icex _
Premium
join:2004-05-22
USA
clubs:
 ·Colane Cable
| New virus going around on msn messenger? People are realy starting to annoy me on msn messenger. Not sure what virus this is or how it got started, but people have been messaging me the following:
`~~{**namehidden**}~~ says:
hey is it really you on this pic msnprofiles.ms.funpic.de/viewimage.php?=someemail@hotmail.com
I deleted » to disable it.
When opened, it asks to run a ms-dos file. Obviously I dident. But if anyone that examins these files can examine it and see what it is so I can help people on my list (hopefully) get rid of it, it'd be appreciated. I'm not sure if its even on anti-virus's or not yet, which is why I'm wondering what it is..
--
Team Discovery | |
|
 |
Seattle206
@cablespeed.com | I have had this sent to me 4 times today. Id didnt open it but my friends did.
Any threads on how to remove this? | |
|
 | |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
| and since it is related to wkssvc.exe..
you can see it removed here in a hijackthis thread..
O23 - Service: Workstation Service Library (Microsoft Locator Service) - Unknown owner - C:\WINDOWS\wkssvc.exe
»gladiator-antivirus.com/forum/in···exe&st=0
wkssvc.exe is called the postcard virus. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.
You can check to see if wkssvc.exe is running in your registry and kill the process. Disable and remove wkssvc.exe immediately.
And just could be that old one..now being delivered a different way using 'social engineer' via MSN and a web site.
»www.trendmicro.com/vinfo/virusen···VSect=Sn
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/ | |
|
ridingstar
@comcast.net
| The escapestudies.com removal seemed to work pretty well! My friend got this virus, and I was helping him through it (since he wasn't too literate with computers) and everything seems to be working now. No more messages are sending =)
Thanks, Name Game! | |
|
| |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
| There is a cleaning tool at this link that works..
»www.sharebigfile.com/en/file/664···exe.html
but then you also must go into the dos prompt “Start>Run>cmd” and run the command “attrib -h -s -r c:\windows\wkssvc.exe” Once that is completed you run the command “del c:\windows\wkssvc.exe” You might have to run “Start>Run>msconfig” as mentioned earlier to make it so the file does not boot when you start your computer, if you have not done that already. That should get rid of the file itself.
»squidnews.com/2008/01/23/your-ms···nmsncom/
and others sum it up this way..
1.)These 3 files need to be removed:
C:\windows\wkssvc.exe
C:\windows\system32\spool.exe
C:\windows\system32\vsconfig.xml (this file was hard, I had to use a special program to unlock)
2.) Repair the hosts file
3.) Remove all references to wkssvc.exe from the registry.
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/ | |
|
|
|
|
|
|
