Do I have a Virus?

Everyone on my contact list keeps receiving strange messages from me at the
moment. I think it may be a virus. It is asking people to download pictures
etc, or says.. "What do you think of this picture". I am not sending
anything, however, I received a message from a friend which claimed to be a
screenshot with a PC error in it. I clicked it, but nothing was there,
however, I do believe this is a virus. I have removed and reinstalled the
app, I have carried out virus check, but nothing is found.

Help :-)

Dave,

Sounds like you have a virus there.

Do you have anti virus software installed so you can clean it off?


--
Richard Hay
http://WindowsObserver.com


"daviejojo" <> wrote in message
news:EEAC8CAD-2AF4-4DF8-9752-...
> Everyone on my contact list keeps receiving strange messages from me at
> the
> moment. I think it may be a virus. It is asking people to download
> pictures
> etc, or says.. "What do you think of this picture". I am not sending
> anything, however, I received a message from a friend which claimed to be
> a
> screenshot with a PC error in it. I clicked it, but nothing was there,
> however, I do believe this is a virus. I have removed and reinstalled the
> app, I have carried out virus check, but nothing is found.
>
> Help :-)
>

Greetings,

The problem with these Messenger worms is that they are modified continually and the various
anti-virus scanners, malware cleaners, etc. cannot keep up. You can't rely on one scanner or
tool, I'd suggest trying others. Most have an online scan, like OneCare, which may be able
to find it:
http://onecare.live.com/site/en-us/default.htm

Of course, usually they're just separate programs running and you can look into the Task
Manager, see something that doesn't belong and remove it. However, depending on your PC
knowledge and how familiar you are with what normally is run on your PC, this might be
difficult for you to do personally.

--
Jonathan Kay
Microsoft MVP - Windows Live Messenger/MSN Messenger/Windows Messenger
Associate Expert
http://www.microsoft.com/windowsxp/expertzone/
Messenger Resources - http://messenger.jonathankay.com
All posts unless otherwise specified are (c) 2007 Jonathan Kay.
You *must* contact me for redistribution rights.
--



"daviejojo" <> wrote in message
news:EEAC8CAD-2AF4-4DF8-9752-...
> Everyone on my contact list keeps receiving strange messages from me at the
> moment. I think it may be a virus. It is asking people to download pictures
> etc, or says.. "What do you think of this picture". I am not sending
> anything, however, I received a message from a friend which claimed to be a
> screenshot with a PC error in it. I clicked it, but nothing was there,
> however, I do believe this is a virus. I have removed and reinstalled the
> app, I have carried out virus check, but nothing is found.
>
> Help :-)
>

sounds very like my other post mate..................................


Recently i started receiving messages from one of my contacts with links to
webpages such as the following examples (have replaced http with **** to
prevent people clicking on these links).


****://ucakcatkisi.info
****://www.free-offers-for-you.com
****://www.dont-miss-this.com
****://www.free-offers-your-clicks.com
****://publicinfoart.info
****://invitesoftware.info
****://heycanbasliyor.info
****://auramin.info
****://suborusu.info

When these messages are received, the infected contact goes from being
online to showing as being busy for a period around 1 minute. Then it shows
them logging off and logging on again.

It became annoying to the point i asked them to run Anti spyware and
Antivirus scans. And after having them visit every online scan engine
possible, and using various locally installed anti spyware packages. None
of them was able to detect whatever was causing this barrage of links

Online scanners Tested
===============
Trend Micro , Eset, Symantec, Kaspersky, Panda, Bitdefender, Avast, Sunbelt,
Prevx CSI

Locally Installed Antispyware Tested
=======================
Windows defender, Superantispyware, Spyware Doctor, Spybot S&D, Adware 2007

Asked them to allow me to provide remote assistance to try and help them
with their problem, as this is causing not only them to be logged out of
msn, but its also crashing windows. And forcing them to restart the pc.

What i observed was that "windows live messenger" was using abnormally large
amount of the cpu before it logged them out and eventually caused the o/s to
crash. By This i mean a instant jump to 99%

When they were being logged out, a message with wording similar to "you have
been logged out of messenger and logged into another version that does not
support multiple login".

I then checked all running processes and not only was "windows live
messenger" running, but also "windows messenger" , the one XP installs by
default (Also using large amounts of Cpu time). And thinking of the popup
message from "live messenger" i thought that maybe somehow the old version
of "windows messenger" was in some way related to this problem and removed
it from their system.

This action has stopped my contact from sending me links , but has not
resolved the whole issue. As 4 of their contacts are sending the same links
to them , that in turn still causes them to be signed out of "windows live
messenger" (using lots of cpu time again) and have to log in again.

In short.... These links crash"windows live messenger" and somehow use
"windows messenger" to propagate the message onto everyone on your contact
list.

I use vista x64 , and these links do not cause my pc to crash or for cpu
usage to go up. Whether that's down to whatever is running only affects xp
machines or if its down to the individual piece of code that's been
installed on the xp machine i dont know.

You can observe the behaviour of it when using remote assistance in XP , via
help and support on your startbar. When it brings up your list of messenger
contacts to ask for remote assistance, you can observe it going through your
contact list 1 by 1 messaging them.

My friend and 4 of her friends surely aren't the only 5 people in the world
that's been infected by this

Hopefully this Half fix will help stop some peoples pc crashing but it
wont stop you being logged off or receiving more of these links from your
contacts............ until someone somewhere can deliver a proper fix for
this.

Hi,

Due to the way the Messenger API works, Windows Messenger will proxy API calls to Live
Messenger, that's why you're seeing this behavior.

--
Jonathan Kay
Microsoft MVP - Windows Live Messenger/MSN Messenger/Windows Messenger
Associate Expert
http://www.microsoft.com/windowsxp/expertzone/
Messenger Resources - http://messenger.jonathankay.com
All posts unless otherwise specified are (c) 2007 Jonathan Kay.
You *must* contact me for redistribution rights.
--


"Cyberhash" <> wrote in message
news:...
> sounds very like my other post mate..................................
>
>
> Recently i started receiving messages from one of my contacts with links to webpages such
> as the following examples (have replaced http with **** to prevent people clicking on these
> links).
>
>
> ****://ucakcatkisi.info
> ****://www.free-offers-for-you.com
> ****://www.dont-miss-this.com
> ****://www.free-offers-your-clicks.com
> ****://publicinfoart.info
> ****://invitesoftware.info
> ****://heycanbasliyor.info
> ****://auramin.info
> ****://suborusu.info
>
> When these messages are received, the infected contact goes from being online to showing as
> being busy for a period around 1 minute. Then it shows them logging off and logging on
> again.
>
> It became annoying to the point i asked them to run Anti spyware and Antivirus scans. And
> after having them visit every online scan engine possible, and using various locally
> installed anti spyware packages. None of them was able to detect whatever was causing this
> barrage of links
>
> Online scanners Tested
> ===============
> Trend Micro , Eset, Symantec, Kaspersky, Panda, Bitdefender, Avast, Sunbelt, Prevx CSI
>
> Locally Installed Antispyware Tested
> =======================
> Windows defender, Superantispyware, Spyware Doctor, Spybot S&D, Adware 2007
>
> Asked them to allow me to provide remote assistance to try and help them with their
> problem, as this is causing not only them to be logged out of msn, but its also crashing
> windows. And forcing them to restart the pc.
>
> What i observed was that "windows live messenger" was using abnormally large amount of the
> cpu before it logged them out and eventually caused the o/s to crash. By This i mean a
> instant jump to 99%
>
> When they were being logged out, a message with wording similar to "you have been logged
> out of messenger and logged into another version that does not support multiple login".
>
> I then checked all running processes and not only was "windows live messenger" running, but
> also "windows messenger" , the one XP installs by default (Also using large amounts of Cpu
> time). And thinking of the popup message from "live messenger" i thought that maybe somehow
> the old version of "windows messenger" was in some way related to this problem and removed
> it from their system.
>
> This action has stopped my contact from sending me links , but has not resolved the
> whole issue. As 4 of their contacts are sending the same links to them , that in turn still
> causes them to be signed out of "windows live messenger" (using lots of cpu time again) and
> have to log in again.
>
> In short.... These links crash"windows live messenger" and somehow use "windows messenger"
> to propagate the message onto everyone on your contact list.
>
> I use vista x64 , and these links do not cause my pc to crash or for cpu usage to go up.
> Whether that's down to whatever is running only affects xp machines or if its down to the
> individual piece of code that's been installed on the xp machine i dont know.
>
> You can observe the behaviour of it when using remote assistance in XP , via help and
> support on your startbar. When it brings up your list of messenger contacts to ask for
> remote assistance, you can observe it going through your contact list 1 by 1 messaging
> them.
>
> My friend and 4 of her friends surely aren't the only 5 people in the world that's been
> infected by this
>
> Hopefully this Half fix will help stop some peoples pc crashing but it wont stop you
> being logged off or receiving more of these links from your contacts............ until
> someone somewhere can deliver a proper fix for this.

I had a similar problem a while back.
All virus scanners failed to find it.
I finally found the bugger hidden on the active desktop as a web page.

Control Panel ->Display -> [Desktop] -> {Customize Desktop} -> [Web] >
{Delete}

Unfortunately, this is a great place to run malicious code !


"Jonathan Kay [MVP]" <> wrote in message
news:B80DA479-D4C5-4699-8004-...
> Greetings,
>
> The problem with these Messenger worms is that they are modified
> continually and the various anti-virus scanners, malware cleaners, etc.
> cannot keep up. You can't rely on one scanner or tool, I'd suggest trying
> others. Most have an online scan, like OneCare, which may be able to find
> it:
> http://onecare.live.com/site/en-us/default.htm
>
> Of course, usually they're just separate programs running and you can look
> into the Task Manager, see something that doesn't belong and remove it.
> However, depending on your PC knowledge and how familiar you are with what
> normally is run on your PC, this might be difficult for you to do
> personally.
>
> --
> Jonathan Kay
> Microsoft MVP - Windows Live Messenger/MSN Messenger/Windows Messenger
> Associate Expert
> http://www.microsoft.com/windowsxp/expertzone/
> Messenger Resources - http://messenger.jonathankay.com
> All posts unless otherwise specified are (c) 2007 Jonathan Kay.
> You *must* contact me for redistribution rights.
> --
>
>
>
> "daviejojo" <> wrote in message
> news:EEAC8CAD-2AF4-4DF8-9752-...
>> Everyone on my contact list keeps receiving strange messages from me at
>> the
>> moment. I think it may be a virus. It is asking people to download
>> pictures
>> etc, or says.. "What do you think of this picture". I am not sending
>> anything, however, I received a message from a friend which claimed to be
>> a
>> screenshot with a PC error in it. I clicked it, but nothing was there,
>> however, I do believe this is a virus. I have removed and reinstalled the
>> app, I have carried out virus check, but nothing is found.
>>
>> Help :-)
>>
>

Hi Al,

Interesting -- now I know why the feature got axed in Vista.

--
Jonathan Kay
Microsoft MVP - Windows Live Messenger/MSN Messenger/Windows Messenger
Associate Expert
http://www.microsoft.com/windowsxp/expertzone/
Messenger Resources - http://messenger.jonathankay.com
All posts unless otherwise specified are (c) 2007 Jonathan Kay.
You *must* contact me for redistribution rights.
--


"Al Sierra" <> wrote in message
news:5F3389F5-B42E-4BF6-B729-...
> I had a similar problem a while back.
> All virus scanners failed to find it.
> I finally found the bugger hidden on the active desktop as a web page.
>
> Control Panel ->Display -> [Desktop] -> {Customize Desktop} -> [Web] > {Delete}
>
> Unfortunately, this is a great place to run malicious code !
>
>
> "Jonathan Kay [MVP]" <> wrote in message
> news:B80DA479-D4C5-4699-8004-...
>> Greetings,
>>
>> The problem with these Messenger worms is that they are modified continually and the
>> various anti-virus scanners, malware cleaners, etc. cannot keep up. You can't rely on one
>> scanner or tool, I'd suggest trying others. Most have an online scan, like OneCare, which
>> may be able to find it:
>> http://onecare.live.com/site/en-us/default.htm
>>
>> Of course, usually they're just separate programs running and you can look into the Task
>> Manager, see something that doesn't belong and remove it. However, depending on your PC
>> knowledge and how familiar you are with what normally is run on your PC, this might be
>> difficult for you to do personally.
>>
>> --
>> Jonathan Kay
>> Microsoft MVP - Windows Live Messenger/MSN Messenger/Windows Messenger
>> Associate Expert
>> http://www.microsoft.com/windowsxp/expertzone/
>> Messenger Resources - http://messenger.jonathankay.com
>> All posts unless otherwise specified are (c) 2007 Jonathan Kay.
>> You *must* contact me for redistribution rights.
>> --
>>
>>
>>
>> "daviejojo" <> wrote in message
>> news:EEAC8CAD-2AF4-4DF8-9752-...
>>> Everyone on my contact list keeps receiving strange messages from me at the
>>> moment. I think it may be a virus. It is asking people to download pictures
>>> etc, or says.. "What do you think of this picture". I am not sending
>>> anything, however, I received a message from a friend which claimed to be a
>>> screenshot with a PC error in it. I clicked it, but nothing was there,
>>> however, I do believe this is a virus. I have removed and reinstalled the
>>> app, I have carried out virus check, but nothing is found.
>>>
>>> Help :-)
>>>
>>