Messenger viruses abound!

[TanisNikana]

Caution! If someone you know sends you a suspicious looking file over your IM network, be advised it could be a virus!

(21:32:23) Megan: here, this picure is GREAT for your desktop wallpaper.
(21:32:25) Megan is offering to send file photo_977-JPEG.zip

This spells trouble! If you're using a 1st party client like MSN Live, Yahoo! Instant Messenger, or AIM 6.0, you should switch to a more secure client. Better clients include Pidgin (http://pidgin.im), trillian (http://www.ceruleanstudios.com), or meebo (http://meebo.com).

Remember, only you can prevent the distribution of viruses!

(This public service announcement brought to you by the fact that three members of this board sent me viruses in this manner in the last 10 minutes.)

[StarryShay]

Thank you for the warning.

[Sugarlat]

If you have been hit with this virus here's a way I found what to do if you do accept the file.

There is a virus being spread by MSN Messenger. You are asked to accept a picture from the person who you are talking to. If you do then a file called PICT1324(2)(1)(1)(2)(1)(1)(1).exe will be transferred to your computer and begin the process of asking others that you chat to to accept pictures as well.

The best way to avoid the file is to keep clicking Decline when asked (if the other person is affected then you will see several messages asking to accept the file)

If you do accept the file then you need to go into msconfig and remove the file from starting when Windows does. Do as follows:


1. Click on the Start button and click on Run
2. Then type in msconfig and click OK
3. You should see a screen that has System Configuration Utility in the blue bar
at the top
4. Click on the Tab that says Startup
5. Locate an entry that says MSN Messenger as the name. The filename will have
PIC1342(2)(1)(1)(2)(1)(1)(1).exe at the right hand side
6. Click the box beside the name MSN Messenger
7. Click the Apply button in the bottom right hand side of the screen
8. Then when prompted restart your computer and when Windows loads up again
locate the file on your computer (it should be in the C:/My Documents/Messenger Received Files directory) and then you should be able to delete it

I hope this helps anyone who has been affected

[Sugarlat]

Oh this also transfers as zip files and pictures

[TanisNikana]

It doesn't transfer as pictures. It transfers as executables wrapped as a zip file.

A better version of MSConfig is called Autoruns, and can be found

http://download.sysinternals.com/Files/Autoruns.zip

If you run it, in the menu there's an option to hide Microsoft entries. That should make finding malfunctioning software easier. Otherwise, it's as simple as clicking check boxes.

Edit: Forgot to mention, just run autoruns, and ignore autorunsc.

[nikkiolie]

Thanks for the help. I'll be sure not to accept any files for now ^_^

[TanisNikana]

I use autoruns in my line of work as a heavy-duty virus removal tool.

[JeffT]

Secunia is a great site to keep track of vulnerabilities in software applications. They have an RSS feed to make it easier. I think they have a free software scanning tool which compares your applications against their database, though I haven't used it.

Be sure to check for new versions of all the software you use weekly! That includes browser plugins, and everything.

[BlackjackGabbiani]

My Trillian has a block against that--it never sends files anyway! Lousy piece of crap...

[saya-chan14]

Wait did they know they were doing it, or there computer did it by its self?

[Hazuza]

The computer does it itself, and once you get it, you start doing it too. You don't see your computer sending it if you have it though.

[Syd-chan]

I've been getting similar things like this from my contacts for a while[MSN]. It's usually a link that tells you to enter your phone number or hotmail password and e mail. >> I did NOT do that. But just today, I've been getting those exact same messages.

[Sugarlat]

It's been a while since I got sent a message for it. It might have passed on to the next group of people XD

[nikkiolie]

I haven't gotten it yet. I don't plan on it....

I trust my friends and I know the ones I talk to don't send me crap

[Sugarlat]

Well that's a good thing.
My stupid messanger automatically downloaded it up i never opened the file so I was never affected.

[nikkiolie]

wow that sucks....i wonder if it automatically downloads all the time >_>

There was one person that kept sending me crap but I blocked them XD

[Sugarlat]

XD nice!
I think everyone has gotten rid of the virus.
cept i hear ari is still affected, but I don't has her on my msn XD

[nikkiolie]

that good to hear. I don't really know anyone that has gotten the virus.....maybe it was an attack against Tanis? =/

[Sugarlat]

I donno, I first got it from Bella, then Kakashi, then Youko.

[nikkiolie]

That's too bad. I really don't have too many forum people's messenger and even if I did I don't really talk to many of them. I tend to talk with my closer friends....like Patrick and Sarah XD