Msn Latest Virus *take note*

• pierre^^

  1 Apr 07, 12:47

  i download the file
  
  den i did a f-secure internet security scan on the file
  but nv detect anithing
  
  so i jus del it
  
  
• Xtrider

  3 Apr 07, 01:54

  a F U C K...my fren sent it and i DL my accident..zzzz... but its in a zip form... didn open it and deleted... scanning now... will i have any problem???
• ndmmxiaomayi

  3 Apr 07, 02:29

  As long as this file is being downloaded, you will be infected.
• Quinsy

  3 Apr 07, 02:45

  heng every night i scan com.
• MyPillowTalks

  3 Apr 07, 16:50

  OMG! i just dled into my thumbdrive, and run a scan wid AVG
  
  
• lpx88

  3 Apr 07, 17:51

  Originally posted by MyPillowTalks:

  OMG! i just dled into my thumbdrive, and run a scan wid AVG
  
  

  chi1 bao3 mei2 shi4 zhuo4 ah
• MyPillowTalks

  3 Apr 07, 19:22

  ok great, i downloaded the photo album, then i click on restore the file instead of empty virus vault, now cannot find
• MyPillowTalks

  3 Apr 07, 19:25

  paiseh, mayi, need ur help again
  
  Logfile of HijackThis v1.99.1
  Scan saved at 19:22:30, on 2007-4-3
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
  C:\WINDOWS\system32\nvsvc32.exe
  C:\Program Files\SiteAdvisor\6028\SAService.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\UStorSrv.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\AlienGUIse\wbload.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\WgaTray.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\devldr32.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BP.EXE
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
  C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
  C:\Program Files\SiteAdvisor\6028\SiteAdv.exe
  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\internet explorer\iexplore.exe
  C:\WINDOWS\system32\conime.exe
  D:\E.G. Tuners\System\HijackThis.exe
  
  R3 - URLSearchHook: Yahoo! Toolbar BETA - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll
  O3 - Toolbar: Yahoo! Toolbar BETA - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [EPSON Stylus CX3500 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BP.EXE /P26 "EPSON Stylus CX3500 Series" /O6 "USB001" /M "Stylus CX3500"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
  O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
  O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6028\SiteAdv.exe
  O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
  O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
  O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
  O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra button: (no name) - {11316B13-33F0-4C9F-BD55-09994CCFA8EB} - C:\WINDOWS\System32\shdocvw.dll
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {2B866353-E598-4403-8E4D-B871AB30DC55} (Speed Class) - http://www.singnet.com.sg/technical/helptools/media/SpeedCtrl.cab
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O16 - DPF: {7606693A-C18D-4567-AF85-6194FF70761E} (GomWeb Control) - http://app.ipop.co.kr/gom/GomWeb.cab
  O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://www.epson.com.sg/support/OnlineDiagnosis/selftest/Prg/ESTPTest.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/WscWlanScannerCtrl.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll
  O20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
  O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6028\SAService.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe
  
  
• ndmmxiaomayi

  3 Apr 07, 19:31

  Show hidden files and folders
  

  [*]Open My Computer.
  [*]Go to Tools > Folder Options.
  [*]Select the View tab.
  [*]Scroll down to Hidden files and folders.
  [*]Select Show hidden files and folders.
  [*]Untick Hide extensions of known file types.
  [*]Untick Hide protected operating system files (Recommended).
  [*]Click Yes when prompted.
  [*]Click OK.
  [*]Close My Computer.

  
  
  Go to Jotti or Virus Total and upload this file for scanning: C:\WINDOWS\system32\conime.exe
• MyPillowTalks

  3 Apr 07, 19:34

  all found nothing lea
  
  skarli ish cannot find
• ndmmxiaomayi

  3 Apr 07, 19:40

  That means you lucky lor. AVG deleted it liao.
• MyPillowTalks

  3 Apr 07, 19:42

  Originally posted by ndmmxiaomayi:

  That means you lucky lor. AVG deleted it liao.

  but i remember i restore back the file, then cnnt find in my thumdrive, i scan my thumbdrive, found nothing.
  
  maybe is cos i delete the whole virus folder for safe sake, but cannot delete untill i replugin my thumbdrive
• ndmmxiaomayi

  3 Apr 07, 19:44

  Originally posted by MyPillowTalks:

  but i remember i restore back the file, then cnnt find in my thumdrive, i scan my thumbdrive, found nothing.
  
  maybe is cos i delete the whole virus folder for safe sake, but cannot delete untill i replugin my thumbdrive

  Your thumbdrive also don't have, how to find back? Ask your friend send you back lor...
• MyPillowTalks

  3 Apr 07, 19:46

  Originally posted by ndmmxiaomayi:

  Your thumbdrive also don't have, how to find back? Ask your friend send you back lor...

  tsk, i tink they also accept then dunno they store where
  
  actually i ish wanna bring to school then open in the school's computer, but, haix
  
  wish some1 sent it back to me
• MyPillowTalks

  3 Apr 07, 19:47

  pci file recovery
• ndmmxiaomayi

  3 Apr 07, 19:48

  Originally posted by MyPillowTalks:

  tsk, i tink they also accept then dunno they store where
  
  actually i ish wanna bring to school then open in the school's computer, but, haix
  
  wish some1 sent it back to me

  Sign in and sign out.
  
  By default, it's in My Documents\My Received Files
  
  MSN stores all received files in that folder.
• MyPillowTalks

  3 Apr 07, 19:50

  Originally posted by ndmmxiaomayi:

  Sign in and sign out.
  
  By default, it's in My Documents\My Received Files
  
  MSN stores all received files in that folder.

  ok
  
  hmm my com skill still not good enough
  
  must learn how ot read log liao
• ndmmxiaomayi

  3 Apr 07, 19:51

  Originally posted by MyPillowTalks:

  ok
  
  hmm my com skill still not good enough
  
  must learn how ot read log liao

  Huh?
• MyPillowTalks

  3 Apr 07, 19:52

  Originally posted by ndmmxiaomayi:

  Huh?

  in other words, teach me how to read the logs lea, how u noe wad will be infect4ed?
• TrixCereals

  3 Apr 07, 19:56

  Originally posted by ndmmxiaomayi:

  Nice virus.
  
  Even alternative MSN programs also tio.
  
  Me using aMSN.

  something off topic,
  
  what's the difference btwn Live Messenger and aMSN?
• ndmmxiaomayi

  3 Apr 07, 19:58

  Originally posted by MyPillowTalks:

  in other words, teach me how to read the logs lea, how u noe wad will be infect4ed?

  Join me over at Malware Removal. I'm not qualified to teach. Geeks to Go, Spyware Info, Tom Coyote, Tech Support Forum or That Computer Guy will also teach you.
• ndmmxiaomayi

  3 Apr 07, 20:06

  Originally posted by TrixCereals:

  something off topic,
  
  what's the difference btwn Live Messenger and aMSN?

  aMSN has a lot of things that Windows Live Messenger don't have.
  
  aMSN opens your email in Firefox, check if your friends block you (known as reverse list), track their version of MSN, steal your friend's pictures, notifies you whether your friends are on or offline, change skin and tabbed chats, all without plugins.
  
  The only thing that they don't have, offline messenging!
  
  They have one plugin that I like, chat in mIRC style! Very nice feature.
  
  If you want your friend to know what you are listening and like using iTunes or Winamp, there's a plugin that just does this.
• MyPillowTalks

  3 Apr 07, 20:14

  Originally posted by ndmmxiaomayi:

  Join me over at Malware Removal. I'm not qualified to teach. Geeks to Go, Spyware Info, Tom Coyote, Tech Support Forum or That Computer Guy will also teach you.

  u qualify first lor, i sec 3 nia, not time, ad i oso scared my skills now will be hard for me to cope when i get into poly
• ndmmxiaomayi

  3 Apr 07, 20:16

  Originally posted by MyPillowTalks:

  u qualify first lor, i sec 3 nia, not time, ad i oso scared my skills now will be hard for me to cope when i get into poly

  Must wait at least one year. But I'm betting for 2 years to get qualified.
• MyPillowTalks

  3 Apr 07, 20:18

  Originally posted by ndmmxiaomayi:

  Must wait at least one year. But I'm betting for 2 years to get qualified.

  but u tink based on wad i noe now will i be stressing when i be in poly?
  
  nxt year teach me