Path : %SYSTEM%\windows.exe
[ C:\Windows\System32\windows.exe ]
type : Internet
Name : W32.Reatle@mm
Alias : W32/Lebreat.A,
Net-Worm.Win32.Lebreat.gen, WORM_REATLE.A, WORM_REATLE.C,
level : Low
Windows.exe is dropped by
Reatle worm. It is a mass mailing and network
Worm, spreads using e-mail attachments and
exploits a remote code execution vulnerability
LSASS explained by Microsoft Security Bulletin MS04-011.
infected mail subject will be
one of the following
Mail Delivery System
**WARNING** Your Account Currently Disabled.
Message could not be delivered
infected mail message body will
be one of the following
message is available.
are your banks documents
Notification checkout the attachment for more
message contains Unicode characters and has been
sent as a binary attachment.
The original message was included as an
We have temporarily suspended your email account
checkout the attachment for more info.
You have successfully updated the password of
your domain account checkout the attachment for
Your Account Suspended checkout the document.
Your credit card was charged for $500 USD. For
additional information see the attachment.
Your password has been updated checkout the
checkout the attachment.
I was in a hurry and I forgot to attach an
document. Please see attached.
infected mail attachment will be
one of the following
infected mail sample is given below
When the infected
attachment is executed, copies itself to Windows
System folder as ccapp.exe, Windows.exe and
attach.tmp in the background. W32.Reatle@mm
modifies registry run section to load
automatically on the next startup. The registry
modification is given below.
W32.Reatle@mm uses its
own SMTP engine to send infected mails. It also
performs DoS attack on security related web site.
Reatle worm disables security features in Windows
systems. It also downloads another worm in the
infected system. Reatle worm appeared on 15th
How can I protect my
Solo has incorporated
windows.exe in its signature file to protect
users from this worm attack. Make sure that you
have installed registered version of Solo
Antivirus to protect your system from all virus
to remove this worm?
If you are already
infected with Windows.exe process, download and
install security patches from the link http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx. Then run Solo anti-virus
scanner to remove the worm components.
antivirus can detect and remove W32.Reatle@mm and
its variants safely. Use the following
link to Download 30 day trial version of
Solo antivirus to remove viruses from your
Solo anti-virus not only
scans for all viruses, it contains a unique System
Integrity Checker to protect you from
New Internet Worms, Backdoors and
malicious VB, Java Scripts. It also
effectively removes all existing Internet Worms,
File viruses, malicious VB, Java scripts, Trojans,
Backdoors, boot sector, partition table and macro
purchase Solo antivirus using the link