New Worm Targets Microsoft Messenger Programs

A new worm, distributed as a Windows .EXE file attachment to a mass email, is one of the first to involve Microsofts instant messenging programs in its exploit. Reports are somewhat in conflict on exactly what it does, but prevention and containment appear to be easy.

The W32.Nicehello@mm worm shows up as a 99,328 byte attachment to an email with one of a small number of possible subject lines. The list of subject lines and file names for the attachment may be found at the description at the Symantec Antivirus Research Center (SARC). SARC goes on to say that the worm attempts to steal Microsoft MSN and .NET Messenger passwords. Symantec added this worm to their LiveUpdate virus definitions on 3/12/03.

Once executed, the program copies itelf to the Windows directory as “systemsys64dvr.exe” or “system32sys64dvr.exe” and creates the registry entry “HKLMSoftwareMicrosoftWindowsCurrentVersionRunSystem 64 Driver for Games” = “sys64drv.exe”. You can check to see if you are infected by checking for these files, and manually disinfect your system by removing them. Windows NT/2K/XP users should also Terminate the process in Task Manager. Windows 95/98/ME users can remove it from memory by rebooting to safe mode.

According to a description at the BitDefender site, the program then sends a notification containing the users Messanger user name and password to a particular Yahoo.com address. Then it sends infection messages to the users MSN/.NET Messengers contacts. SARC says that it sends itself to entries in the Windows Address Book, which is not the same thing.

Because this file arrives as a .EXE attachment it will be blocked by any recent version of Microsoft Outlook or older versions with proper security patches installed. Of course, all users should be skeptical of file attachments, especially executable ones.