Well he clicked a link on msn something to the effect of .. Is this really you? and a link followed he downloaded it and now my comuter sometimes oens mass internet explorer windows im running spybot the new one and it keeps asking if i want to change registry files/keys something about msn.com and i scanned with spybot and it found some registry keys so i removed em rebooted and it found it again but 5 entries instead of 4 the previous time i got AVG it moved some stuff to the cault i deleted everything from there rebooted my pc and it said a .dll was missing.. im thinking it was the virus now tea timer goes crazy blocking alerts i dont know what to do so i did a hijack this log and here it is
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:58:23 AM, on 28/03/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal
Yeah that is a trojan. I have a copy of the actual virus file here.
Some flags were related to vundo and others looked like smitfraud, but it was well written little beastie.
Rotary had it as well but fixed it by doing something or other. Your machine will probably be spreading this virus around to all your friends every time you log on.
I'm safe from these. Do you have the link it redirects to for the file?? I have been reporting the hacked servers which are hosting this nasty to their admins every time I come across them.
Quote: From: Fernando <admin@xxxxxxxxx.com>
To: juliaskitchen <juliaskitchen@xxxxxxxxxx.com>
Subject: Re: Server Hacked?
Date: Tue, 5 Feb 2008 09:33:54 +0100 (08:33 GMT)
Hello xxxxxxxx,
Thank you for your message, we are investigating the issue now.
Regards,
Fernando
On Feb 5, 2008, at 8:21 AM, juliaskitchen wrote:
> Hello
>
> I believe the server at http://www.inmobiliarialusan.com/images/ has
> been hacked and files added.
>
> PIC006.JPG-www.photoshare.com 04-Feb-2008 19:58 129K
>
> viewimage.php 04-Feb-2008 19:55 347
>
> Do not seem to relate to the site in any way.
>
> The server has been linked to by spam messages circulated by exploited
> machines using the MSN chat networks.
>
> ##sample message##
>
> (23:02:14) Paul (AKA - Rotary): haha is this really you on this
> pic? :)
> http://www.inmobiliarialusan.com/images/viewimage.php? > =xxxxxxxx@xxxxx.com
>
> ##
>
> Regards
>
> J.Richards
> administrator.
> Juliaskitchen.
So how do i get rid of it.. i dont want my machine sending that out to my friends so im staying off msn messenger untill my machine is fixed any ideas ?
[*]Close all other windows before proceeding.
[*]Double-click on dss.exe and follow the prompts.
[*]When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.
