Dubious web address on sign in

After I sign in to WLM I get a message purporting to come from one of my
contacts. All it says is "Contact Name says: http://www.cekilir.info/list". I
have looked at the site www.cekilir.info & creates the impression that it is
connected with MSN & will tell you who has blocked you on WLM if you input
your account details. At the bottom of the page is a statement in small
letters that the site is in no way connected with the Microsoft Corporation.
Naturally I did not fill out my details.
Has anyone else experience of this? Is it a hoax, as I suspect, or is it
genuine?

On Fri, 1 Feb 2008 03:00:14 -0800, Mike_Aberdeen wrote:

> After I sign in to WLM I get a message purporting to come from one of my
> contacts. All it says is "Contact Name says: http://www.cekilir.info/list". I
> have looked at the site www.cekilir.info & creates the impression that it is
> connected with MSN & will tell you who has blocked you on WLM if you input
> your account details. At the bottom of the page is a statement in small
> letters that the site is in no way connected with the Microsoft Corporation.
> Naturally I did not fill out my details.
> Has anyone else experience of this? Is it a hoax, as I suspect, or is it
> genuine?

Could be a way to get your account details. From time to time somebody posts
about losing a Messenger account. Makes one wonder if they weren't trying to
use a similar service.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

The site www.cekilir.info re-directs to one called msnliststatus.com. I've
searched for this site on Google & it features heavilly in lots of forums as
a phishing site. For what it's worth, I've therefore reported it to Microsoft
as such with IE's Phishing tool. Neither IE7 not Firefox picked it up as such
mind you....

What I can't understand is how the initial message found it's way in to my
WLM.

Mike.



"N. Miller" wrote:

> On Fri, 1 Feb 2008 03:00:14 -0800, Mike_Aberdeen wrote:
>
> > After I sign in to WLM I get a message purporting to come from one of my
> > contacts. All it says is "Contact Name says: http://www.cekilir.info/list". I
> > have looked at the site www.cekilir.info & creates the impression that it is
> > connected with MSN & will tell you who has blocked you on WLM if you input
> > your account details. At the bottom of the page is a statement in small
> > letters that the site is in no way connected with the Microsoft Corporation.
> > Naturally I did not fill out my details.
> > Has anyone else experience of this? Is it a hoax, as I suspect, or is it
> > genuine?
>
> Could be a way to get your account details. From time to time somebody posts
> about losing a Messenger account. Makes one wonder if they weren't trying to
> use a similar service.
>
> --
> Norman
> ~Oh Lord, why have you come
> ~To Konnyu, with the Lion and the Drum
>

Greetings Mike,

Sounds like someone with a Messenger virus on their PC sending it to you.

--
Jonathan Kay
Microsoft MVP - Windows Live Messenger
MSN Messenger/Windows Messenger
MessengerGeek Blog: http://www.messengergeek.com
Messenger Resources: http://messenger.jonathankay.com
(c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
--


"Mike_Aberdeen" <> wrote in message
news:EAC07131-B7FE-4210-BEAD-...
> After I sign in to WLM I get a message purporting to come from one of my
> contacts. All it says is "Contact Name says: http://www.cekilir.info/list". I
> have looked at the site www.cekilir.info & creates the impression that it is
> connected with MSN & will tell you who has blocked you on WLM if you input
> your account details. At the bottom of the page is a statement in small
> letters that the site is in no way connected with the Microsoft Corporation.
> Naturally I did not fill out my details.
> Has anyone else experience of this? Is it a hoax, as I suspect, or is it
> genuine?

Thanks Johnathan, looks like it. Though I know that the contact concerned is
firewalled, runs a virus checker (Avast), Windows Defender, and routinely
checks his pc with a couple of other malware utilities.

Mike.


"Jonathan Kay [MVP]" wrote:

> Greetings Mike,
>
> Sounds like someone with a Messenger virus on their PC sending it to you.
>
> --
> Jonathan Kay
> Microsoft MVP - Windows Live Messenger
> MSN Messenger/Windows Messenger
> MessengerGeek Blog: http://www.messengergeek.com
> Messenger Resources: http://messenger.jonathankay.com
> (c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
> --
>
>
> "Mike_Aberdeen" <> wrote in message
> news:EAC07131-B7FE-4210-BEAD-...
> > After I sign in to WLM I get a message purporting to come from one of my
> > contacts. All it says is "Contact Name says: http://www.cekilir.info/list". I
> > have looked at the site www.cekilir.info & creates the impression that it is
> > connected with MSN & will tell you who has blocked you on WLM if you input
> > your account details. At the bottom of the page is a statement in small
> > letters that the site is in no way connected with the Microsoft Corporation.
> > Naturally I did not fill out my details.
> > Has anyone else experience of this? Is it a hoax, as I suspect, or is it
> > genuine?
>
>

Hi Mike,

Won't stop a Messenger virus if they clicked and run the virus executable. They're usually
made from an existing one and are unique.

The utilities in question rely on blacklists and due to the uniqueness, are rarely detected
by any application I've seen. At least not for a few months.

--
Jonathan Kay
Microsoft MVP - Windows Live Messenger
MSN Messenger/Windows Messenger
MessengerGeek Blog: http://www.messengergeek.com
Messenger Resources: http://messenger.jonathankay.com
(c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
--


"Mike_Aberdeen" <> wrote in message
news:2D8B4AF6-7D20-4C68-9427-...
> Thanks Johnathan, looks like it. Though I know that the contact concerned is
> firewalled, runs a virus checker (Avast), Windows Defender, and routinely
> checks his pc with a couple of other malware utilities.
>
> Mike.
>
>
> "Jonathan Kay [MVP]" wrote:
>
>> Greetings Mike,
>>
>> Sounds like someone with a Messenger virus on their PC sending it to you.
>>
>> --
>> Jonathan Kay
>> Microsoft MVP - Windows Live Messenger
>> MSN Messenger/Windows Messenger
>> MessengerGeek Blog: http://www.messengergeek.com
>> Messenger Resources: http://messenger.jonathankay.com
>> (c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
>> --
>>
>>
>> "Mike_Aberdeen" <> wrote in message
>> news:EAC07131-B7FE-4210-BEAD-...
>> > After I sign in to WLM I get a message purporting to come from one of my
>> > contacts. All it says is "Contact Name says: http://www.cekilir.info/list". I
>> > have looked at the site www.cekilir.info & creates the impression that it is
>> > connected with MSN & will tell you who has blocked you on WLM if you input
>> > your account details. At the bottom of the page is a statement in small
>> > letters that the site is in no way connected with the Microsoft Corporation.
>> > Naturally I did not fill out my details.
>> > Has anyone else experience of this? Is it a hoax, as I suspect, or is it
>> > genuine?
>>
>>

Hi Johnathan,

Thanks for your answer. Is there anything around that would detect/eliminate
the virus that you know of?

Thanks,

Mike.

"Jonathan Kay [MVP]" wrote:

> Hi Mike,
>
> Won't stop a Messenger virus if they clicked and run the virus executable. They're usually
> made from an existing one and are unique.
>
> The utilities in question rely on blacklists and due to the uniqueness, are rarely detected
> by any application I've seen. At least not for a few months.
>
> --
> Jonathan Kay
> Microsoft MVP - Windows Live Messenger
> MSN Messenger/Windows Messenger
> MessengerGeek Blog: http://www.messengergeek.com
> Messenger Resources: http://messenger.jonathankay.com
> (c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
> --
>
>
> "Mike_Aberdeen" <> wrote in message
> news:2D8B4AF6-7D20-4C68-9427-...
> > Thanks Johnathan, looks like it. Though I know that the contact concerned is
> > firewalled, runs a virus checker (Avast), Windows Defender, and routinely
> > checks his pc with a couple of other malware utilities.
> >
> > Mike.
> >
> >
> > "Jonathan Kay [MVP]" wrote:
> >
> >> Greetings Mike,
> >>
> >> Sounds like someone with a Messenger virus on their PC sending it to you.
> >>
> >> --
> >> Jonathan Kay
> >> Microsoft MVP - Windows Live Messenger
> >> MSN Messenger/Windows Messenger
> >> MessengerGeek Blog: http://www.messengergeek.com
> >> Messenger Resources: http://messenger.jonathankay.com
> >> (c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
> >> --
> >>
> >>
> >> "Mike_Aberdeen" <> wrote in message
> >> news:EAC07131-B7FE-4210-BEAD-...
> >> > After I sign in to WLM I get a message purporting to come from one of my
> >> > contacts. All it says is "Contact Name says: http://www.cekilir.info/list". I
> >> > have looked at the site www.cekilir.info & creates the impression that it is
> >> > connected with MSN & will tell you who has blocked you on WLM if you input
> >> > your account details. At the bottom of the page is a statement in small
> >> > letters that the site is in no way connected with the Microsoft Corporation.
> >> > Naturally I did not fill out my details.
> >> > Has anyone else experience of this? Is it a hoax, as I suspect, or is it
> >> > genuine?
> >>
> >>
>

Hi Mike,

Well the easiest thing is just to open up the Task Manager and look at the processes running.
These things are pretty basic, they don't hide. All you have to do is locate what doesn't
belong, kill its process and then remove the executable.

--
Jonathan Kay
Microsoft MVP - Windows Live Messenger
MSN Messenger/Windows Messenger
MessengerGeek Blog: http://www.messengergeek.com
Messenger Resources: http://messenger.jonathankay.com
(c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
--


"Mike_Aberdeen" <> wrote in message
news:06C901D5-5DDB-45FE-ABAD-...
> Hi Johnathan,
>
> Thanks for your answer. Is there anything around that would detect/eliminate
> the virus that you know of?
>
> Thanks,
>
> Mike.
>
> "Jonathan Kay [MVP]" wrote:
>
>> Hi Mike,
>>
>> Won't stop a Messenger virus if they clicked and run the virus executable. They're
>> usually
>> made from an existing one and are unique.
>>
>> The utilities in question rely on blacklists and due to the uniqueness, are rarely
>> detected
>> by any application I've seen. At least not for a few months.
>>
>> --
>> Jonathan Kay
>> Microsoft MVP - Windows Live Messenger
>> MSN Messenger/Windows Messenger
>> MessengerGeek Blog: http://www.messengergeek.com
>> Messenger Resources: http://messenger.jonathankay.com
>> (c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
>> --
>>
>>
>> "Mike_Aberdeen" <> wrote in message
>> news:2D8B4AF6-7D20-4C68-9427-...
>> > Thanks Johnathan, looks like it. Though I know that the contact concerned is
>> > firewalled, runs a virus checker (Avast), Windows Defender, and routinely
>> > checks his pc with a couple of other malware utilities.
>> >
>> > Mike.
>> >
>> >
>> > "Jonathan Kay [MVP]" wrote:
>> >
>> >> Greetings Mike,
>> >>
>> >> Sounds like someone with a Messenger virus on their PC sending it to you.
>> >>
>> >> --
>> >> Jonathan Kay
>> >> Microsoft MVP - Windows Live Messenger
>> >> MSN Messenger/Windows Messenger
>> >> MessengerGeek Blog: http://www.messengergeek.com
>> >> Messenger Resources: http://messenger.jonathankay.com
>> >> (c) 2008 Jonathan Kay - If redistributing, you must include this signature or citation
>> >> --
>> >>
>> >>
>> >> "Mike_Aberdeen" <> wrote in message
>> >> news:EAC07131-B7FE-4210-BEAD-...
>> >> > After I sign in to WLM I get a message purporting to come from one of my
>> >> > contacts. All it says is "Contact Name says: http://www.cekilir.info/list". I
>> >> > have looked at the site www.cekilir.info & creates the impression that it is
>> >> > connected with MSN & will tell you who has blocked you on WLM if you input
>> >> > your account details. At the bottom of the page is a statement in small
>> >> > letters that the site is in no way connected with the Microsoft Corporation.
>> >> > Naturally I did not fill out my details.
>> >> > Has anyone else experience of this? Is it a hoax, as I suspect, or is it
>> >> > genuine?
>> >>
>> >>
>>