If you do not know yet there is a Skype worm spreading around that is affecting Skype Windows clients. The virus automatically sends a chat message to other Skype users containing a link to an image on a website where he is prompted to download a file with the .scr extension using a simple redirection
If, and only if, the user executes the file his computer becomes infected with the w32/Ramex.A virus which uses Skype’s public API to access the infected pc. Many antivirus companies like Symantec, Kaspersky and F-Secure have already updated their virus definitions to detect and remove the worm.
It is however also possible to remove the worm manually by following the steps outlined below:
1. Restart the PC in safe mode
2. Run regedit
3. Go to HKLM/software/microsoft/windows/currentversion/runonce find entry with mshtmldat32.exe. Delete this entry.
4. Go to Windows\System32 directory and delete following files: wndrivs32.exe, mshtmldat32.exe, winlgcvers.exe, sdrivew32.exe
5. Go to windows/system32/drivers/etc
6. Find file hosts
7. Open it with notepad, ctrl+a and delete all entries (this will resume your antivirus updates), save, close.
8. Restart the PC.
via Skype blog
Read Related Posts
-
Improve Skype Sound Quality
-
US Military Bans Removable Media To Stop Computer Worm
-
Conficker Worm Detection And Removal
-
Delete Entries in Add or Remove Programs
-
Clear the Chat History of one contact in Skype
-
Remove Fake Antivirus Software Programs
-
Why I decided to uninstall my Antivirus software
-
Skype Chat History Remover
4 Responses to “Quick Way to Remove the Skype Worm”
Trackbacks/Pingbacks
-
[...] Way to Remove the Skype Worm If you do not know yet there is a Skype .worm spreading around that is affecting Skype Windows clients. The virus automatically sends a [...]
-
[...] 原文链接。 I hope you enjoyed reading this post. You may now subscribe to my RSS Feed, scroll down to 留下评论 or get back to the homepage. I recommend Giganews, the ultimate P2P alternative: Read here why [...]
I have a computer running Windows XP Home with SP 2. This computer has been infected with the Skype Worm, Ramex, and we cannot logon any more. Each time you try and logon it simply goes back to “Saving your settings” and returns you to the logon screen.
Can anyone help with any advice on how to get around this. I cannot access Regedit, nor can I edit the hosts file from the Repair utility.
I am really desperate, please help.
Alan
Did you try starting in safe mode ? If yes, I would start the command line mode only and delete all the files mentioned above.
You could also try system restore.