Shoutbox

someone should find out what is making it say go to {msnvirus.com} of wateva and make a patch for it

i see what you are saying

a bit off-topic here, but...
somebody could make a plugin which checks for a .txt or any other information file which could contain excerpts of url's, filenames and/or prose used to transmit the virus.

you would have to get user support for a plugin like that however.

quote:

---

Originally posted by Fergy
i see what you are saying

a bit off-topic here, but...
somebody could make a plugin which checks for a .txt or any other information file which could contain excerpts of url's, filenames and/or prose used to transmit the virus.

you would have to get user support for a plugin like that however.

---

it wouldnt be stored in a txt :/

quote:

---

Originally posted by YA_MUM
someone should find out what is making it say go to {msnvirus.com} of wateva and make a patch for it

---

patch a virus? why not just delete it? :\

quote:

---

Originally posted by ShawnZ
it wouldnt be stored in a txt :/

---

yeah i know, i was just using it as an example, some sort of file that could contain a blacklist

quote:

---

Originally posted by Fergy

quote:

---

Originally posted by ShawnZ
it wouldnt be stored in a txt :/

---

yeah i know, i was just using it as an example, some sort of file that could contain a blacklist

---

Um no, the links are sent live to all the people using it in a botnet over IRC.

www.m00.cx/wiki/index.php/botnets

There is nothing you can do about it besides using common sense (and keep your AV definitions up to date, but that will not protect against new virusses). Seriously, do you want the same thing as with the .pif, MSNM blocking it? Blocking all urls? Because that would be the only thing to prevent these messages.

Most important rule to prevent getting infected:
If the first thing sent in a message is a link, do not click it! Virusses/worms always send messages to all contacts on sign in.

Second thing that will stop it beeing spred is:
Warn the person you got that message from and if you can provide instructions on how to get rid of it. That person can then get rid of it and send your intructions to the contact he/she got it from.

i'm talking about MSN not IRC

say somebody sent you something like this:

quote:

---

OMGZ! you have 2 check dis out: http://www.reallybadsite.com/with/a/reallybadfile.pif

---

The plugin would check it's blacklist for a match, it finds a match in *.reallybadfile.pif (where * is a wildcard) and alerts you that your contact has been infected with a known virus (this could also inform your contact as well).

quote:

---

Originally posted by Fergy
i'm talking about MSN not IRC

say somebody sent you something like this:

The plugin would check it's blacklist for a match, it finds a match in *.reallybadfile.pif (where * is a wildcard) and alerts you that your contact has been infected with a known virus (this could also inform your contact as well).

---

I meant irc as in thats where the virus gets the new link from.

ahh yeah, got it!

REMINDER: Microsoft provides FREE virus removal over the telephone.  1-866-PCSAFETY or 1-866-727-2338
This phone number is for virus and other security-related support. It is available 24 hours a day for the U.S. and Canada.

On another note, The related virus I was talking about, McAfee has provided an EXTRA.dat for detection of a virus that is related to this one.  A fix for this virus has not yet been issued by McAfee, this is simply a fix for the related virus.

Simply copy the EXTRA.dat to your McAfee Program Directory

I have attached the zip file containing EXTRA.DAT.

-----------------------------------------

The file Fergy originally spoke of is Backdoor.Tixanbot.  The virus also has been known to spread as saying something along the lines of "Download the msn plus update! {url here}"

Update: Symantec Security Response has just issued Beta Virus Definitions (RapidRelease) that include protection for the original threat in this thread. Download them here