W32/Msnmaker.B is a worm. The worm will infect Windows systems and spreads through MSN Messenger.

The worm arrives as a file manually sent by a malicious user via MSN Messenger. It may also be downloaded from the following URL:

http://www.pictu(BLOCKED)entre.com/MsnTricker.zip

Upon execution, the worm replaces the valid MSN Messenger executable file MSNMSGR.EXE with a copy of itself, while the original file is renamed as MSN.EXE. Whenever the worm is executed, it executes MSN.EXE to avoid immediate detection.

If the worm does not find the file C:\Program Files\MSN Messenger\MSNMSGR.EXE, then it simply terminates itself.

The worm also has a backdoor component that uses MSN Messenger to perform its routines. Upon successful execution on an infected system, remote users can send commands via instant messages in order to perform malicious activities on the infected machine, such as:

Open a URL
Open CD-ROM
Restart system
Send pop-up message boxes
Enable or disable message sending
Log the user off from MSN Messenger
Enable or disable receiving of messages
Change user's display name on MSN Messenger
Capture messages sent/received by the affected user

This backdoor component may display the following fake error message when executed:

Error

You need MFC42D.DLL to run this file.

The said message may trick unsuspecting users, thinking that the file was not executed, even though it is already running in the background.

This worm first appeared on July 30, 2006.

 Other names of W32/Msnmaker.B Worm:

This Worm is also known as BKDR_MSNMAKER.B .