marketingshift.com— There is a new AIM virus going around claiming to be an updated myspace picture. This could have the potential to be extremely wide spread so def Digg this in hopes to let others know.
Dec 6, 2005View in Crawl 4
There will be a file called dr.exe or drme.exe in the root of the drive where your operating system is loaded. Mine is on the C: Drive so it was located in root of C:.1. Delete C:dr.exe or C:drme.exe file.2. Show all hidden files and folders in the Folder Options from the Tools menu in explorer.3. Stop the SCVHOST.EXE service in Task Manager. NOTE: Do not confuse this with SVCHOST.EXE or it will cause your system to shutdown if you terminate the task.4. Delete the file C:Windowsscvhost.exe5. Clear your temporary internet files from IE and all the offline content.6. Delete the dr.exe from the C:WindowsPrefetch (if it resides there)
I got this through MSN Messenger... well... Windows messenger, but it's the same thing really. It said something like "Check out these pictures of us on Myspace!" and then a hyperlink like <a class="user" href="http://19185.myspace.com">http://19185.myspace.com</a> or something, only if you click on the link it installs something to your computer instead of opening a myspace site. As far as I can tell, all it does for me is send the link to anyone on my contact list who's online, but when it does that I can't talk to them anymore, although I remain signed in, and signing out and in again lets me talk again, but the virus sends again when I do. It seems to be a minute or so after I sign in, but never a long time. It created a file called "myspace" in C: (not subfoldered or anything, you could see it as soon as you got there) that had the msn icon, but you can't delete it (access is denied), my anti-virus program doesn't pick it up, neither does my anti-spyware. Also, moving it to a different part of the computer doesn't work (not that I really thought it would, but anything's worth a try). And it doesn't show up in the "Add or Remove Programs" list... Any ideas?
Goddamnit! It got me. It sends it out to everyone in ur buddylist it seems. It was from one of my buddies saying "Can I keep this pic of you on my blog?" I clicked the link and then it brought up an icon (I should've f**kING kjnown it was a DOS file but i gave it the benefit of the doubt and it brought up windows with all of my online (but away luckily) buddies and I guess sent it to them. Let me take a wild guess and say this is unique to Windows, however. In which case I'll definitely only IM from Ubuntu.
I don't intend to be rude. I believe this is valuable information for some people. But there is not only this virus in this kind of instant messaging system. Can't people learn the lesson of "Beware of your conversation content"? Good luck
Closed AccountDec 6, 2005
umm whoever uses aim and myspace deserves it.
evroccckDec 6, 2005Submitter
apparently the front of the URL Varries, b/c i just got the message again,I would assume it all redirects to the same peice of $h|t file.
zeabridDec 7, 2005
there's "I found your pic online" and "is this you", but there have been about 40 Digg stories about this.
slickrateDec 7, 2005
if you click the link it asks you to execute a program. its pretty easy for anyone on this site to steer clear
evroccckDec 7, 2005Submitter
it makes sense to the geeks but maybe its the geeks friends that done know.. either way its a good thing to have out there
johnny025Dec 22, 2005
There will be a file called dr.exe or drme.exe in the root of the drive where your operating system is loaded. Mine is on the C: Drive so it was located in root of C:.1. Delete C:dr.exe or C:drme.exe file.2. Show all hidden files and folders in the Folder Options from the Tools menu in explorer.3. Stop the SCVHOST.EXE service in Task Manager. NOTE: Do not confuse this with SVCHOST.EXE or it will cause your system to shutdown if you terminate the task.4. Delete the file C:Windowsscvhost.exe5. Clear your temporary internet files from IE and all the offline content.6. Delete the dr.exe from the C:WindowsPrefetch (if it resides there)
gavster89Jun 11, 2006
I got this through MSN Messenger... well... Windows messenger, but it's the same thing really. It said something like "Check out these pictures of us on Myspace!" and then a hyperlink like <a class="user" href="http://19185.myspace.com">http://19185.myspace.com</a> or something, only if you click on the link it installs something to your computer instead of opening a myspace site. As far as I can tell, all it does for me is send the link to anyone on my contact list who's online, but when it does that I can't talk to them anymore, although I remain signed in, and signing out and in again lets me talk again, but the virus sends again when I do. It seems to be a minute or so after I sign in, but never a long time. It created a file called "myspace" in C: (not subfoldered or anything, you could see it as soon as you got there) that had the msn icon, but you can't delete it (access is denied), my anti-virus program doesn't pick it up, neither does my anti-spyware. Also, moving it to a different part of the computer doesn't work (not that I really thought it would, but anything's worth a try). And it doesn't show up in the "Add or Remove Programs" list... Any ideas?
tech42erSep 4, 2006
Goddamnit! It got me. It sends it out to everyone in ur buddylist it seems. It was from one of my buddies saying "Can I keep this pic of you on my blog?" I clicked the link and then it brought up an icon (I should've f**kING kjnown it was a DOS file but i gave it the benefit of the doubt and it brought up windows with all of my online (but away luckily) buddies and I guess sent it to them. Let me take a wild guess and say this is unique to Windows, however. In which case I'll definitely only IM from Ubuntu.
argentounceMar 21, 2008
I don't intend to be rude. I believe this is valuable information for some people. But there is not only this virus in this kind of instant messaging system. Can't people learn the lesson of "Beware of your conversation content"? Good luck