EffectiveMethod :Clean NewMSNvirus

Technical Information about this latest strain of trojan+virus

On execution, the backdoor performs the following operations :

• Copies itself as usnserv.exe in the Windows System folder.
• Drops the file NewYear2008.ZIP in the %Temp% folder.
• This .zip contains the file Image027.JPEG_VirusScannedBy-Msn.com, which is a copy of the backdoor.
• Adds the value

"Userfile Sharing Server" = usnserv.exe

under the key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

in the Windows registry to hook system startup.

• May connect to a specific IRC channel on a certain IRC server to await remote commands.

The best way to counteract the problem is:

Make sure you have the latest version in order to have complete protection. If you do not have the below versions please update the products using the Live update option in the product

• Update the product to the latest version.
• Restart the system in safe mode.
• Run a full system scan.
• Delete all the files detected as infected with this virus.
• Open the Windows Registry Editor.
• Delete the value

"Userfile Sharing Server" = usnserv.exe

under the key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

• Close the Windows Registry Editor.
• Restart the system.

P.S: In order go to boot options, when you restart, try hitting F8 or DELETE key. Then select safe boot with networking.

Any problem do post here...

reference from:

http://www.k7computing.com/virusdetails.asp?virusid=46455