WARNING!!!!!

To all msn messenger user, plz take note that there is a new virus in the net.
A new MSN virus has started spreading recently, it sends itself to MSN contacts as IMG-0012.zip. Like other variants, it sends sham messages to contacts.

In IMG-0012.zip, there is img0012-www.photostorage.com included, the file size is 25,600 bytes, Kaspersky detects it as Backdoor.Win32.SdBot.bxr, and Worm.MSN.Win32.PhotoCheat.f by Rising Antivirus, Win32.Hack.SdBot.bx.25600 by Kingsoft Antivirus.


DO NOT ACCEPT IT
ALTHOUGH IT COMES WITH A MSG!!!!

Sends messages:

Quotation
Check out my nice photo album. 😀
wanna see the pics from my vacation? :>
Nice new photos of me and my friends and stuff and when i was young lol…
lol remember when you used to have your hair like this
My friend took nice photos of me.
you Should see em loL!
hey i’m going to add this picture of us to my weblog
Here are my private pictures for you

sorry to those who got the msg from me and accept it

HOW TO REMOVE

STEP 1
Delete registry entry:(“Start” menu -> “Run”, type “REGEDIT”.)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“Windows Lsass Services”=”%Windows%\system\lsass.exe”

STEP 2
Restart WINDOWS

STEP 3
Delete virus files: (the lsass.exe is marked as hidden and as a system file under properties.)
%Windows%\system\lsass.exe
%Windows%\IMG-0012.zip

STEP 4
Remove “Windows Sharing” from exceptions tab of Windows Firewall

STEP 5
Set registry data:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
“WaitToKillServiceTimeout”=”20000”

if u do not understand go to this website http://www.cisrt.org/enblog/read.php?162&part=2

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s