[Uglybob]

both gaspode and minnie have both sent me .pif links but i didnt not click on them. they look like virus names.

mailto:[email protected] says:
LOOK! http:// members.home.nl/marnixstaal/handcuffs.pif

made a space just in case you unintentionally clicked on it by mistake

gaspode sent me the exact same link

im 99% sure they did not send them

[Wyatt]

and if you have got the virus, heres how to remove it.

http://securityresponse.symantec.com/avcenter/venc/data/w32.bropia.removal.tool.html

[Uglybob]

http://www.bigblueball.com/forums/showt ... hp?t=28957

more info about it

[fish heads]

Yeah, got this yesterday. Luckily I'm rid of it now (I think)

[Gaspode_The_Wonder_Dog]

but how do i get the breasts back?

[Sheep]

Based on numerous reports from msn messenger users, a new virus seems to be propagating itself rapidly through MSN Messenger.

F-Secure identifies the worm as Bropia.A, other antivirus software (like including Kaspersky) labels it IM-Worm.Win32.VB.a.

When received and executed by the victim, the worm places itself in the C directory with a random filename like:

sexy_bedroom.pif
drunk_lol.pif
naked_party.pif
webcam_(random number).pif
love_me.pif and similar looking names.


It then automatically sends itself to active MSN Messenger contacts. It also drops and executes oms.exe, a variant of Rbot, which copies itself as lexplore.exe and adds two registry keys so it will be executed at next system startup. The bot can be used as a backdoor, logging keystrokes, relaying spam and for various other purposes and is therefor a huge security threat to your system. Brobia.A can also disable mouse right button and manipulate Windows mixer volume settings.


If you receive a file transfer request for such a file, press ALT-D or click Decline. Don't ever execute the file. If you did, delete the file immediately and permanently from your system (My Received Files and C drive) and take necessary security measures. For more information, visit F-Secure.
Watch out for instant messages -even when they come from good friends and family- which look like this:

"OMFG! http://[some_domain_name]/handcuffs.pif"

OMFG can be similar words, like LOL, LMAO, SO COOL or ROFL. This is a new worm, probably a Bropia variant, spreading around MSN Messenger disguised as a hyperlink to a file called handcuffs.pif (which is hosted on random domains, like for instance members.chello.nl/g.geurts). When you click the link and thus activate the download of this file, a jpg of a handcuffed girl will be extracted (which some of you didn't seem to mind) and in the background a similar message will be sent to online MSN Messenger contacts. Don't help this worm propagate... don't click links to .pif files!

Also check out the link Bob provided us with.

[Dickie]

Hopefully it's just MSN messenger based so Trillian wont be affected