Shoutbox

Just another thread I've made regarding an MSN Virus. A friend of mine has a virus on her MSN Messenger that sends links to all the contacts on her list, not too sure what the link had completely but it had "Chatpr" at the end. I've sent her a few programs to run but it hasn't worked.

Anyone else had this? what's the best program and way to remove this? In advance thanks so much to anyone who helps, much appreciated!

sorry but via a symantec virus search, i was unable to locate any virus called chatpr...

but if its one that sends links over msn it is properfly a variation of W32.Kelvir

here is a link to the removal tool:
http://securityresponse.symantec.com/avcenter/ven....removal.tool.html

The virus is hosted at http://chatpr.org/ The page is msn.php? which is followed by email=<contact's e-mail>

The file downloaded is named by the e-mail address and it is an MS-DOS Application.

I can't find any any reference to what the virus is or how to remove it.

quote:

---

Originally posted by monster.rat
I can't find any any reference to what the virus is

---

Most probably another version of Rxbot which connects you to an IRC server, then, along with all the people of that have the virus, can be used to ddos sites.

EDIT: Checked it out, figured out what server it connects to, relayed that to Segosa since he knows more about it than me. The program also makes a connection to 180solutions.com which is the infamous adware/spyware site.

The file is only renamed to the person's e-mail address if they are @hotmail.com. If the email is not @hotmail.com, the virus will be called 'unknown@hotmail.com'

I think that the text sent along with the link is ur profile is under chatpr?

I would recommend pressing Ctrl+Alt+Del and seeing if there is a process with your e-mail in the name, or unknown@hotmail.com. If it is there, end the process and also delete it from your startup.

Start-> Run -> type msconfig

then on the startup tab, look for the file which is @hotmail.com and uncheck it. Then restart your computer.

Is this the virus? http://securityresponse.symantec.com/avcenter/ven...w32.serflog.c.html

If it is, I got that one quite a while ago. I think that it the transfer was accepted by the Plus! auto-accept

You should be able to use the removal tool on the link above if it is the same virus.

quote:

---

Originally posted by zach

If it is, I got that one quite a while ago. I think that it the transfer was accepted by the Plus! auto-accept

---

There are loads of viruses that spread through MSN Messenger, however I don't think the one you mentioned there has anything to do with the one mentioned in the first post.

Before it starts, please do not start posting every virus that spreads through MSN Messenger, because it isn't likely to be the one mentioned.

It downloads shitloads of adware: 180solutions, nCase, etc. I didn't bother checking if it connected to an IRC server, but I'd assume it does.