New MSN Messenger Virus/Worm spreading
Thursday, October 27, 2005 (03:03:56)
Posted by admin
A new worm/virus is currently spreading via MSN Messenger.
You may receive a message from a contact similar to the following format:
wow, this is you? http://www.messengerstats.net/profile.php?msn=email@hotmail.com
Do not click on the link within the message!
Update:
Although the threat seems to have been resolved, you should still not click on similar messages through MSN Messenger as other variants may be released.
This new MSN Messenger worm executable extracts 3 files to WINDOWS\system32\(random folder name)\. They are:
- csrss.exe
- smss.exe
- csrss.ini
All 3 files have the system and hidden flags set. Task Manager will not kill either of these processes, so go get a copy of 'Process Explorer' at www.sysinternals.com to kill them, and be sure not to kill the actual system processes!
Thanks to Jack Kaufman for the information above.
|