Step by step manual instructions for removing the Skype ‘Dorkbot’ virus doing the rounds:
If you suspect a computer is infected with this virus – symptoms are that you or someone else receives a skype message from them with the following text:
lol is this your new profile pic?
http://goo.gl/??????profile=xxxxxxxx
You can follow these steps to remove the virus manually on the infected PC:
1) Open Skype. Click Tools – options – advanced. Click Manage other programs’ access to Skype at the bottom
2) Remove any references to suspect programs in the API Access control window. The virus usually appears as an exe file with 3-4 random character name as in the example below. Select each one and ‘remove’
3) Open the ‘run’ window (press windows key and R). Enter ‘%appdata% in the ‘Open’ dialog box and click OK:
4) Scroll down to the list of files in the folder (ignore other folders). Delete suspect looking executable files – usually 3-4 digit random names as in the example below:
*You may receive a message to the effect that a file is in use and cannot be deleted. In this case, you need to find it in task manager and terminate it under processes:
Press Ctrl-Alt-Del and start task manager, or (if supporting the PC remotely), open the run dialog as above and enter ‘taskmgr’ to start task manager.
Click the ‘Processes’ tab and find the exe that could not be deleted in the list, select it and click ‘End Process’. Try deleting the file again.
5) There may be another random exe in the folder with a skype icon – this is the spawn process for the main virus – delete it as well. It usually has a longer name with random characters but can be identified as having the skype icon.
6) Open msconfig (open the run dialog and enter ‘msconfig’). Go to the startup tab and find a suspect entry with the name of the file in step 5. To properly identify it, you will notice in the command column, the user’s profile folder will be listed along with the file name – usually C:\users\username\appdata\roaming\ jnxkxt.exe where the jnkxt.exe could differ from computer to computer. Deselect this entry.
You may want to double check the %appdata% folder as well as Skype API access control again before rebooting the PC. After a reboot the PC should be clear of infection.
