-
Based on numerous reports from visitors of Mess.be, a new virus seems to be propagating itself rapidly through MSN Messenger. F-Secure identifies the worm as Bropia.A, other antivirus software (like including Kaspersky) labels it IM-Worm.Win32.VB.a. When received and executed by the victim, the worm places itself in the C directory with a random filename like: sexy_bedroom.pif drunk_lol.pif naked_party.pif webcam_(random number).pif love_me.pif and similar looking names. It then automatically sends itself to active MSN Messenger contacts. It also drops and executes oms.exe, a variant of Rbot, which copies itself as lexplore.exe and adds two registry keys so it will be executed at next system startup. The bot can be used as a backdoor, logging keystrokes, relaying spam and for various other purposes and is therefor a huge security threat to your system. Brobia.A can also disable mouse right button and manipulate Windows mixer volume settings. If you receive a file transfer request for such a file, press ALT-D or click Decline. Don't ever execute the file. If you did, delete the file immediately and permanently from your system (My Received Files and C drive) and take necessary security measures. For more information, visit F-Secure. Source: Mess with MSN Messenger