Wednesday, June 4, 2008

Live messenger new virus: Is this your photo? http://myspaces.110mb.com/index.php?=youremail@hotmail.com

A new kind of worm hits Windows Live Messenger.




How it works?

Clicking on the received link will execute the worm and infect the computer. In this way it will continue to spread itself to other users. It copies itself to the Windows folder and runs in stealth all the time. It may run under the name wksvcsc.exe causing MSN messenger to send out auto messages to all people on user’s MSN-friend list. Its purpose is to spread itself through social engineering techniques, which make victims believe they received the link from a trustworthy source.
This virus writes a sentence like this:

Is this your photo? http://myspaces.110mb.com/index.php?=youremail@hotmail.com

or

Is this your photo? http://youtube.my3gb.com/index.php?= youremail@hotmail.com

To delete it if you're pc was infected you have to install msn cleaner by InfoSpyware or Ad-Aware by Lavasoft.
If you want to do it manually:

1) Stop the process wksvcsc.exe (go to task manager and stop it)
2) Delete the registry key /HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/Windows UDP Control Service: wksvcsc.exe
(Start -> Run -> "regedit", navigate to the key and delete it)

Reboot and see if the process starts again by repeating step 1.

1 comment:

gb said...

How do I remove from a mac?