New Worm Targets Microsoft Messenger Programs
W32.Nicehello@mm worm attempts to steal MSN/.NET Messenger passwordsA new worm, distributed as a Windows .EXE file attachment to a mass email, is one of the first to involve Microsofts instant messenging programs in its exploit. Reports are somewhat in conflict on exactly what it does, but prevention and containment appear to be easy. The W32.Nicehello@mm worm shows up as a 99,328 byte attachment to an email with one of a small number of possible subject lines. The list of subject lines and file names for the attachment may be found at the description at the Symantec Antivirus Research Center (SARC). SARC goes on to say that the worm attempts to steal Microsoft MSN and .NET Messenger passwords. Symantec added this worm to their LiveUpdate virus definitions on 3/12/03.
Once executed, the program copies itelf to the Windows directory as "systemsys64dvr.exe" or "system32sys64dvr.exe" and creates the registry entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\System 64 Driver for Games" = "sys64drv.exe". You can check to see if you are infected by checking for these files, and manually disinfect your system by removing them. Windows NT/2K/XP users should also Terminate the process in Task Manager. Windows 95/98/ME users can remove it from memory by rebooting to safe mode.