WORM SPREADS IN THE WILD
Virus Name : W32.Reatle@mm
Alias : W32/Lebreat.A,
Virus type : Internet
level : Medium
Reatle is a mass mailing
and network Worm, spreads using e-mail
attachments and exploits a remote code execution
vulnerability LSASS explained by Microsoft
Security Bulletin MS04-011.
infected mail subject will be
one of the following
Mail Delivery System
**WARNING** Your Account Currently Disabled.
Message could not be delivered
infected mail message body will
be one of the following
message is available.
are your banks documents
Notification checkout the attachment for more
message contains Unicode characters and has been
sent as a binary attachment.
The original message was included as an
We have temporarily suspended your email account
checkout the attachment for more info.
You have successfully updated the password of
your domain account checkout the attachment for
Your Account Suspended checkout the document.
Your credit card was charged for $500 USD. For
additional information see the attachment.
Your password has been updated checkout the
checkout the attachment.
I was in a hurry and I forgot to attach an
document. Please see attached.
infected mail attachment will be
one of the following
infected mail sample is given below
When the infected
attachment is executed, copies itself to Windows
System folder as ccapp.exe, Windows.exe and
attach.tmp in the background.
W32.Reatle@mm modifies registry run section to
load automatically on the next startup. The
registry modification is given below.
W32.Reatle@mm uses its
own SMTP engine to send infected mails. It also
performs DoS attack on security related web site.
Reatle worm disables security features in Windows
systems. It also downloads another worm in the
infected system. Reatle worm appeared on 15th
How can I protect my
Solo has incorporated
W32.Reatle@mm in its signature file to protect
users from this worm attack. Make sure that you
have installed registered version of Solo
Antivirus to protect your system from all virus
to remove this worm?
If you are already
infected with this worm, download and install
security patches from the link http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx. Then run Solo
anti-virus scanner to remove the worm components.
antivirus can detect and remove W32.Reatle@mm and
its variants safely. Use the following
link to Download 30 day trial version of
remove viruses from your computer.
Solo anti-virus not only
scans for all viruses, it contains a unique System
Integrity Checker to protect you from
New Internet Worms, Backdoors and
malicious VB, Java Scripts. It also
effectively removes all existing Internet Worms,
File viruses, malicious VB, Java scripts,
Trojans, Backdoors, boot sector, partition table
and macro viruses.
purchase Solo antivirus using the link