Replies

The best solution for this malware is prevention rather than cleanup. Like most malware, it counts on getting a "sucker" to take some action, in this case clicking on a link, in order to install itself.

When it infects a computer, it will likely send a message like this:

hey dude check out this pic of us
coolpic.jpg

Most people, when they get such a message from someone in their buddy list, will assume the link is actually to a picture and click on it. Of course, if you mouse over the (fake) link in my example, you'll see it actually points to a .com file, which is an executable program, even though I falsely labeled it as a .jpg picture file. Clicking on a link to an executable program will run the program, thus installing the malware on your computer and sending the same message to everyone in your buddy list.

The solution is simply not to click on any link anyone sends you via instant messenger program unless you can confirm with them that it is a genuine link and not malicious. It's also advisable to right-click the link and select "Properties" to make sure the link points to what it says it does, such as a .jpg picture or a .html web page, and is not actually a program such as a .com or .exe file. In any case, it is not possible for such a worm to run without action on the part of the user, and avoiding clicking on any link sent by instant messenger will prevent infection of your PC.

On a side note, while I use and recommend Firefox as a better web browser than IE6, it's of no particular help in this case. Yes, it won't get infected, but if you click on an infected link, you will still get this worm on your computer, and it will still attempt to infect everyone on your buddy list. Other malicious effects are also possible.