Last week Adrian posted about a new messenger worm that has now spread to many users. It spreads by sending a message like one of the following to online contacts:
check out these pics of us!
http://p1392.pic-myspace.info
check out this pic of you on myspace!p1392.pic-myspace.info
According to the original post, it was using the domain pics-myspace.info, but on that same day pic-myspace.info was registered and the worm started using that instead. The whois information looks valid…?
Some helpful visitors have posted comments on how to remove it, check out SgSiaoKia’s comment and head over to Serena’s site for full instructions.
0 Responses to “Removing the messenger worm”
Leave a Reply