Page 1 of 2 12 LastLast
Results 1 to 20 of 21

Thread: trojan virus spreading via MSN chat, it points to URL in photobucket !

  1. #1
    Senior Member
    Join Date
    Sep 2005
    Location
    Raffles Place
    Posts
    1,808

    Default trojan virus spreading via MSN chat, it points to URL in photobucket !

    if u encounter this during msn chat, do not open it !

  2. #2
    Moderator Francis247's Avatar
    Join Date
    Jul 2005
    Location
    Hougang, Punggol
    Posts
    6,627

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Quote Originally Posted by raincool2005 View Post
    if u encounter this during msn chat, do not open it !
    I think it is more like send a zip file by your friend.

    Something like this

    "wanna see the pics from my vacation?
    XXX sends imag091307.zip
    Check out my nice photo album.
    XXX sends imag091307.zip"

    Source: [img091307-www.photoshop.com] inside of [c:\documents and settings\owner\my documents\my received files\imag091307.zip]
    Risk category: Virus
    Overall Risk Impact: High
    Click for more information about this risk : W32.Scrimge!gen
    Action taken: Fully removed
    Last edited by Francis247; 21st September 2007 at 10:53 AM.
    莫问前程有愧,只求今生无悔. Time pasts, Places changed, Beauty faded, what is left are Photos of Memories…

  3. #3

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Another variant is

    "Hey this guy says he knows you! Is it true??" Followed by

    Picture to download

  4. #4

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    i keep getting random friends sending me damn weird messages on msn
    so irritating, i just blocked them after a while =D =D =D

  5. #5
    Member/Tangshooter
    Join Date
    May 2006
    Location
    ClubSNAP Community
    Posts
    3,118

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Sometimes the file name comes like -> xxxxxx.jpg.com
    When u tot it looks like a jpeg image file, and u double click on it, u have actually started a worm/spam program..
    This is an electronic post which requires no signature.

  6. #6
    Senior Member
    Join Date
    Sep 2005
    Location
    Raffles Place
    Posts
    1,808

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    chia lak.. wat should i do ?

    norton actually deleted it but seems like i cannot kill the worm

  7. #7
    Member
    Join Date
    Sep 2007
    Location
    LA 2019
    Posts
    1,282

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Quote Originally Posted by raincool2005 View Post
    chia lak.. wat should i do ?

    norton actually deleted it but seems like i cannot kill the worm
    my sympathies.

  8. #8
    Moderator Francis247's Avatar
    Join Date
    Jul 2005
    Location
    Hougang, Punggol
    Posts
    6,627

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Quote Originally Posted by raincool2005 View Post
    chia lak.. wat should i do ?

    norton actually deleted it but seems like i cannot kill the worm
    Do a full system scan and check if you have been sending weird messages to you friends on MSN. My system is still ok even though I download the zip. My Norton Antivirus managed to kill it.
    莫问前程有愧,只求今生无悔. Time pasts, Places changed, Beauty faded, what is left are Photos of Memories…

  9. #9
    Member/Tangshooter
    Join Date
    May 2006
    Location
    ClubSNAP Community
    Posts
    3,118

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    a worm program usually unpack another program for keeping it alive.
    For instance, worm1.exe unpack wormClone.exe..and will usually write a registry setting to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run..by adding a key to this registry, they will be able to re-run themselves on every next boot..
    worm1.exe will usually be the one creating havoc, and yet monitoring whether wormClone.exe is started..
    wormClone.exe is usually monitoring worm1.exe started a not, if not it will try starting it, if fail to start it will unpack another worm1.exe and start it..
    some worm programs even check the availabilty of registry keys to make sure they continue to live on the next boot..
    This is an electronic post which requires no signature.

  10. #10
    Senior Member
    Join Date
    Sep 2005
    Location
    Raffles Place
    Posts
    1,808

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Quote Originally Posted by blazer_workz View Post
    a worm program usually unpack another program for keeping it alive.
    For instance, worm1.exe unpack wormClone.exe..and will usually write a registry setting to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run..by adding a key to this registry, they will be able to re-run themselves on every next boot..
    worm1.exe will usually be the one creating havoc, and yet monitoring whether wormClone.exe is started..
    wormClone.exe is usually monitoring worm1.exe started a not, if not it will try starting it, if fail to start it will unpack another worm1.exe and start it..
    some worm programs even check the availabilty of registry keys to make sure they continue to live on the next boot..
    how to remove this worm ?

  11. #11
    Senior Member
    Join Date
    Apr 2004
    Location
    東京 Tokyo
    Posts
    10,193

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Quote Originally Posted by raincool2005 View Post
    how to remove this worm ?
    think there are at least 2 places to check

    1. My Computer > C Drive > Documents and Settings > (Your Name) > Local Settings > clear everything in temporary internet files ... usually i clean up the temp folder as well

    2. check My Documents, My Received Files, Downloads etc. and see if there are any trace of the worm

  12. #12
    Senior Member
    Join Date
    Sep 2005
    Location
    Raffles Place
    Posts
    1,808

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    i had uninstalled MSN 8.1 and go back to MSN 4.1 for the time being

    seems like the worm is very active in MSN 8.1 version

    Last edited by raincool2005; 21st September 2007 at 10:02 PM.

  13. #13

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Mac does not seem to have this problem... using adium as my chat browser for msn

  14. #14
    Senior Member
    Join Date
    Sep 2005
    Location
    Raffles Place
    Posts
    1,808

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    second attempt of attack again !

    this time i just close the chat window. It says something like "does this photo look nice on myspace "

    clearly, the virus is spreading fast via msn chats

  15. #15
    Senior Member
    Join Date
    Apr 2004
    Location
    東京 Tokyo
    Posts
    10,193

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Quote Originally Posted by raincool2005 View Post
    second attempt of attack again !

    this time i just close the chat window. It says something like "does this photo look nice on myspace "

    clearly, the virus is spreading fast via msn chats
    have you checked the folders i mentioned? if you don't purge the worm it'll surface no matter what version of msn messenger you are using. you should do a scan on your entire system and then go to those folders to delete the worm files.

  16. #16
    Senior Member
    Join Date
    Jan 2006
    Location
    West Legion
    Posts
    7,751

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Quote Originally Posted by raincool2005 View Post
    second attempt of attack again !

    this time i just close the chat window. It says something like "does this photo look nice on myspace "

    clearly, the virus is spreading fast via msn chats
    if everything fail, do a system restore to the time before you got it... most of the time it works on suchs worms/virus... etc

  17. #17
    Senior Member
    Join Date
    Feb 2005
    Location
    sing
    Posts
    3,353

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Trojan Remover from Simply Super Software.
    Spyware Doctor from PC Tools.
    Norton Security Suite.
    Kapersky Anti Virus.

  18. #18
    Senior Member
    Join Date
    Sep 2005
    Location
    Raffles Place
    Posts
    1,808

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    Quote Originally Posted by blazer_workz View Post
    a worm program usually unpack another program for keeping it alive.
    For instance, worm1.exe unpack wormClone.exe..and will usually write a registry setting to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run..by adding a key to this registry, they will be able to re-run themselves on every next boot..
    worm1.exe will usually be the one creating havoc, and yet monitoring whether wormClone.exe is started..
    wormClone.exe is usually monitoring worm1.exe started a not, if not it will try starting it, if fail to start it will unpack another worm1.exe and start it..
    some worm programs even check the availabilty of registry keys to make sure they continue to live on the next boot..
    yes, i had tired almost the whole day, finally did a SYSTEM RESTORE on my laptop

    WORM confirmed died !

  19. #19
    Member
    Join Date
    Feb 2006
    Location
    Bukit Timah
    Posts
    145

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    I managed to get it out of my PC in one hour, it was extremely irritating.
    Nikon D80|Nikon 18-135 AF-S DX|Nikon 70-300 AF|Nikon 50 f/1.4 AFD|Nikon SB-800|Canon IXUS 70

  20. #20
    Senior Member
    Join Date
    Sep 2005
    Location
    Raffles Place
    Posts
    1,808

    Default Re: trojan virus spreading via MSN chat, it points to URL in photobucket !

    here's what i experienced.

    the anti-virus software can detect and remove (found to be trojan) it but this virus or worm created a backdoor for another worm during a reboot. Your windows (which is protected by Updates) will prompt u to run this msn program and guess what ? the "publisher" is an unknown. By right the publisher should be Microsoft.

    despite running it or not, even u cancel it, it still runs ! auto-sending out ugly presents to your fellow msn friends without your permission.


    Last edited by raincool2005; 23rd September 2007 at 01:43 AM.

Page 1 of 2 12 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •