MSN-Messenger Virus Alert!

[cdr12]

accdent

Hi all, I just thought I'd bring this to your attention.

A friend of mine on msn messenger just sent me a message saying
"Hey", and then
"I look so cool in this pic http://www.q8hell.org/NewImage-9.***".

First I thought it looked a little suspicious sending a pic as an exe so i messaged back asking what it was and he confirmed my suspitions that it was in fact a virus that was sending itself by msn-messenging everyone on his contact list. He is currently trying to delete the offending virus.

Luckily i was aware the file was a virus as it said .exe instead of something like .jpg. Others might not be so aware of things like this, so I thought I'd just let you all know about it - beware of opening files from MSN messenger, even though it is from someone you know on your cantact list.

i accdently sent my cozin that virus. now he dosent know how to get it off. i am worried

 

[cdr12]

Q8hell

i was chatting to my friend and i reveved the hey then the I look so cool in this pic *************** NewImage-9. so i clicked on it. lucky it didnt download because my norton anti virus stopped it. but then i noticed it spread to my mum (who was at work at the time) and my cousin. the meassage comes up every 5 minutes asking me to download it. it is driving me nutts!

 

[cdr12]

yea same here i had 2 get ADSL and when i go 2 ma friends house it is SOOO slow!

 

[thamenace]

i got it

i got that virus yesterday ... norton didnt detect it. but avast did ... i found 7 trojans and 5 worms. restarted and it still came back. this elite bar thing keeps coming back everytime i restarted it and that project file keeps coming back with some thing called fgr ... i tried searching for those files and deleting them but then i would restart and they would all come back. so i just formatted my computer. im not sayin to go format but it was too annoyin for me. and now my cuz has it .... ooo she mad

 

[cdr12]

yes

yes. my friend got that on her iPod too.

 

[psd99]

damn this virus sounds quite annoying and detrimental

let me just confirm, u can only get it if u CLICK THE LINK or someone sends u the file through msn?

One cant get it automatically on msn can they?

for a start im going to stay away from msn its very bad news
it always has been

 

[cdr12]

mmm

yes it is if you CLICK the link. it is sent automatically without the 'carrier' or the virus knowing. but it asks to download like 3 times before you actually get it.

 

[cdr12]

how do people even make viruses? dont they have anythinb better to do??

 

[j@ke]

dnt u jus h8 viruses....

 

[cdr12]

dnt u jus h8 viruses....

YES!!!

 

[crazylegs]

this sounds particularly nasty.... ..I don't use MSN...

 

[cdr12]

nahh its not really.

 

[ChristopherP]

If i found him i'd smash HIS head through the screen!

Bet he can't get a girlfriend... stupid tart.

People like him are a waste of precious oxygen!

Enough said... I haven't got that virus yet... and i hope i don't! i dont accept any links or files from people unless i know they are legit. I also use Zone Labs IM Secure... i thinks that protects you from some stuf...

 

[blackprofits]

........

Has anyone tried monitoring the registry and noting any changes it makes?

 

[caseys_32]

A new fix

Run Linux! Or at least do yourself a favor and go to www.mozilla.org and download Mozilla Firefox, then dont execute any .exe files or MS DOS binary (yesterday I got a link on MSN saying check out my profile and had a link with it to a DOS file).

For those who think Firefox doesnt do all IE does it actually done way more. The only reason all pages do not display correctly is people are using Microsoft Development environments like Fontpage (if you could call it a deveopment environment) that do not follow recognised web standards. Microsoft is big so they think they can do whatever and create whatever they want....Anyways there have been several good suggestions on the site for removing the virus, so best of luck!

 

[thamenace]

when i got the link i clicked it and i saw and exe extension so i didnt dload it. someone came on my pc and dloaded it but didnt open it. so i was thinkin if some one with a secure pc could dload it (DONT OPEN IT ... WHEN U CLICK THE FILE NewImage-9.exe IT DISAPPEARS ... THEN YOU ARE ALL F&#^ED UP) and send it to symantec or somethin maybe they could get a fix for it sooner or something ... i aint dloadin it again tho. i was thinkin about it then i got scare

 

[cowboy19]

I i'm new here, i came to this forum cause i had the virus and was looking for a way to get rid of it. You realy helped me out with your advises. I did serch on my computer for a file called "W32RfSA.exe" and an other one called "NewImage-9.exe" (found 2 of the last one) and deleted all of those files. Then I uninstalled msn messenger and did a virus scan with norton and then restarted my pc and I think it worked. I reinstalled messenger and had it running four about 2 hours and the message did'nt pop up again but i have 2 applications runnig (Ctrl-Alt-Del) called "prjBwBBotMailer" (processus called "intranet.exe") and "prjServiceInstall" (processus called "waspits.exe") witch I think were not there before. Exept fort that, witch I'll try to get ride off, heverything's ok. So thanks a lot for your help

 

[cowboy19]

Yeah thats what I was thinking, the 2 apps were related to the virus cause they were created about the same time I caugth it. I searched my pc for the processus names and mouve the files found from that search to my desktop to be able to delete them cause they didin't want to delete in there original folders, witch where %windows\System32% (applications) and %wnidows!prefetch% (the file linked to the apps). So I got ride of them and everiting seems to bee all rigth. Thanks agan for your good advises and let me know if anyone of you find the wicked son of a b**** who created that virus. I think I'll break is freekin neck

 

[Ian]

Some advice on what this application changes : http://sandbox.norman.no/live_2.html?logfile=141108

 

[PSmith2003]

how do u get rid of it though?