Shoutbox

help if you can! - Printable Version

-Shoutbox (https://shoutbox.menthix.net)
+-- Forum: MsgHelp Archive (/forumdisplay.php?fid=58)
+--- Forum: Messenger Plus! for Live Messenger (/forumdisplay.php?fid=4)
+---- Forum: WLM Plus! Bug Reports (/forumdisplay.php?fid=7)
+----- Thread: help if you can! (/showthread.php?tid=45534)

help if you can! by hecks on 05-30-2005 at 09:50 PM

hi, ive just got this virus where it opens up all my contacts who are online and then sends them a link .....  when you click on the link it comes up as a download but doesnt complete so not sure how i actually got the virus. any help?? thanks hecks


RE: help if you can! by mwe99 on 05-30-2005 at 10:16 PM

Yes thanks for removing the link,

In regards to your problem, these thread may help:

http://shoutbox.menthix.net/showthread.php?tid=44...d=459314#pid459314

http://shoutbox.menthix.net/showthread.php?tid=43...d=450812#pid450812


RE: help if you can! by hecks on 05-31-2005 at 01:23 PM

those didnt work! and now its got worse! i cant see what im writing on msn! other people can see but i cant :S


RE: help if you can! by mwe99 on 05-31-2005 at 01:24 PM

Okay we need more information on what happens, do get an error message? Do you have anything installed such as Smiley Central or any other plugins?


RE: help if you can! by Zephyr on 05-31-2005 at 01:47 PM

Also, what is the exact text that is sent to your contacts, or is it just the link.

for example, some say:

hi
look at this picture of you
<link>


RE: help if you can! by hecks on 05-31-2005 at 02:49 PM

it isnt the virus which sends them a picture of anything like that! its just a link...


RE: help if you can! by mwe99 on 05-31-2005 at 02:51 PM

so its just a link on its own then? 


RE: help if you can! by hecks on 05-31-2005 at 02:51 PM

the link hasnt shown up today though and everything looks to be ok .... my writing has come back! ... but dont want to speak to soon!


RE: help if you can! by hecks on 05-31-2005 at 02:52 PM

and yea just a link on its own!


RE: help if you can! by Zephyr on 05-31-2005 at 02:52 PM

quote:
Originally posted by hecks
it isnt the virus which sends them a picture of anything like that! its just a link...

There isn't a virus which sends a picture, it just tries to make the contact think it is a picture so that they will click on it, but really it is a link to download a virus.

Could you please answer the questions posted above as we need more detail to help you.

Also, please don't double post, you can use the edit button on your first post if you wish to add anything.
RE: help if you can! by user27089 on 05-31-2005 at 02:53 PM

It's a new virus people, somebody kept sending me the link last night, I know that it's not there fault, but it's becoming a major hastle, it looks like somebody has created another worm, it says '~Leach', then gives you a link...

If you receive any random links that say something like "leach" in it, then DO NOT click it!...


Here is the chat log of the person who was sending me the links :rolleyes:...:

quote:
Originally posted by Virus Conversation
[13:46:38] im adorable : n=leach
[14:11:46] im adorable: http://subdomainremoved.animedb.com/script.php?da...orum&section=leach
[14:11:49] Luke - "Grow: :-/
[14:12:32] im adorable : i know
[14:12:42] Luke - "Grow: :p

RE: help if you can! by hecks on 05-31-2005 at 02:57 PM

no i havent got smiley central or anything and nope dont get an error.... its just when im talking on msn it will open up all my contacty who are online and then send them the link


RE: help if you can! by hecks on 05-31-2005 at 02:59 PM

traxor... thats the one ive got!


RE: help if you can! by user27089 on 05-31-2005 at 03:03 PM

I know, I don't think that it has been around for very long, and there isn't any security definitions, I've sent an email to the owner of animedb:

quote:
Originally posted by email i sent
To Whom it may concern,

I am not blaming you for this matter, as it may not be you that is responsible for this crime. One of the subdomains for your website contains some malicious content, a worm, that is going around MSN Messenger at the moment, it is putting millions of users of MSN Messenger at risk, unless you remove this subdomain, therefore, preventing any further attacks on the computers of innocent MSN Messenge users.

The worm in question is similar to the worm that was going around MSN Messenger in the previous months, with the extension of .scr, .exe & .pif; it attaches itself to MSN Messenger, and sends a message to every user on MSN Messenger saying the following:

[13:46:38]im adorable: n=leach
[13:46:38]im adorable: http://freezoe.animedb.com/script.php?data=forum&section=leach

As you can see, the subdomain is clearly one of yours, so I would advise you to remove the subdomain before further action is taking, it is just a forewarning, as I cannot take action, but I'm sure Microsoft would, I am advising Microsoft of this matter and will be forwarding them this email that I have sent you.

Please reply as soon as possible.

Yours faithfully,

Luke J.

Hopefully, they will remove the subdomain before any other damage is caused, as said, I will contact Microsoft, and will also contact Symantec.
RE: help if you can! by hecks on 05-31-2005 at 03:06 PM

cheers. hopefully something will happen soon. thanks again


RE: help if you can! by user27089 on 05-31-2005 at 03:08 PM

That's okay, have you downloaded all of the latest definitions for your anti-virus software and ran a thorough scan of the whole computer?


RE: help if you can! by hecks on 05-31-2005 at 03:11 PM

yea. nothing shows up on my virus scanner.


RE: help if you can! by user27089 on 05-31-2005 at 03:16 PM

I have just tested the link using a piece of software, and it tries to download "look iamflying.exe". So if anybody sends you that file, then do not accept.

quote:
Originally posted by hecks
yea. nothing shows up on my virus scanner.

I am not surprised, I really don't know what you could do to try and get rid of the virus...
RE: help if you can! by SikStyles on 05-31-2005 at 03:34 PM

if its a worm then a worm works like this, it goes thru ur network holes to replicate itself and then goes to another user and so on replicating itself many times...deletin the subforum will only get rid of the download action but not the link itself as the worm is in ur computer..if u have a good virus protection the go on their website and look for maybe updated virus definitions..or maybe they have something about deletin the virus..

good luck