ATTENTION: WORM THROUGH ICQ

[Piper]

It appears that a worm is being spread through ICQ. It's w32.stration.cx@mm and seems to manifest as weird messages with links. I got it from Eisaac and Thom said she started getting weird messages from me. It kicked me off ICQ and hijacked it to send out the messages. So don't click the links and notify the sender if you get something bizarre, like stuff about sex tapes or just weird URLs with unusual extensions. The one I clicked look like a normal image link.

If you think you have it, you'll probably want to start up in safe mode and run your antivirus program, or run safe mode with networking and find a free scan online.

I thought I'd let everyone know about it.

To those of you who have me on your lists, please let me know if you continue to get these messages from me.

Edited February 23, 2007 by Blair

[Eisaac]

I never got any weird messages, nor seen any link like the one you described, but I'll run another antivirus program, in addition to the one I have and run frequently, both at home and at work.

Please notify me if you get any more junk and I'll check harsher options.

Sorry!

[Piper]

Apparently it adds things to the registry, so antivirus programs typically can't remove it. I'm looking about removing it manually at this point, since it's still there. My antivirus program found four files associated with it, but access to them was denied so nothing could be done.

Here's a report on it from Symantec:

http://www.symantec.com/security_response/...-101910-1040-99

...And how to remove it:

http://www.symantec.com/security_response/...-99&tabid=3

It's been stubborn for me so far. I haven't been on ICQ or online at all except to look for information about it; I don't want to spread it to anyone else.