New Virus (Worm) effects MSN Messenger

[Slappie 9]

New MSN Messenger Worm Win32.Bropia.A

For those of you who use MSN Msg, like myself. Your best protection is not to accept or open files. Unless you're 100% sure of the origins.

Quote

Bropia.A spreads by sending itself to contacts using MSN Messenger. It sends itself using one of the following names:

Drunk_lol.pif
Webcam_004.pif
sexy_bedroom.pif
naked_party.pif
love_me.pif


When run, Bropia.A creates two files in the root directory of the current drive (usually c:\). The first file is a copy of the worm itself, using one of the following file names:


Drunk_lol.pif
Webcam_004.pif
sexy_bedroom.pif
naked_party.pif
love_me.pif


The second file is called "oms.exe", and is a variant of the Rbot worm family, called Win32/Rbot.BMB. Information on Win32/Rbot,


Bropia.A drops and executes the file called "oms.exe", which is a worm and IRC bot called Win32/Rbot.BMB. If any of the following files exist, however, it will not drop Rbot.BMB:


%System%\adaware.exe
%System%\VB6.EXE
%System%\lexplore.exe
%System%\Win32.exe


Bropia.A also attempts to stop the user from running several programs, such as Windows Task Manager. It disables the right mouse button, and the 'ctrl-alt-delete' key combination. It also opens the files %System%\cmd.exe and %System%\taskmgr.exe and locks them, so they can not be executed.

The worm also sets the audio volume to zero.

"Find out just what any people will quietly submit to and you have found out the exact measure of injustice and wrong which will be imposed upon them."

[BlueEyedMonster 0]

For those you that don't like MSN messenger, the best way is to use Add/Remove programs then Add/Remove windows components. And remove that pesky little messenger program.

[CrazyIvan 0]

VIVA YAHOO MESSENGER!!!

__________________________________________
Blue Skies and May the Force be with you.