Home Forums Windows 7 Security Tips

Windows 7
Windows Vista
Windows XP

Security Tips
Keyboard Shortcuts


Internet Terms
Computer Terms

File Extensions (75)
File Extensions (15K+)

Startup Applications
Necessary Files
Useless Files
At Your Option Files
Dangerous Files
Browser Objects

DLL Files
SYS Files
INF Files
OCX Files
VXD Files

Virus Database
Virus Warnings

Easter Eggs
Tips and Tricks
Hot Downloads

Privacy Policy
Contact Us


Name msys32.exe


I-Worm.Masana is a worm virus spreading via the Internet as an attachment to infected emails.
The worm has bugs in its code; as a result some of its routines don't work.
Copies itself into the Windows system directory with under the msys32.exe name and registers this file in the system registry or in the SYSTEM.INI auto-run keys:
shell=Explorer.exe msys32.exe -dontrunold

Also, creates two additional files on disk that manage the exploit: ERunAsX.exe; ERunAsX.dll
Then creates another copy of itself under the name EEXPLORER.EXE name and by using DepPLoit exploit starts this copy with administrator rights.

To send infected messages the worm uses Windows MAPI functions.
To get victim email addresses Masana:
- looks for *.HTM* files and extracts email-like strings
- by using Windows MAPI functions it reads all unread messages from the Inbox and answers them.

This worm also:
- disables the MS Outlook Express 5.0 MAPISendMail warning.
- adds to the system the user named masyanechkaa with Admin privileges (under Windows NT)

Automatic removal: Use antivirus (also check How To Remove section)Startup Optimizer to remove it from startup.

Still have a problem? Ask for help at our discussion forum.

Search Dangerous Files :

: : Recent posts at Forums : :

Fatal error: Incompatible file format: The encoded file has format major ID 1, whereas the Loader expects 7 in /home/software/public_html/forum/includes/functions_vbseo.php on line 0