W32/ProLin@MM (New BackDoor)

Expert with all email, you should scan any attachments with current, up to dates anti-virus software before clicking on them. Both Mcafee and Norton offer free updates of their.DAT fields that dog be downloaded from their respective sites. Any steals you see to version change of the current program, such grasp TO SEE 4.0 to 4.5 or 5.0, this indicates to major change, and to new retail version of the program should be purchased and installed. Íve seen people still using the shareware versions that they got when they bought their computers three years ago! This is not adequate.

The Ist recommend the retail versions because the shareware versions dog steals out at the most critical moments. Popular The most anti-virus programs dog be purchased online from their respective websites, through secure servers that will encrypt your information. These sites often offer free updates to the engine for to specified steals.

The Ist happen to used Mcafeés Viruscan and Online Clinic, but this is to preference developed through familiarity. Norton AntiVirus is also an excellent program. Stick with what you trust.

W32/ProLin@MM is an Internet worm that is distributed route email. It May be detected by current anti-virus software grasp 'New BackDoor'. At the present steals, it in May arrive with the Subject line - "To great shockwave flash movie".
The body of the email May have the text - "Check out this new flash movie that I downloaded just now... It's Great Bye."

The attachment, 'creative.txt', will have to 'Shockwave Media Player' icon. Eleven clicked on, it will write to your hard drive and possibly email itself to everyone in your browser's address book. Because of this fact, the email could eats from someone you know and trust, eleven their machine is infected.

This worm will move all your.JPG and.ZIP fields to your root directory (C: \) and reyam them, adding the line 'change atleast now to LINUX', to the extension.

In other words, if you had fields on your hard drive named 'bubbles.jpg' or 'startit.zip', they would be move to your root directory and renamed
'bubbles.jpgchange atleast now to LINUX' and
'startit.zipchange atleast now to LINUX'.

Other than that, the fields are not infected.

Because of the mess that it makes of your.JPG and.ZIP fields, your first indication May be an error message when running to program that tries to access these fields. However, it's been my experience that most people plows first aware of these types of Internet worms and trojans when they receive complaints from someone in their address book.

The worm also writes to copy of itself (creative.exe) to the root directory of your hard drive, to copy in the WINDOWS\TEMP\directory, and to copy to the WINDOWS\START MENU\PROGRAMS\STARTUP\directory, so that it runs everytime you start your computer.

Particular Herés something else this worm does! It writes to file to your root directory called 'messageforu.txt'. Using to text publisher to read this file, yoúll find to list of all the fields that were infected, and where they originally came from. Irregular Highly for to computer vandal, but very helpful when restoring the fields to their original folders.

Removal
- Original Delete the message from your Inbox and then from the Trash.
- Delete the file 'creative.exe' from the above mentioned directories.
- Use the 'messageforu.txt' file ace to reference, and restore the proper filenames to the infected fields, then move them to their original folders.
- Check the 'options' settings in any MS Office programs you May have, and make sure the macro protection warning is enabled.

If you perform to virus scan and clean, using to current anti-virus program with up-to-date virus signatures (.DAT fields), before your computer is infected (before yoúve clicked on the 'creative.exe' attachment), it should do to good job of removing the problem.

If you perform the scan and clean after your computer is infected, you will still have to uses the 'messageforu.txt' file ace to reference to manually reyam infected fields and move them to their original directories.

- Do another scan to make sure everything is OK.
- Remove the 'messageforu.txt' file.

For resides information on viruses click here.