If you do not know yet there is a Skype .worm spreading around that is affecting Skype Windows clients. The virus automatically sends a chat message to other Skype users containing a link to an image on a website where he is prompted to download a file with the .scr extension using a simple redirection
If, and only if, the user executes the file his computer becomes infected with the w32/Ramex.A virus which uses Skype's public API to access the infected pc. Many antivirus
companies like Symantec, Kaspersky and F-Secure have already updated their virus definitions to detect and remove the worm.
It is however also possible to remove the worm manually by following the steps outlined below:
1. Restart the PC in safe mode
2. Run regedit
3. Go to HKLM/software/microsoft/windows/currentversion/runonce find entry with mshtmldat32.exe. Delete this entry.
4. Go to Windows\System32 directory and delete following files: wndrivs32.exe, mshtmldat32.exe, winlgcvers.exe, sdrivew32.exe
5. Go to windows/system32/drivers/etc
6. Find file hosts
7. Open it with notepad, ctrl+a and delete all entries (this will resume your antivirus updates), save, close.
8. Restart the PC.
via Skype blog
If, and only if, the user executes the file his computer becomes infected with the w32/Ramex.A virus which uses Skype's public API to access the infected pc. Many antivirus
It is however also possible to remove the worm manually by following the steps outlined below:
1. Restart the PC in safe mode
2. Run regedit
3. Go to HKLM/software/microsoft/windows/currentversion/runonce find entry with mshtmldat32.exe. Delete this entry.
4. Go to Windows\System32 directory and delete following files: wndrivs32.exe, mshtmldat32.exe, winlgcvers.exe, sdrivew32.exe
5. Go to windows/system32/drivers/etc
6. Find file hosts
7. Open it with notepad, ctrl+a and delete all entries (this will resume your antivirus updates), save, close.
8. Restart the PC.
via Skype blog
