Virus Warnings

[nemafakei]

I reckon we need to create a thread for major virus alerts.

So, if any of your friends send you the following link on MSN:

http://www.block-checker.com

Do not click on it.

Please reply only if you have a new virus warning, then people can easily see when there are new warnings.

[Andrew]

Umm, is there a way to not make the link in your post clickable? :P

Oh, I see the url is h ttp://0/ nice! I take it you did that so we don't click on it?

I might have went to that before or another website that made you enter your msn account and password and it tells you who has you blocked etc. Luckily Miranda already has this option.

Never accept a file from a friend unless you know its coming or you get confirmation. Same with links.

[veK]

I don't see the sense in this topic as my antivirus program always notifies me of any suspicious virus, scripts or whatever. no matter if on irc, miranda, email, mozilla, downloaded files... but anyway, some people find might this helpful but: shouldn't this be in technical issues?

[gunner154]

Makes a lot of sense. And Re-veK, prevention is better than cure :)

And no, if it's technical issues, not as many people are going to refer to it. Not many of us go to the Technical Issues forum anyway.

[veK]

And Re-veK, prevention is better than cure :)

that's why I have the antivirus program. I never need it to cure, it always blocks before anything happens. no matter what crap I click on.  :)

[Caid Ivik]

People don't make such fun about it, I am paranoic to log here from my house since I catch a new CWS while reading the birthday thread...no fear now, I write from school  ;)

[erjin999]

Not while reading the Happy birthday thread, shurely ? You mean while browsing the thread and other stuff (pr0n :P) ?

Although you will have to be careful of virus hoax's as well.

[Andrew]

Don't use websites that claim to show you who has you blocked or deleted on msn network. htey collect your email address and posibly your password (they work, but privacy is terrible).

Use miranda instead, it can do that for you :)

[gunner154]

I've observed many friends getting victimised by those bogus "blocking/deleting checks". It even has them automessage whoever they talk to when they pop the window up.

[Hanmya]

I got some message in my Bulk Folder and it had the title "Urgent" by some guy I didn't know, could that have been some sort of virus? I really didn't know viruses can be sent just like that to anyone... [i deleted it anyway]

[Phoenix]

It is possible to send a virus within an e-mail..

Often is it an infected file.

but also malicious html code...

good you deleted it..

I also delete such mail.

[Andrew]

New MSN Virus/Trojan

A new worm that carries a message reminiscent of movies such as "The Ring" or "FearDotCom" is currently making rounds in the MSN Messenger community according to antivirus specialist Panda Security.

[Barbarossa]

Hmmm, I was on AIM today. I received a message from a friend saying "Hey!". A minute later, he sent a second message saying "is alright if I put this picture of you on our Myspace?" Along with a link. I clicked it, and he logged out. I was then that all hell broke loose. The Virus has been uploading every conceivable type of Ad ware into my Comp. I'm getting ready to shoot myself from the popups alone. Worse, none of my programs can remove them! I keep getting a message saying "The files cannot be removed. In use by Directory" or something like that.

My friend logged on a minute later and said "WTF? That wasn't me."

[Andrew]

My friend logged on a minute later and said "WTF? That wasn't me."

That's because his computer is infected as well. You will most likely send the same thing to people on your contact list.

[Barbarossa]

Indeed. I Deleted the Original file. It's quite malicious though, and has spread quite quickly.

I think I'm just going to save to Disks, what I know is safe. Then delete everything and reinstall my OS. :(

[Acriku]

Another reason why you should rarely accept things from friends, or if you do through IM or e-mail, reply and see if your friend is not an automated virus IM/e-mail.

[MrFlibble]

I sometimes receive a pop-up message box that says something like "Message from SYSTEM to ALERT. You computer softaware has serious errors that may lead to malfunction and data corruption. To fix this, go to www.c32.net and download System Doctor, start it, then reboot the system" when I establish Internet connection.

Spam? Virus? Trojan? Junk ad?

[Andrew]

Did you go to the c32 website? If so what is it? I'm not clicking on the link because it could be a virus. Simple google search didn't pop anything up.

Could be anything, I'd do a virusscan and adware scan.

[Acriku]

Assuming it actually is System Doctor that you're installing, it is typically regarded as (according to my google search) as a low-risk process that will start when rebooting, and was used to diagnose your computer for various problems. One site says that the worst it can be said to be is adware that detects spyware and recommends you to buy certain software to get rid of it.

No threat.

http://www.auditmypc.com/process/sysdoc32.asp

http://www.sophos.com/security/analyses/systemdoctor.html

As for www.c32.net, I clicked on it (due to insane curiousity) and for now it just shows a site referer since it is under construction. *shrugs*

[erjin999]

Sites that advertise themselves like that are usually trying to make money somehow.

[Cyborg]

Sites that advertise themselves like that are usually trying to make money somehow.

*applauds*

[Andrew]

I just got an email into my Windows Live Mail inbox.

I thought it looked legitimate, but I wasn't going to click on anything anyway, then I noticed the weird email address and where the links went to.

I use Windows Live Mail Beta.

Sender: Windows Live Mail Beta Staff (communications_msn_cs_enca<@>x<@>cimail1.msn.com)

Subject: You could attend a dream concert anywhere in the world, and more

The links all go to hxxp://xxxxxxxxxcimail1.msn.com/Key=2266.DpHK.L.Q.Nl4kcfxxxxxxxxx

I changed the email and link slightly to deter people from accidentally clicking on it.

The scary part is Windows Live Mail had it marked as a known sender. Then I reported and deleted it.

[Andrew]

So recently some friends hotmail got infected by simply clicking on what appears to be an image link (which turns out to be a link to virus website). Once clicked somehow people have control of their hotmail account and start sending out exact same spam to all the contacts.

Just got off the phone with someone, and they said when they logged in to hotmail to change password it showed up as it was sending emails right then and there.

I told them to change password, as this usually fixes the problems with spammers. But the only additional problem I can think of is if virus on computer which would figure out new password.

Attached is image of spam email. This is what they usually look like. All links are clickable, and they use completely different urls at times.

They most likely use windows vista and IE. I clicked on link (silly me), hopefully not capable of taking my email/password. I did see a googleapi url appear. Didn't wait long enough to see what happens.

Some url checkers I am trying to use show it as bad.

[Gobalopper]

People still use Hotmail?

[Andrew]

People still use Hotmail?

Yah I know. Sad. Same people who use IE, probably don't patch windows, and have out of date antiviruses.

If anyone can figure out the extent of this infection would be helpful. I'm hoping password change fixes it. I think it did for one user last week. Of course the person I was talking to tonight said they had credit card receipts in hotmail account. sigh.

aha!

http://doiop.com/ is a url redirector, now to figure out the url that gets redirected.

xrl.us is another redirector. So looks like they use url redirectors to get to malware sites.

Gonna try the malware links in virtualbox windows.

EDIT:

link goes to 70kb binary file called fotos.com

aww fuck, I enabled it and my bandwidth is being maxed out. So it is sending spam non stop. So they most likely are infected on computer.

Windows is running lots of winntR1.exe and winnt1.exe according to process explorer. Going back to clean windows snapshot to see if it has same processes running. Nope, none of them are running on clean winxp.

ARGH. gonna have to fix their computers.

EDIT:

url redirectors are catching on that they are malware links and removing them. Still got one that works though. downloads as videos.com

Might be running in msconfig->services tab as windows media player network sharing service

Talked to person on phone, they got malware infected everywhere on computer (like antivirus2009 malware). gonna have to backup stuff and fix their laptops.