NZR - Gibe Worm

Just got sent this information :

Gibe Worm

Dubbed W32.Gibe by antivirus vendors, the Gibe worm

arrives in email disguised as Microsoft's security update

MS02-005.

The email message even contains a link to Microsoft's

critical updates listing for Internet Explorer in an attempt

to legitimise the attachment.

In actuality, if the attached file is opened, a dialogue box is

displayed asking: "This will install Microsoft Security Update.

Do you wish to continue?" Regardless of choice, the worm

drops a remote access Trojan onto the system, modifies the

registry, and mass-mails itself to others.

>>

From: "Microsoft Corporation Security Center"

To: "Microsoft Customer"

Subject: Internet Security Update

Microsoft Customer,

this is the latest version of security update, the known

security vulnerabilities affecting Internet Explorer and

MS Outlook/Express as well as six new vulnerabilities,

and is discussed in Microsoft Security Bulletin MS02-005.

Install now to protect your computer from these vulnerabilities,

the most serious of which could allow an attacker to run code

on your computer

REMOVING THE WORM :

Locate and delete the following Registry key:

HKEY_LOCAL_MACHINE\Software\AVTech

Locate and modify the following Registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run to remove the references to "3dfx Acc" and "LoadDBackup"

Locate and delete the following files:

BCTOOL.EXE, GFXACC.EXE, Q216309.EXE, VTNMSCCD.DLL, WINNETW.EXE, and 02_N803.DAT. You may find it necessary to reboot after the registry changes in order to delete the files.