Quick Way to Remove the Skype Worm
If you do not know yet there is a Skype worm spreading around that is affecting Skype Windows clients. The virus automatically sends a chat message to other Skype users containing a link to an image on a website where users are prompted to download a file with the .scr extension using a simple redirection. SCR files are screensaver files usually but also often used by malware to infect systems and bypass security software that is mainly looking out for .exe files.
If a user runs the downloaded .scr file on the computer it will become infected with the w32/Ramex.A virus which uses Skypeâ€™s public API to access the infected pc.If you are lucky, your resident antivirus software may block the execution of the file, if not, you may need to follow the guide below to uninstall it from your system.Many antivirus companies like Symantec, Kaspersky and F-Secure have already updated their virus definitions to detect and remove the worm.
It is however also possible to remove the worm manually by following the steps outlined below:
- Restart the PC in safe mode
- Run regedit by using the Windows-R shortcut to open a run dialog box, typing regedit, and hitting the enter key.
- Go to HKLM/software/microsoft/windows/currentversion/runonce find entry with mshtmldat32.exe. Delete this entry.
- Go to Windows\System32 directory and delete the following files there: wndrivs32.exe, mshtmldat32.exe, winlgcvers.exe, sdrivew32.exe. Use the search if you can't find the files immediately or do not want to browse the large list of files manually.
- Go to windows/system32/drivers/etc
- Find the hosts file there.
- Open it with notepad, ctrl+a and delete all entries (this will resume your antivirus updates), save, close. If you have used the hosts file previously make sure you keep legit entries in there and only delete the entries that block your antivirus software from updating.
- Restart the PC.
via Skype blogAdvertisement