Saturday, August 11, 2007

recently there is a Trojan virus going around...of course, it's irritating a lot of people, especially since those who got it were just a few days ago. So...i told them to wait a few more days, there's bound to have more people who have the virus too and will resort to posting in forums, blogs and blah blah to cure it. So i shall just copy and paste wad i have found, hope you guys get to clear it. For actual post, pls refer to http://maybeshitwillhappen.blogspot.com/ ...ok, maybe the name is not very nice, but who cares. =X

This variant is very similar to the earlier variants. It also can send out different messages according to the different operating systems and send out the .zip file with random combination with "photo_albumXX.zip, photos2007_XX.zip, imagesXX.zip, photoXX.zip (XX is random digitals, such as photos2007_79.zip, photo12.zip)".

These messages will be as the following:
What do you think of this picure? I feel i look ugly : /
Here's a new pic of me Here's a new pic of me
A few pictures from last week, see if you like em A few pictures from last week, see if you like em
Have you seen this picure yet?
Have you seen this picure yet?
Haha, is that you on that picture?
Haha, is that you on that picture?
Should i use this picture on msn?
Should i use this picture on msn?
What do you think about this?
What do you think about this?

W32.Mimbot.A is a worm that spreads by sending a copy of itself through MSN Instant Messenger and opens a back door on the compromised computer.

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low
• Payload: Opens a back door.

Distribution

• Distribution Level: Medium
• Name of Attachment: PictureAlbum2007.zip

Solution:

1. Force your pc to shut down. Press restart button or power off button if shut down doesnt work.
2. Plug out ur telephone line.
3. Turn on ur computer and go to Run: regedit

4. Go to HKEYLOCAL_MACHINESOFTWARE
MicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad

5. Find the key "Prodigy1". Note down the value under Data, then delete "Prodigy1".
6. Go to HKEY_CLASSES_ROOTCLSID. Find the value u've jot down in #3 n if u find it, delete.

7. Go to C:Windows. Search for *.zip and PictureAlbum2007.zip should show. Delete it.
8. Restart your comp. Before it reaches windows, press F8 & restart comp in safe mode.

9. When in safe mode, go to C:Windows. Search for prodigy. Delete Prodigys323.dll or sthg similar.
10. Restart your computer normally! Voila!! YAY!!

butterfly heaven
5:01 PM