New Worm Disabling A/v & Firewalls

pchelpman

Spread over MSN this worm can disable Antivirus/Firewalls.

If you think you may be infected scan your computer with HijackThis. Look at the results but DO NOT CHANGE ANYTHING without advice. These entries will suggest if you have this new infection ....

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gamingunderground.us/index.php
F3 - REG:win.ini: run=C:\WINDOWS\System32\[random foldername]\csrss.exe
F3 - REG:win.ini: run=C:\WINDOWS\System32\[random foldername]\csrss.exe
O4 - startup: csrss.lnk = ?

If you are infected then start a new thread in this forum and someone will help you.

As ever people .... be careful out there.

pchelpman

bump .....

deary65

Would it be this one!

this bug is particularly bad.
read the excerpt from the email alert:

Websense® Security Labs ™ has received several reports of a new worm, "Nugache", which is spreading on AOL/MSN Instant Messenger networks and as an e-mail attachment by exploiting several workstation vulnerabilities. The worm opens a back door on TCP port 8, and installs a bot to wait for commands from the attacker. The command & control channel that is used is unique, as the bot appears to connect to infected peers instead of a static list. A peer-to-peer command & control channel makes it more difficult to block commands issued to the bot. The traffic over this channel also uses obfuscation in an attempt to bypass intrusion detection systems.
http://www.websensesecuritylabs.com/alerts/alert.php?AlertID=478

ollyshaw

There are some emails and alerts like this that are scams too.

The idea goes, if you have "x" in your registary you have some nasty, please delete it and you will be ok.

In fact they have you deleting legit and important windows services. So just be careful!

(Note I am not suggesting that the OP was one of these)

Olly