VoIP operator Skype is warning its Windows-based users of a new worm which spreads by sending links to users via the Skype application’s integrated chat feature. Users receive a message which appears to be from someone on their contact list, asking them to click a link. The messages are “cleverly written” to appear like typical chat messages, and appear to contain a link to a JPEG image. The link actually points to an executable file; if Windows-based users click the link (and give permission to save or run a .scr file) the user’s computer will be infected with the w32/Ramex.A worm. The worm uses Skype’s public API to access the user’s computer.
Please note that Skype users ONLY become infected after they have downloaded the link and run the malicious software. The chat message, of which there are several versions, is cleverly written and may appear to be a legitimate chat message, which may fool some users into clicking on the link.
Manual Instruction for Removing the WORM
There are two ways to get rid of the worm: the normal way and the techhead way. Most users should NOT attempt to edit their computer’s registry manually. For most people, downloading and/or updating their anti-virus software, and scanning their computer to detect and remove the worm, is the way to go.
Expert users — and only expert users — who know what they’re doing can also remove the worm manually.
1. Restart the PC in safe mode
2. Run regedit
3. Go to HKLM/software/microsoft/windows/currentversion/runonce find entry with mshtmldat32.exe. Delete this entry.
4. Go to Windows\System32 directory and delete following files: wndrivs32.exe, mshtmldat32.exe, winlgcvers.exe, sdrivew32.exe
5. Go to windows/system32/drivers/etc
6. Find file hosts
7. Open it with notepad, ctrl+a and delete all entries (this will resume your antivirus updates), save, close.
8. Restart the PC.
Source:
http://heartbeat.skype.com/2007/09/the_worm_that_affects_skype_fo.html
http://news.digitaltrends.com/news/story/14129/worm_wriggles_into_skype_for_windows