emanuel.exe
Originally Spotted 15/11/00

E-Mail Message Received (please note different mails may differ slightly)

Subject: VIRUS ALERT URGENT PLEASE READ

Dear All

If you receive an email with an attachment called Emanuel.exe do not open it. This contains a virus. The subject header is not important If you receive multiple copies of the same email please delete them as they also contain the same virus.

Diagnosis

This is a virus named W32/Navidad-B. If the attached program is launched, it displays a dialog box containing the text ";)".

It then attempts to read new email messages and to send itself to the senders' addresses. If the attached program is launched, it displays a dialog box containing the text ";)". It then attempts to read new email messages and to send itself to the senders' addresses.

The worm copies itself into the Windows system directory with the filename WINTASK.EXE and changes the registry so that it runs on Windows startup and before any file is run. The worm also installs itself into the system tray.

If the user clicks on the icon, it displays a dialog box with the text "Nunca presionar este boton".

If the user clicks the button, the worm displays a dialog box with the title "Emmanuel....." and the text "Emmanuel-God is with us!May god bless u.And Ash, Lk and LJ!!".

If the user does not press the button but instead attempt to close the message the worm displays a message with the title "Emmanuel....." and the text "May GOd bless u;D";