Virus - does anyone know what this is?

Lukus

Lukus

Testament to the ghoul lifespan
Orderite
I have some form of virus on my system. I must have.

A few days ago, I was talking to a colleague on msn messenger, and towards the end of the conversation, he sends me a message reading "haha :P" followed by a link that looked 'teh funnay' since it ended with my msn email address.

I clicked it, it lead to some flash site, the flash wouldn't load. I dunno if I installed flash from that site, or if I went to the official flash site to do it. Anyway, it still wouldn't work, and nobody said anything after that so the convo ended.

Now, yesterday, a guy on msn asks me "what is it?" and I don't understand what he means. Turns out, *my* msn had sent such a 'teh funnay' link, signed by my screen name, to him. In fact, not only to him, but others started to pop up and ask what the link was.

I shut down, tried to reset my system to a control point, but that didn't work. Ran Spybot Search & Destroy, removed to regedits, and that was it. Removed excess and suspicious programs from the list on the control panel.

I formatted the D: drive, where I kept all my documents (though I have backups), and now it says this:

* 69,3 Mb used space on the empty drive (save for one txt document I made explaining when it was formatted) - why?

* Total amount of folders: 12
* Total amount of files: 12
* Average file size: 6 kB
* Cluster size: 4 kB
* Tot. MTF: 48 kB
* 34 MTF posts
* 70% of MTF in use
* 2 MTF fragments

(What the hell does that mean?)

I'm going to check with the guy who delivered the CPU today to either reboot and format the whole thing, or change the drives or whatever. It would be nice if my 'work laptop' actually worked, and I wasn't afraid to log in with passwords and shit on various sites.

Hlep pls?
 
Did you use Internet Explorer? What link was it? PM it to me if you don't want to post it publicly.
Formatting D: won't help. If it's a virus, it'll be somewhere on your Windows drive.

Edit: I already found it (googling "msn link haha"):

http://blog.zurka.us/index.php/2008/10/05/webcam-messenger-virus/

Also check your Task Manager (ctr+alt+del) for updater.com or similar.

You should probably also do a search for "updater.exe" (or updater.com) and delete it. Also: get a decent Antivirus program and scan the computer. If you want to be absolutely sure, reformat every hard disc and reinstall Windows.
And don't allow random sites to execute Java Applets. And don't use Internet Explorer (in case you do).

By the way:
comments on that site said:
apparently this virus is most common in Sweden, though I happened to be in Singapore. Most google result turns out to be in Swedish.
Click to expand...
There's also a link to a swedish site:
http://www.ehsan.me/2008/10/03/msn-virus/
 
Yep, that's the one. Thanks!
I think I was using Mozilla Firefox.

I tried to follow the steps in the links. Managed to delete admintxt.txt from the C:/WINDOWS folder, but I couldn't find "updater.com" - not with a search, and not with checking manually (and showing hidden files). :(
 
Check msconfig (Start->run->"msconfig") for anything like that. (on the services or startup tab).
 
aside from what bux said, try ad aware as well. sometimes it catches things that the others miss. there's also this:

http://housecall.trendmicro.com/

which you can use for free, usually locates and defines the virus and if you can't automatically delete it...will give you step by step instructions on how to do so manually.
 
BitDefender also has a free online scan here:
http://www.bitdefender.com/scan8/ie.html
You need to use IE though.

Better safe than sorry, eh?


Also, I've been getting those messages from a few people in my contact list for a while. Glad I never clicked any of them :P
 
TwinkieGorilla said:
aside from what bux said, try ad aware as well. sometimes it catches things that the others miss. there's also this:

http://housecall.trendmicro.com/

which you can use for free, usually locates and defines the virus and if you can't automatically delete it...will give you step by step instructions on how to do so manually.
Click to expand...

House call had been pretty reliable when I worked at a PC Repair shop. Also, for giggles... Changing your MSN log-in credentials might not be a bad idea.

Oh... And it would probably be best to use Firefox over IE.
 
You must log in or register to reply here.
Back
Top