MSN-Messenger Virus Alert!

[rochelley]

Its driving me insane, it opens up all your conversations and sends people the link. i keep having to tell people to not open it and then try an sign off quickly. It really is a pain!

 

[Cache-man]

go here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.bropia.removal.tool. html

download and run it



if it finds nothing then go here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.kelvir.removal.tool. html

download and run it


if both find nothing then ur virus free.

I have had a good look around the web for a cure for this for you all, and i cant seem to find much at the mo....not even on microsoft website. Feel free to check out the links in the quote, but not actually having the virus on my own computer i cant check it myself to see if it works.
All I have managed to find is an awful lot of references to IM-related virus's....so, please be vigilant when downloading files from instant message programs, and if unsure just don't open it at all.

 

[Alf]

So it spreads by itself?!

 

[j@ke]

does any 1 know?

so does any 1 no how to get rid of the fing yet ? mcafee virus scan did detect it but its still here! nd ive ran virus scan nd it detects nothing... i didnt save it nd i restarted my pc but it asks me to run it wen it loggs back on... i go to where it says the file is but its not there ( or i cant find it) so can som1 plz tell me how to delete it! loades of pll here in harlow, essex (uk) ave it too...

 

[rochelley]

it says it cant find those pages. im not really very good with computers when it comes to viruses, so i really dont know what i'd be looking for. but thank you for your help

 

[j@ke]

hmmm maybe system restore?

 

[Alf]

Since this apeares to be rather new, i doubt anyone knows how to really get rid of it.
Just hope MSN can fix it.

 

[j@ke]

i hope so...

 

[rochelley]

when i restarted my computer it asked me to run it again too, the file was called W32RfSA.exe and was apparently in the C:\WINDOWS\system32, however when i looked it wasn't there, so i typed it into my computer search thing and it found it, iv deleted it but i dont know if its worked

 

[Cache-man]

Ok he is a little guide to removing 4 types of the MSN Messenger virus from you PC.

First of all, cute.pif it sends all people on your buddy list this
QUOTE
omg this is funny!
*link to download cute.pif from jose.rivera4.home.att.net*

Here is how to remove it...
1. Hit Ctrl,Alt,Delete on the keypad, look for "hotkeysvc." select it and press "End Task" (if it is on there...).
2. Use the Search feature to look for "hotkeysvc.exe". It will be in the %System% directroy, if it is there at all. Delete that file.
3. Go to Start> Run> [type] msconfig
4. Click the tab at the top right hand corner of the program that poped up that says "Startup".
5. Look for "hotkeysvc.exe" or something like that and uncheck the box next to it.

Ok, now to remove the PIC1234(1)(1)(1)(1)(1)(1).exe...
1. Close MSN (if not already closed)
2. Goto 'Start> Run' [type] "msconfig"
3. Click the tab at the top right hand corner of the window that pop up that says "Startup"
4. Uncheck the box next to "MSN Messenger".
5. Hit Ok, when it asks if you want to restart your computer say "no".
6. Hit Ctr, Alt, Del find "MsgSpread" and click End Task (if the file is there).
7. On the Desktop, open My Documents.
8. Double click "Messenger Service Received Files" if you dont see a folder called that then go to My Computer> C> Program Files> Messenger Service Received Files
9. You should see a file called PIC1234(1)(1)(1)(1)(1)(1)(1)(1).exe, right click it ONCE and select delete.
10. On the desktop click the "Recycle Bin" and click empty.

Now for Choke.exe...
1. Hit Ctrl, Alt, Delete select Choke.exe press "End Task"
2. Close MSN (if not already closed...)
3. Go to Start> Run> [type] "msconfig"
4. Click the tab at the top right hand corner that says "Startup"
5. Uncheck the box next to "Choke.exe", "ShootPresidentBUSH.exe", or "*The user name here*.exe
6. Use windows search, and look for for "Choke.exe", "ShootPresidentBUSH.exe", or "*The user name here*.exe
7. Right click the file once, and select delete.
8. On the desktop open the "Recyle Bin" and empty the recycle bin.

Now to remove W32.Aplore@mm... (only deactivate actually...)
1. Close MSN (if you haven't already)
2. Go to Start> Run> [type] "msconfig"
3. Click the tab at the top right hand corner that says "Startup"
4. Uncheck the box next to "Explorer"
5. Restart your PC

If you have any questions, reply or PM me... biggrin.gif

I also found this, but I'm still not sure if these will remove the current virus in question.

PERSONALLY, all I can suggest for now is to do the following:-

• Close and uninstall MSN-Messenger for now
• Give your system a full virus scan
• Run Windows update, and make sure you have all the latest updates and patches
• Be extremely vigilant with any other items you are tempted to download from messenger, from e-mail, and from the internet.

Microsoft should be pulling it's finger out soon enough with an official solution to this virus, so you might just have to wait a few days.

If I do find a solution, I will keep you updated. Also, if anyone else finds a solution, would you please let everyone else know. Thanks

 

[rochelley]

well i know i am probably being a little bit hasty as it's only been 10mins since i deleted it, but it seems to have worked. Maybe im being a little naïve but oh well

 

[muckshifter]

It is too new for anybody at the moment ... it has only just been reported to Sandbox ... the little bugger is going to be a tough one to eradicate.

 

[Tada]

I think I found the way to kill it.

Search your computer for a file named "NewImage-9.exe", and delete the file that appears as the result of the search.

 

[Cache-man]

That will delete the actual file that you downloaded, but if the program has been run, it has also probabally installed itself in a hidden corner somewhere, and possibly in your registry too.

 

[Tada]

That will delete the actual file that you downloaded, but if the program has been run, it has also probabally installed itself in a hidden corner somewhere, and possibly in your registry too.

Eh. I haven't had a problem now that I deleted that file.

For safe measures, go into your task manager. I think I found about 6 "Project" applications that had nothing to do with the programs running up, so I ended them,

 

[TurboTycoon]

Has anyone noticed anything else about it? E.g.:

A new toolbar came up and deleted my others (although it said they were installed)
Tons of random adverts and searches keep coming up
And yes, the stupid MSN message.

I found something in Add or Remove Programs called EliteBar; not sure if that was there already but it was detected as adware.

 

[Tada]

Thank god I use Mozilla Firefox. I think if I were to use my IE it would be horribly messed up.

Edit: No Swearing Please!

 

[TurboTycoon]

Yeah I really oughta use Firefox, but I find it doesn't do so many little things. But maybe I'll try it again anyway.

 

[Cache-man]

Yeah I really oughta use Firefox, but I find it doesn't do so many little things. But maybe I'll try it again anyway.

Firefox rules!
Personally I find it does many things that IE doesn't, and it's easily customised too. Sure there are a minority of sites that don't display/work properly with Firefox, but it is a small price to pay for the best browser on the planet!

Thank god I use Mozilla Firefox. I think if I were to use my IE it would be horribly f****d up.

Tada - please be carefull of your choice of language on the forums, there are some who don't appreciate it.

 

[Alf]

Has anyone noticed anything else about it? E.g.:

A new toolbar came up and deleted my others (although it said they were installed)
Tons of random adverts and searches keep coming up
And yes, the stupid MSN message.

I found something in Add or Remove Programs called EliteBar; not sure if that was there already but it was detected as adware.

Indeed that is adware suggest you get something like Ad-Aware which deletes programs like that. but some times they refuse to go away, look under the latest articles for Protection against adware and spyware.