A recently discovered virus codenamed Win32.NiceHello.A@mm is spreading as an e-mail attachment and targets MSN Messenger users.
The virus sends email messages (in the format described above) to the user"s MSN/.NET Messenger"s contacts to mass-multiply itself. It also tries to send a notification email:
From: nemesis@olimpo.comTo: jcrivas77@yahoo.com
Subject: Hello world :) have a nice day
Body:
Eventually, a message box with "Microsoft Windows XP or greated required!" appears.
- How to see if you"re infected:
- The file "systemsys64dvr.exe" or "system32sys64dvr.exe" exists in the Windows folder.
- There"s a registry entry "HKLMSoftwareMicrosoftWindowsCurrentVersionRunSystem 64 Driver for Games" = "sys64drv.exe".
Delete this file and registry entry to disinfect.