NEW VIRUS WARNING! MSN MESSENGER USERS BE WARNED!

[TN] Nathan · ALMIGHTY PWNER! Joined: 14 Feb 2002 Posts: 7406

If you get a message from a friend saying....

"OMG, this is funny! http://........../cute.pif"

Do not click the link!

Will cause the virus to send it to all of your contacts on your messenger list.

AVOID THE LINK AT ALL COSTS! Just close the window.
_________________
Owner & Administrator
www.Tweaknews.net
www.Pocketbookpinch.com

Google · Sponsor

smith.p.sean · Posted: Sun Mar 06, 2005 7:03 pm Post subject:

s*** f***... If only u had been like 30 seconds sooner... f*** f*** f***

smith.p.sean · Posted: Sun Mar 06, 2005 7:07 pm Post subject:

so... what do u do once ur screwed?? I have a file on the desktop named photos, im going to use move on boot to get rid of it... i dont see any other side effects yet...god damnit iw as talking to this chick i know... i even thought to myself what kind of a picture file is .pif f***

smith.p.sean · Posted: Sun Mar 06, 2005 7:10 pm Post subject:

NEW PICS FROM THE BEACH http://www.c had whack.c om/p hotos.pi f !!!!!

Spaces are there on purpose to disturb the link
DONT CLICK THE LINK... but thats what i got. Is it the same thing?

[TN] Nathan · ALMIGHTY PWNER! Joined: 14 Feb 2002 Posts: 7406

ok, looks like it uses different links

remove the file and scan for viruses immediately.

make sure your AV is updated.
_________________
Owner & Administrator
www.Tweaknews.net
www.Pocketbookpinch.com

Josh · Posted: Sun Mar 06, 2005 7:27 pm Post subject:

maybe this should be temporarily be stuck....not a good thing if all our tweakers get cuagh up in this.

Thanks for the for-warning nate!
_________________
»4 RS«»1Ж «»1 DENE«»1 FREAKIN LAME OH«»1 MONEY MONEY«
(-)

smith.p.sean · Posted: Sun Mar 06, 2005 7:52 pm Post subject:

and it was freaking fast warning too. cause i got the s*** and i checked tn and the warning was there. Im pretty shure that i got caught in the first wave of this too. High five nate. Ok so updates the file has been deleted but upon reboot a webpage loaded looking to update something but thatnks to firefox it was not allowed to... so ima see if it comes up again on restart...

smith.p.sean · Posted: Sun Mar 06, 2005 7:59 pm Post subject:

ok,
on restart a system command prompt opens
and an explorer window opens up with this as the adress
file:///C:/WINDOWS/trufkz.html

and this as the title
.:(Updaten Der Securiten):.
so i guess that i begin googling from there... I have updated norton corporate edition and it finds nothing on a full scan... ill keep everyone updated.

smith.p.sean · Posted: Sun Mar 06, 2005 8:09 pm Post subject:

Ok, from what i have learned so far, the virus that i just recieved is a version used in aim. I was on trillian so i didnt know which one it was. This virus has now been ported for msn messenger as well.

After running hijack this i have found 2 new processes that are named run ipod service or something. That joged my memory and i remember seeing that flash on my screen during the install... seeing as i dont have an ipod and dont like them and wouldnt install anything to do with them, i feel fairly safe removing them... ill post back again after a restart to see if this has fixed the problem

smith.p.sean · Posted: Sun Mar 06, 2005 8:13 pm Post subject:

Ok,
After running hijack this and removing the two ipod entries, the command promt and in turn the explorer window dont show up on boot any longer... Any one else who runs into this problem, DO NOT USE HIJACK THIS ON YOUR OWN. The program is very powerful and u can screw ur computer by removing the wrong things. If you need help just post a log from hijack this and ill see what i can do for ya and im shure there are other members here who know how to use it.

[TN] Nathan · ALMIGHTY PWNER! Joined: 14 Feb 2002 Posts: 7406

do a complete deep AV scan of the HD. Have it search everything.

Scan for spyware.
_________________
Owner & Administrator
www.Tweaknews.net
www.Pocketbookpinch.com

zhensem · Posted: Mon Mar 07, 2005 2:56 am Post subject:

I think this is the virus that you are refering to:

http://securityresponse.symantec.com/avcenter/venc/data/w32.kelvir.a.html
_________________

gmoney · Posted: Mon Mar 07, 2005 4:09 am Post subject:

dood i thought that the virus thing going around on msn was old news.. thats y i never use msn ...
_________________
I finally got an award=OFFICIAL ROCKSTEADY AWARD and then one time... at tweaknews dene gave me a A+++++++....
and then...
i got a couple josh awards too
an' den one of those too -->... Ж award

comdak · Posted: Mon Mar 07, 2005 1:45 pm Post subject:

my girlfriend just got attacked by this one, got it outta the system pretty easily though, wasnt a big deal
_________________
"The closer you get to light, the greater your shadow becomes" - Kingdom Hearts
Net Slum - Game/Anime Reviews that Matter

[TN] Nathan · ALMIGHTY PWNER! Joined: 14 Feb 2002 Posts: 7406

gmoney · Posted: Mon Mar 07, 2005 3:40 pm Post subject:

ohhhh... but this isnt the first instance.. i have seen this around not too long ago maybe 2 weeks ago .. ppl were posting about it in other forums...
_________________
I finally got an award=OFFICIAL ROCKSTEADY AWARD and then one time... at tweaknews dene gave me a A+++++++....
and then...
i got a couple josh awards too
an' den one of those too -->... Ж award