New MSN Virus?

** Links in this post may lead to active viruses. Please do not click them unless you know what you are doing. If you ignore this advice and go ahead and click them - tough dont come bitchin to me!**

Ok just received this message :

Quote:

---

UserX says:
Heh, is this really you? http://www.messengertools.org/[email protected]

---

where [email protected] was my MSN address.

The user did not send this message and the link tries to download a program called contact.exe

I did a quick google buit showed up nothing - and am on work machine (not in a DMZ) so dont want to **** around with it here.

Anyone seen this / have any additional info about it?

Also if you go to just messengertools.org it doesn't display a page simply tries to download a different .exe

so any info?

ta

v_Ln

Hi val,

Don't know if this will shed any light but...

http://www.google.ca/search?client=f...=Google+Search
MSN virus - Google Search

seems you're not alone.

Eg ;)

yeah there has been several MSN viruses before (i even wrote a removal tool for one many moons ago :) )

But this one appears slightly different to ones I have seen previously (most would attempt to send the infected file through msn, but i think new versions of the client block transfers of suspect file types) hence why it appears they have switched to a web download. A google search of the message the virus sends and the web addy it directs you to have turned up nothing.

And am really looking for some information on this particular infection type not all MSN viruses - but ta anyways :)

Sorry val...looked all over and came up empty...maybe it just hasn't been reported yet?

Eg ;)

There is a bit about this here: http://forum.mess.be/index.php?showt...21&#entry84621

Near the bottom of the page.

perfect jinxy - thanks :)

no word on its actual payload tho - but at least there is removal instructions. Thankfully I'm smart enough not to download random files online ;)
but a few of my friends aint so sensible and its gettin rather annoying receiving these damn messages :S

Not sure if there is still interest here. Just incase there is, here is what Trendmicro has on their site

http://www.trendmicro.com/vinfo/viru...R%2ECP&VSect=T

Looks like messengertools.org has now been pulled.

Thanks, Jinxy! My friend was hit with this and I couldn't find anything about it on Symantec last night, so thanks!!

- Xierox

I was hit with a new one last night from http:// messengerstats.net/

Here's a link to a fix

http://www.bertelsen.ca/journal/viru...sengerstatsnet