Msn Virus

[Freaky]

Has ayone had or seen this before, and more to the shitting pint how to get rid of it.

One of my contacts has it, when he signs in, about 30 seconds later i get an IM from him, but all thats in the IM is this.

John says (20:12):
:'0:'0:'0:'0
John says (20:12):
****;//diabogrupo.com/xiang.com

the link is live and i clicked it coz i thought the contact was trying to show me a website, but its apparently a virus that spreads itself through your conacts with a trojan in.

So guys have any of you seen it???? and know how to get rid of it.

im in the middle of a full system scan now and its found 15 already most are trojans, so i aint gonna know which one of them is the msn one.

Any advice really appreciated

cheers

[TotallyRandom]

Format Reinstall

no point messing about trying to remove them and cause more problems

[blaggard]

I hate to say it but he's right, I had something similar in Live, the moment I clicked it I thought (uuuuuuuuuuuuuunt!! fortunately it was a few days before Vista was released and I was re-installing anyway!

[Freaky]

WHAT A BUMMER not an option for him sadly and its not possible for me to do it for him, well unless he brings me the laptop.

thanks for replies guys

[tef89]

Explains where you've been recently - 15 trojans - ouch - best of lucky freaky m8.

[DiGiT]

This site had a phishing report done a few days ago, and I think they resloved the issue.
Im not to experienced wit this phishing thing, but heres the report. It may show you who was responsible.

h**p://www.castlecops.com/Yahoo_phish156832.html


MORE IMPORTANT:
***********************
The virus calls itself: TagASaurus and is a pursuing Cookie over IE and Yahoo.
The message is indicated in such a way: … did READ urgente this text

Troj/agent BQS is a Installer Trojaner for the Windows platform.


As soon as it is implemented, Troj/agent BQS installs the following files:


<Desktop> \ TagASaurus.exe (a potentially unwanted application)
<Windows> \ pms111x.exe (recognized as Troj/VB YT)
<Windows> \ SYSC00.exe (recognized as Troj/Dloadr LO)
<Windows> \ uni_eh.exe (a Uninstaller for TagASaurus.exe)
<Windows> \ unin101.exe (recognized as Troj/VB AXW)
<Windows> \ Uninst2.htm
<Windows> \ university T1 htm
<Windows> \ win<Zufällige Zahl>.exe (recognized as Troj/VB YT)


Uninst2.htm and unist1.htm can be deleted.



I got this a year or so ago aswell. I knew my message from my contact was fake because they were out of the country with no comupter access. Her font color was different aswell. Frigin sneaky eh! I was able to clean my system, but most people arent so lucky. First things first... stop using messenger entirely until u clean or format or u may infect a friend, and it will just end up coming backto u again! email them stating not to go to any links that u ask them too

[Freaky]

Explains where you've been recently - 15 trojans - ouch - best of lucky freaky m8.

you know how i LOVE my virus,s teffers, just wanted to build up a nice collection.

as for where ive been, i aint been on msn coz.......... well coz i fucking hate everyone at the mo and dont wanna speak to them so don't sign in.

cheers for the info DiGiToL_WaRRioR im just going to check it out now

[ubergaz]

shitting pint

Sounds painful

[Freaky]

Sounds painful

looks like i dropped an O there LOL

[DiGiT]

Hey guys.. This may be irrelevant, but to avoid the process that this virus uses to infiltrate our messenger, cant we just go into our services and turn off the messenger service which is to my knowledge there for Microsoft to send us messages, but it is not needed in order for messenger to operate. Isn't this the way they do it. I know that they are not actually logging into the service as my contact, it just to the viewer seems like they are. I know Ad aware by Lava-soft has a add-on that disables it automatically if u aren't sure how to manually disable it. I just wonder.. would this have stooped it from happening, and I am forgetting my basics, but (assuming u know what I am talking about here) is the messenger service to disable the same one that I would use from the command prompt to send a message to another network user (ie: net send <NETWORK ADDRESS> <TEXT>) of which xp pro has already disabled from OS installation.

I may be a bit mixed up here.. I hope I made a bit of sense though!

wow: Just installed the ie-spellcheck... Kinda neat.. my spelling is atrocious.

[Freaky]

well according to my contact who i spoke to on the phone, he said that im the only one who has said that this is happening to, maybe all the rest of his contacts are just to thick to realise, well a bit like i did when it forst happened LMAO.

but he said im the only one and he aint had any other trouble.

hmmmmmmmmmmm curiouser and curiouser

[inspectercoley]

I may be a bit mixed up here.. I hope I made a bit of sense though!

Service Pack 2 automatically disables this service and this has nothing to do with this problem. As it says in the descrition:

Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted.

Net sends also cannot send clickable links.

The program being referred to here is probably MSN Messenger or Windows Live Messenger or even Windows Messenger. All versions of Mircrosoft's Instant Messaging programs.

[blaggard]

Yep, the whole point of this question as I understand is not messenger running in the background but a problem when in use. Any existing virii and trojans are now established and not reliant upon messenger.

[Freaky]

Yep, the whole point of this question as I understand is not messenger running in the background but a problem when in use. Any existing virii and trojans are now established and not reliant upon messenger.

yeah it only needed messenger initially to spread and infect the human races computers LOL, but YES the problem WAS when it was in use


weirdly since he upgraded to messenger live the new one this has not happened
BUT now when he turns off the pc and turns it back on the conversations from days ago and the night before are popping up on screen, i have no idea if this is to do with the virus or not but its ferkin weird.

and i still cant get my hands on the laptop lol coz he aint a pc savvy human and thinks im gonna break it coz i don't work in a pc shop LMAO, so guess theres some people you jus cant help, so thats why im trying to find out how i coould fix it then do the remote assistance and fix it.

Its only the old conversations popping up now thats the problem, though the virii are probably still there and it does need formatting.

thanks for all the input guys anyway

[DiGiT]

isnt it as simple as going into the messenger options and unclick the box that says store previos messeges, store offline messages, show last conversation in new window, show last conversation link in same window, etc... just turn all that off, and you wont be reminded of your last session(s).

[Freaky]

isnt it as simple as going into the messenger options and unclick the box that says store previos messeges, store offline messages, show last conversation in new window, show last conversation link in same window, etc... just turn all that off, and you wont be reminded of your last session(s).

thanks mate ill have him try that

BUT

it aint just the last conversation, sometimes its ones that are say even up to a week or more old, but hey ill tell him to try exactly what you just said m8, may just cure it.

thank you

[DiGiT]

weirdly since he upgraded to messenger live the new one this has not happened
BUT now when he turns off the pc and turns it back on the conversations from days ago and the night before are popping up on screen,

Its only the old conversations popping up now thats the problem, though the virii are probably still there and it does need formatting.

thanks for all the input guys anyway

Well, I myself would be hesitant to try to help him with msn's remote assistance application. U never know if it could infiltrate your system regardless of your firewall or anti virus program. remember.. he got it somehow.

A couple options. You said it stopped happening since he installed the new 'live' messenger, but then you said the history message still keeps popping up. Well I think older versions of messenger don't have the options for the history. Anyways. Here is what I did when it happened.

1. I deleted the contact and took him/her of my address book/contact list (I did not block them - I just deleted them) Blocking them wont do a thing for this)

2. In the live messenger options go to the 'Messages' tab - Under Offline Instant message settings I selected the second choice - Show a link to my offline messages - as opposed to show my offline messages auto - this way you have a choice to view them or not.

3. **VERY IMPORTANT** under message history - same options screen as above - I 'UNCHECKED' both squares - which will stop the program from showing the last conversation, as well as stop saving the history.

4. Take note under the Message History section, and see what directory messenger is/was saving the conversations in, and go wipe them out. This probably does nothing but either way it could help. I think it is something like C:\documents and settings\<USER NAME>\My documents\my received files\<USER NAME FOR MSN MESSENGER>\History

5. Restart the system, go online and do an online virus scan - google 'online virus scan' and u will have many options, I think symantec's is the quickest, but Trand Micro is still good regardless of the speed. This way if your virus program on your system is infected it may not show u any other infected files with the same virus. And run lavasoft adaware, or some spyware/adaware program


6. Once I knew that the system was ok, I put the contact back on my list.


This ain't full proof, but I had the virus everywhere, and my system was 100% clean when I finished with this process. Than again, I did this right when I was infected. This guy has kept his system working ever since right?

Anyways... good luck, let me know if I can help further. either way. u don't always need to format, it is just the easiest way for peace of mind and surety that the system is clean!

[the_wizzard]

we need a bit more help info and mods who know more about this sort of stuff and a room to disscuss it in! but trojan talk is not welcome here, it needs to be. people are makin a living buiding crypters and tools that affect all of us!!! an there are guys here im sure who can do the same sort of stuff ..but dont choose the ...drk side lol....or did they? lmao my fake msn has been affected by so much shit u wouldnt bliev it! i never click on links anymore far too nasty................in msn

[DiGiT]

we need a bit more help info and mods who know more about this sort of stuff and a room to disscuss it in! but trojan talk is not welcome here, it needs to be.

Not sure who this was directed at, but as much as their was some talk of trojans in this room. Our ongoing discussion is about Messenger (PC Software). I am just trying to explain how to be as least vulnerable to the entire system through messenger that he can be. I know I havent been talking about trojans, but that came up only because of the issue he was having.

And yes, dont let me fool anyone, This is not my area of specialty, (trojans that is) but His issue with messenger I have dealt with hands on. We might have gone off on a few tangents, but thats life aint it. And I do beleive that we are keeping this discussion on track.

[Freaky]

Well, I myself would be hesitant to try to help him with msn's remote assistance application. U never know if it could infiltrate your system regardless of your firewall or anti virus program. remember.. he got it somehow.

This ain't full proof, but I had the virus everywhere, and my system was 100% clean when I finished with this process. Than again, I did this right when I was infected. This guy has kept his system working ever since right?

first of thank you very much for taking the time to help out on this
as for me getting infected via remote assistance, well just ask tef89, i fart in the face of a virus, jesus i Do have 15 as pets right now LOL, if i get one i just reformat lol, but as it aint an option this time as i cannot get to the laptop.

oh and yes the system is working fine, and as i said he told me nobody else has had this happen, but i already expained that, they just may not have known it wasnt him sending the message.

anyway thanks again, and ill try all you said with him on the fone and see if it helps.

thanks a lot i really appreciate it