WORM_XPBAGUIO.A « Padz4download - Free Movies-Software-Music- And Online Bux to Earn

Home » Post Item » WORM_XPBAGUIO.A

WORM_XPBAGUIO.A

August 17, 2007

Derived from Trend Micro.

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FXPBAGUIO%2EA&VSect=T

Technical Details

Arrival Details

This worm may arrive via network shares. It may also arrive via physical and removable drives.

Autostart Techniques

This worm creates the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
WindowNT = "%System%\exiplorer.exe"

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Other System Modifications

This worm creates the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
LegalNoticeCaption = "PROMISE???"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
LegalNoticeText = "I am still waiting for the strawberry coming from my Baguio! Pls.. Help!"

Propagation via Network Shares, Physical, and Removable Drives

This worm enumerates drives and drops copies of itself in all available network shares, physical, and removable drives.

It drops an AUTORUN.INF file to automatically execute dropped copies when the drives are accessed. The said file contains the following strings:

[autorun]
shellexecute= {Malware file name}.exe

Other Details

This worm displays the following message box(es):

${WORM_XPBAGUIO.A}$

Platforms Affected

This worm runs on Windows 98, ME, NT, 2000, XP, and Server 2003.

Solution:

Identifying the Malware Program

To remove this malware, first identify the malware program.

Scan your computer with your Trend Micro antivirus product.
NOTE the path and file name of all files detected as WORM_XPBAGUIO.A.

Trend Micro customers need to download the latest virus pattern file before scanning their computer. Other users can use Housecall, the Trend Micro online virus scanner.

Terminating the Malware Program

This procedure terminates the running malware process. You will need the name(s) of the file(s) detected earlier.

If the process you are looking for is not in the list displayed by Task Manager, proceed to the succeeding solution set.

Open Windows Task Manager.
• On Windows 98 and ME, press
CTRL+ALT+DELETE
• On Windows NT, 2000, XP, and Server 2003, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the malware file(s) detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
Do the same for all detected malware files in the list of running processes.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.

*NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process.

On computers running all Windows platforms, if the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure, noting additional instructions. If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.

Removing Autostart Entry from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup.

If the registry entry below is not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
WindowNT = "%System%\exiplorer.exe"
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Removing Added Registry Entries

Still in the Registry Editor, in the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows NT>CurrentVersion>Winlogon
In the right panel, locate and delete the entry:
LegalNoticeCaption = "PROMISE???"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows NT>CurrentVersion>Winlogon
In the right panel, locate and delete the entry:
LegalNoticeText = "I am still waiting for the strawberry coming from my Baguio! Pls.. Help!"
Close Registry Editor.

Restoring AUTORUN.INF

Right-click Start then click Search… or Find…, depending on the version of Windows you are running.
In the Named input box, type:
AUTORUN.INF
In the Look In drop-down list, select a drive, then press Enter.
Select the file, then open using Notepad.
Check if the following lines are present in the file:
[autorun]
shellexecute= {Malware file name}.exe
If the lines are present, delete the file.
Repeat steps 3 to 6 for AUTORUN.INF files in the remaining removable drives.
Close Search Results.

Running Trend Micro Antivirus

If you are currently running in safe mode, please restart your computer normally before performing the following solution.

Scan your computer with Trend Micro antivirus and delete files detected as WORM_XPBAGUIO.A. To do this, Trend Micro customers must download the latest virus pattern file and scan their computer. Other Internet users can use HouseCall, the Trend Micro online virus scanner.

credited by: Sir Billie

Share and Enjoy:

Posted by malloveras at 9:13 am | permalink

Previous Comments

Dear Sir Billie,

Just want to thanks for the information that you’ve share via internet. Thank you very much.

Hope that i can also share some information someday.

Posted by peejay Euebio at September 27, 2007, 1:02 pm

Ugg Australia story began in 1978, when Brian Smith, a young surfer from Australia, took a trip to the United Sates with a bag full of sheepskin boots - UGG Boots.Nowadays Ugg sale is the best popular sheepskin boots loved by people from all over the world.Ugg sale boots are traditionally made from the australia finest twinface sheepskin.

Posted by ugg sale uk at November 19, 2010, 4:42 pm

Came across your blog when I was searching bing I have found the bit of info that
I found to be quite useful. You can visit my site about

Posted by nikeair jordans at November 27, 2010, 11:53 am

Trains run faster depends on the front with a brick I was needed there where the revolutionary move …

Posted by coach stores at December 14, 2010, 2:27 pm

Great, practical and much needed advice *

Posted by coach bags at December 17, 2010, 9:48 am

*People are always telling you what to do, but what’s right for them may not be right for you.

Posted by Christian Louboutin Replica at January 4, 2011, 8:26 am

Ugg boots,a symbol of fashion that almost everyone want to own a pair of ugg sale boots all over the world http://www.saleuggbootsonline.co.uk/

Posted by ugg sale at January 5, 2011, 1:29 pm

Your presence is a gift to the world.

Posted by supra shoes at January 6, 2011, 1:17 pm

Pretty good post. I just came upon your blog and wanted to say that I have really enjoyed reading your blog posts.

Posted by coach outlet at January 7, 2011, 11:11 am

nowadays,here are many people search online for the news and plays but most of people online for buying the goods ,and it is so safety and quickly to get the goods online store.
we would like to share with you about our goods, we had the latest lebron james and kobe bryant basketball shoes,for example;nike lebron VIII ,zoom kobe bryant VI6,nike hyperdunk 2010 basketballshoes, and we aslo have the whole nike air max series,such as nike air max 2010 tailwind shoes,air max 2009 running shoes,air max 24-7 sneakers,air max 90 and so on ,if you are looking for the classic nike air max shoes or basketball shoes shoes,it is a good way to get airmaxhere online shop to get you lover.

Posted by nikelebronVIII at January 26, 2011, 7:34 pm

Thanks a lot for sharing. You have done a brilliant job. Your article is truly relevant to my study at this moment, and I am really happy I discovered your website. However, I would like to see more details about this topic. I’m going to keep coming back here.

Posted by fzqi boss at March 18, 2011, 2:04 pm

There are plenty of other prom dresses to getting your prom dress online, which include prom dresses, prom dresses, Plus-size prom dresses,you dont have to go out to find the discount prom dress – you can wait for the prom dress and wedding dresses, quinceanera dresses quinceanera dresses to come to you.

Posted by prom dress at March 24, 2011, 9:51 am

Really important written content. the information that you shown is hard to trust and many wonderfully i liked the way you provide things here.

Posted by panache at May 5, 2011, 10:09 am

2VThere is noticeably a bundle to learn about this. I assume you made sure nice points in features also.

Posted by hollister clothing at May 19, 2011, 12:37 pm

17I so enjoyed every bit of this site and I’ve bookmarked your blog to keep up with the new topics you will post in the future.

Posted by abercrombie london at May 19, 2011, 8:17 pm

shoes louboutin is the top sellers.

Your article is so helpful. I’m a faithful fan and have heard that all the christian louboutin over the knee boots from online shop are much cheaper.
??christian louboutin pump?? is very popular. Recently my friend and I always play them.

my body has adjusted now and the christian louboutin shoes cheap feel really good.

christian louboutin poseidon 120 pumps Shoes,Free shipping and nontax,only need 1 week to your door!More you order,more discount you got,purchasing now!

The laboutin is one of the most popular people’s laboutin.

I had buy many shoes from louboutin shoes website, this web cheap price and good quality.

You should own louboutin chaussures and join in the fashion.

The shoes uk online shop which have vegetate acknowledged as uptown, chin-up and wont looking position shoes uk online shop

We sales christian louboutin replica sneakers for the best prices .

we sell the best christian louboutin sandals SHOES in our store.

A christian louboutin pumps is something that gives you a new lifestyle and make your personality as a new character.

All kinds of louboutin flats on sale, order the best shoes in our louboutin flats web.

christian louboutin pumps are made from the highest quality parts and crafted with such attention to detail.

christian louboutin sandals On Sale,We are professional supply christian louboutin sandals now,buy more,save more,what are you waiting for?Enjoying shopping now!

100% Authentic, 50% discount louboutin.

By now, the louboutins shoess under sales promotion, they are so cheap online.

We only sell authentic louboutin. No variants and no fakes. You can login our site to login an account and order the product with your credit card and paypal. If you order now, you will enjoy our special offers and gifts.

Cheap and High-quality christian louboutin flats platform.Free shipping.

louboutin pumps is very popular as stylish and comfortable shoes to all type of ages.

Posted by ddddd at May 28, 2011, 5:35 pm

I like this good post. Also I hope I can introduce you to our New York Giants Jerseys online store. You can buy any NY Giants Jersey you want. Here we not only sell Eli Manning jersey, but also Harry Carson jersey and Jason Pierre-Paul jersey. We are sure you will enjoy them!

Posted by giants jerseys-outlet at June 9, 2011, 2:37 pm

11. I like the valuable info you provide in your articles. I will bookmark your weblog and check again here regularly. I’m quite sure I’ll learn many new stuff right here! Best of luck for the next!

Posted by tiffany uk at June 9, 2011, 7:39 pm

12. The content of your blog is exactly what I needed, I like your blog, I sincerely hope that your blog a rapid increase in traffic density, which help promote your blog and we hope that your blog is being updated and placed can always be richer and more colorful.

Posted by chinese tea at June 9, 2011, 9:20 pm

louboutins outlet Nike Dunks position can be crowing described,we all like louboutins outlet.

welcome to buy christian louboutin sample sale invite!thank you!
Promod sell their own branded quality christian louboutin bond street, most of which are in the style of some more expensive designer labels.

It is very simple that the victoria beckham christian louboutin shoes of getting healthy starts by promoting a positive view of life.

excellen quality brand louboutin peep toe pumps save 60%on discount price now!

Purchasing the louboutin d orsay armadillo shoes on line,you will find the louboutin d orsay armadillo with the fast free shipping and best customer service.

Our company is a professional manufacturer specialized in fashion louboutin mary janes.

don’t hesitate,just come to our online shop to catch the opportunity once in the blue moon,to pick up and buy our louboutin sneakers.

louboutin uk online made full use of environmentally friendly materials, including inner packaging, leather and heel stabilizer and so on.

We have the best price and free shipping for the louboutin over the knee boots.

To buy the chanel purses product, the easier has been formed by christian louboutin online store online.

louboutin sample sale london make you healthier.

welcome to choose cheap shop christian,you will like it.

However, They did not notice that long-term to wear high heels would hurt the foot, now louboutin pumps compare with high-heeled.

We provide christian louboutin slingback with high quality and lowest price.

Buy christian louboutin slingbacks , enjoy christian louboutin slingbacks 30%-70% Off.

disount christian louboutins shoes shoes are the trends.

Every time I get the urge to finally give into a designer travel piece, I reconsider it and settle for christian louboutin eugenie shoes that I could use everyday instead.

Thanks for sharing your article. As a sports fan I adore all kinds of sports equipments. I’ve got louboutins.

louboutin online shopping include allure and frolic. our family all like louboutin online shopping

Posted by sas at June 16, 2011, 9:06 am

buy wow gold
account for wow
wow account
dump truck

Posted by wow gold at August 18, 2011, 5:12 pm

When you live in a way that frees you to welcome whatever comes fake oakley sunglassesI wonder how you got so good.cheap oakleys

Posted by cheap oakleys at August 24, 2011, 9:27 am

The legendary Air Jordan 11 was first released for for 1995-96 season. The Air Jordan 11 are the most famous and most popular model of the Air Jordan line.jordan retro 11 cool grey

Posted by jordan 11 retro at August 24, 2011, 9:27 am

The stories are like reflections of what I am going through in my life.cheap ray ban sunglasses I will necessarily write that I think.

Posted by pasta coupon at September 19, 2011, 9:52 am

UGG Australia Boots

Classic UGG Boots
UGG Boots For Sale
Genuine UGG Boots Sale
UGG Boots On Sale

Cheap Uggs Boots
Ugg Boots Cheap
Ugg Sale
Uggs Offical

UGG Boots Outlet
UGG

UGG Boots
UGG Classic Cardy 5819
UGG 3066 Lattice Cardy
UGG Classic Mini Boots
Cheap UGG Classic Cardy Boots 5819 Black Onsale
UGG Classic Cardy Boots 5819 Chocolate
UGG Classic Cardy Boots 5819 Grey Black
UGG Classic Cardy Boots 5819 Grey Online Cheap Sale
UGG Classic Cardy Grey Boots 5819
UGG Classic Cardy White Boots 5819
Black UGG 3066 Lattice Cardy Boots
Blue UGG 3066 Lattice Cardy
Navy UGG 3066 Lattice Cardy
Pink UGG Australia 3066 Lattice Cardy
UGG 3066 Lattice Cardy Chocolate Boots
UGG 3066 Lattice Cardy Grey Boots
UGG 3066 Lattice Cardy Sand Boots
UGG 3066 Women’s Lattice Cardy Green
UGG 3066 Women’s Lattice Cardy Red Boots
UGG Australia 3066 Lattice Cardy Purple Boots
UGG Australia Lattice Cardy Chestnut 3066 Boots
UGG Classic Mini 5854 Boots Black
UGG Classic Mini 5854 Boots Chestnut
UGG Classic Mini 5854 Boots Chocolate
UGG Classic Mini 5854 Boots Dark Blue
UGG Classic Mini 5854 Boots Grey
UGG Classic Mini 5854 Boots Pink
UGG Classic Mini 5854 Boots Sand

UGG 1878 Fringe Cardy Boots
Black UGG 1878 Fringe Cardy Boots
Charcoal UGG 1878 Fringe Cardy Boots
Cheap White UGG 1878 Fringe Cardy Boots Onsale
Purple UGG 1878 Fringe Cardy Boots
Ugg Bailey Button Triplet 1873
Black Ugg 1873 Bailey Button Triplet Boots
Chestnut Ugg Bailey Button Triplet 1873 Boots
Reddish Sand Ugg Bailey Button Triplet 1873 Boots
Ugg 1873 Bailey Button Triplet Blue Boots
Ugg 1873 Bailey Button Triplet Boots Grey
Ugg Bailey Button Triplet 1873 Boots Chocolate

UGG 5715 Lo Pro Classic Tall

UGG 5715 Lo Pro Classic Tall Blue Boots
UGG 5715 Lo Pro Classic Tall Chocolate Boots
UGG 5715 Lo Pro Classic Tall Pink Boots
UGG 5715 Lo Pro Classic Tall White Boots
UGG 5734 Roseberry Boots
Cheap UGG 5734 Roseberry Chocolate Boots Onsale
UGG 5734 Roseberry Boots Black
UGG 5734 Roseberry Sand Boots

Posted by nikefree at September 23, 2011, 5:53 pm

You have made my day! Thanks again
Excellent read, I just passed this onto a colleague who was doing some research on that. And he actually bought me lunch since I found it for him smile Therefore let me rephrase that:
Arizona Contractor
Motorcycle Parts

Posted by Arizona Contractor at September 28, 2011, 9:51 am

If you are into Abercrombie and Fitch, Raining Hollywood can offer you hundreds of selections from this brand. You can choose according to the style, color, model, and design that you prefer. cheap puma shoes and cheap puma shoes free shipping and cheap puma shoes shop and men puma shoes

Posted by cheap womens puma ferrari shoes at October 24, 2011, 11:36 pm

oh my!! i love you so much!!

Thank you so much.

http://www.louisvuitton4lover.com/

Posted by Louis Vuitton outlet at October 25, 2011, 4:44 pm

I like your blog,It is very good.air griffey,The article is great.air griffey max

Posted by air griffey max at November 14, 2011, 2:07 pm

cost ugg boots

be more cheap uggs fashion and health,cost ugg boots or otherwise not,s uggs outlet no wonder,Apart from the looks uggs on sale of it,we are always www.uggsonsalewolaiye.com
Related:
1 2 3 4 5 6 7 8

Posted by sunnyfel at December 2, 2011, 1:20 am

They should have been raised by those Americans who share the view of the late Justice Learned Hand that right conclusions Nike Mercurial Vapor Yellow Black are more likely to be gathered out of a multitude of tongues than through any kind of authoritative selection. Advocates for the networks have claimed a First Amendment right to the same nike total 90 laser held by the great newspapers of America. The three or four competing television stations control virtually all that Synthetic Soccer Cleats can be received over the air by ordinary television sets. But besides the mass circulation dailies, there are weeklies, monthlies, out-of-town newspapers and books. If Yellow Soccer Cleats doesn’t like his newspaper, he can read another from out of town or wait for a weekly news magazine. It’s not ideal, but Soccer Cleats On Sale is infinitely better than the situation in television. ZBY http://www.soccer4shoes.com/

Posted by Nike Mercurial Vapor Purple at December 9, 2011, 10:35 am

This is a Professional blog,great you can write so beautiful.

Posted by Moncler Sale at December 10, 2011, 9:29 am

Ah well your comment! I did you good!

Posted by Office 2010 at December 12, 2011, 2:53 pm

Large fashion of wholesale scarves are offered here. Fashion burberry scarves is beauty favorite. Each people all want to have fashion scarves. They have a lot of the scarves for women. When you see the number of silk scarves and winter scarves cheap for surprise!!!!!

Posted by wholesale scarves at January 6, 2012, 3:03 pm

Large fashion of jordan retro 6 are offered here. Fashion jordan 6 rings is beauty favorite. Each people all want to have air jordan retro 6. They have a lot of the air jordan 6. When you see the number of jordan 6 shoes and jordan 6 cheap for surprise!!!!!

Posted by cheap air jordan 6 at January 6, 2012, 3:16 pm

I will keep your new article. I really enjoyed reading this post, thanks for sharing.

Posted by Microsoft Office 2007 at January 20, 2012, 10:44 am

...........<<<Pa d foot>>>.....

WORM_XPBAGUIO.A

Previous Comments

Add a comment

Email me!!!!

Archives

About Me

Latest Items

Popular

Subscribe

Visitors

Rescent Viewers

Web/Blog

Comment

Message Board