Overclock.net banner
1 - 20 of 20 Posts

·
Registered
Joined
·
58 Posts
Discussion Starter · #1 ·
Hi peeps, I got this msn virus and every time I login it automatically keeps sending a message and a link to people on my contacts list. Not sure exactly what the message says but it's something like "foto?? 'contact's email address'" or something along those lines and sometimes it tries to share photo's. It sends it to random contacts every time.
I'm on Vista Ultimate x64. I've tried changing my password and it still does it.
Any ideas what it is and/or how to remove it is greatly appreciated.
Thanks.
 

·
Premium Member
Joined
·
18,618 Posts
Quote:

Originally Posted by uNeec View Post
Just reformat your computer.
It's not that, my friend built a new computer and it's still happening!

All the parts were knew as well.
 

·
Blue and Green Team!
Joined
·
10,742 Posts
Change MSN password and scan with a good AV and anti spyware program.
 

·
Registered
Joined
·
4,223 Posts
LOADS of people i know have this virus, what happens is, once you click the link, it installs something on your PC which makes you send it to everyone else.

i clicked the link, but becuase i got Internet Download Manager, it asked me if i wanted to download and run the .exe it tried to install first.
 

·
Premium Member
Joined
·
11,272 Posts
Quote:


Originally Posted by alex98uk
View Post

It's not that, my friend built a new computer and it's still happening!

All the parts were knew as well.

You/he got infected again...

I've seen my friends happily click these links.
 

·
Premium Member
Joined
·
18,618 Posts
I wonder whether it's got his password and is sending it externally, not from his PC.
 

·
Registered
Joined
·
58 Posts
Discussion Starter · #14 ·
OK, scanned with malwarebytes, the logfile is as follows, maybe this will help, also the link what is sent to everyone I foud out is hi5-images.org/images.php?=friends email address

Malwarebytes' Anti-Malware 1.34
Database version: 1815
Windows 6.0.6001 Service Pack 1

03/03/2009 20:04:18
mbam-log-2009-03-03 (20-04-09).txt

Scan type: Full Scan (C:\\|)
Objects scanned: 281225
Time elapsed: 1 hour(s), 4 minute(s), 27 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
C:\\Windows\\fxstaller.exe (Backdoor.Bot) -> No action taken.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\ CurrentVersion\\Run\\Windows UDP Control Center (Backdoor.Bot) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\ CurrentVersion\\Policies\\Explorer\\NoActiveDeskto pChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\\System Volume Information\\_restore{083F21F2-DF0E-49CA-9292-AD1F0CD1D96E}\\RP99\\A0018322.exe (Adware.BetterInternet) -> No action taken.
C:\\Windows\\fxstaller.exe (Backdoor.Bot) -> No action taken.
 

·
Registered
Joined
·
455 Posts
I've had this same thing happen to me, someone sent a message about having a picture of me you click a link it installs, and then it sends the message to everyone on your contacts list.

All I did was run ESET and Spybot Search & Destroy, Uninstalled Messenger, then reinstalled with the latest version.

Never had an issue since.
 

·
Premium Member
Joined
·
11,272 Posts
It doesn't install, it asks you to download or run an EXE. It's your fault if you click the SECOND button.
 
1 - 20 of 20 Posts
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top