W32/MSNVB-D

Please follow the instructions for removing worms.

W32/MSNVB-D is a worm for the Windows platform.

W32/MSNVB-D may attempt to spread through Microsoft's MSN Messenger program.

W32/MSNVB-D includes functionality to:

-access the internet and communicate with a remote server via HTTP.
-terminate security related processes

When first run W32/MSNVB-D copies itself to:

<Windows>\Avconsol.exe
<Windows>\Zap.exe
<System>\Hide32.exe
<System>\Ttt.exe

The following registry entries are created to run Avconsol.exe, Zap.exe,
Hide32.exe and Ttt.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WinService
<System>\Ttt.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AVantivirus
<Windows>\Avconsol.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
System
<Windows>\Zap.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Servicewin
<System>\Hide32.exe

Registry entries are created under:

HKCU\Software\VB and VBA Program Settings\Form1\TextBox