VIRUS BEING SENT THROUGH WINDOW LIVE

Hi there, 3 people i chat too have had a message sent to them from someone on
their chat list. The message contains a link to a website ... this is an
example of what was sent to me....
http ://imageshack.opendns.be/pic2.jpg-www.imageshack.com Hey, do you know
t s girl? She said she knows of you and I t nk she might like you "

This message is sent via people your talking to live.... so it appears that
they have sent it. It just happened to me tonight. I have used MSN
Messenger for 7yrs and this has never occured before.... Is there now a
sercurity issue????

I have had the same message being sent to me from one specific contact, who
claims not to know anything about it. Directly after I got it, my anti-virus
protection detected several (about 6) viruses, and I had to do a boot-scan
to clean them.

"Slipperysam" <> wrote in message
news:79E7FDB9-1E4B-4457-9AC5-...
> Hi there, 3 people i chat too have had a message sent to them from someone
> on
> their chat list. The message contains a link to a website ... this is an
> example of what was sent to me....
> http ://imageshack.opendns.be/pic2.jpg-www.imageshack.com Hey, do you
> know
> t s girl? She said she knows of you and I t nk she might like you "
>
> This message is sent via people your talking to live.... so it appears
> that
> they have sent it. It just happened to me tonight. I have used MSN
> Messenger for 7yrs and this has never occured before.... Is there now a
> sercurity issue????

The other issue.. and i dont know if it is related....

Is that since everyone started to use Windows live... including myself...
Is that you are constantly booted more then ever before.... and sometimes it
requires a reboot in order to connect again...



"Francisco Frost" wrote:

> I have had the same message being sent to me from one specific contact, who
> claims not to know anything about it. Directly after I got it, my anti-virus
> protection detected several (about 6) viruses, and I had to do a boot-scan
> to clean them.
>
>

On Wed, 19 Sep 2007 05:58:02 -0700, Slipperysam wrote:

> "Francisco Frost" wrote:

>> I have had the same message being sent to me from one specific contact, who
>> claims not to know anything about it. Directly after I got it, my anti-virus
>> protection detected several (about 6) viruses, and I had to do a boot-scan
>> to clean them.

This has always been a problem with IM services; being directed to sites
with malicious code. I am not sure about the mechanism by which senders
masquerade as known contacts, though. That may be a recent security issue,
or just an old one only now being exploited. The trick is to not click on
the links.

> The other issue.. and i dont know if it is related....
>
> Is that since everyone started to use Windows live... including myself...
> Is that you are constantly booted more then ever before.... and sometimes it
> requires a reboot in order to connect again...

I can't say; I have never been "booted" from a Live Messenger connection.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

It's nothing new, it's the same old virus, just a different link.

Click link -> execute virus -> send to contacts who -> click link -> execute virus....

--
Jonathan Kay
Microsoft MVP - Windows Live Messenger/MSN Messenger/Windows Messenger
Associate Expert
http://www.microsoft.com/windowsxp/expertzone/
Messenger Resources - http://messenger.jonathankay.com
All posts unless otherwise specified are (c) 2007 Jonathan Kay.
You *must* contact me for redistribution rights.
--


"N. Miller" <> wrote in message
news:1nmhi63ls0uut$....
> This has always been a problem with IM services; being directed to sites
> with malicious code. I am not sure about the mechanism by which senders
> masquerade as known contacts, though. That may be a recent security issue,
> or just an old one only now being exploited. The trick is to not click on
> the links.

"N. Miller" wrote:

> This has always been a problem with IM services; being directed to sites
> with malicious code. I am not sure about the mechanism by which senders
> masquerade as known contacts, though. That may be a recent security issue,
> or just an old one only now being exploited. The trick is to not click on
> the links.

The trick is to not click on
> the links.

The trick is to not click on
> the links.
The trick is to not click on
> the links.

OOOOH, you mean, THAT'S how you avoid being attacked by, say... GETTING AN
INVITE LINK FROM AN UNKNOWN CONTACT TO CHAT WITH WEBCAM?? WOW, the fix is
THAT SIMPLE, eh? Kinda funny as hell that this thing is coming along through
Live and not MSN. I've never seen unknown links sent and never gotten a
virus the entire time I've ever been online (read almost every day for 7
years), and I will not use Live, just like about a couple MILLION people.
Microsoft had better start searching the web for the real number of ****ed
off people in this matter.

The tiny amount that actually find your blogs and decide to make a comment
are not even the tip of the iceberg worth of people you have ****ed off. And
stop completely ignoring the NINETY-NINE POINT EIGHT PERCENT of negative
comments, that are actually IN your blogs, directed at you people at
Microsoft with the exact same message stating "I HATE LIVE MESSENGER AND
WOULD RATHER USE ANOTHER MESSENGER IF YOU DO NOT JUST FIX MSN 7.5!"

If you fixed MSN 7.0, then you can fix MSN 7.5 for XP users! People are not
as dumb and blind to what is going on as you think they are, and you forcing
Live on people will not make them suddenly like Live messenger.

Do you guys like suddenly losing out on your money? How about that judgment
over in Europe? Did you like losing that $690 million? Because you're about
to lose a lot more thanks to hitting the idiot button once again. You should
feel happy people still want to use YOUR msn 7.5 program instead of just
going to a free one that is NOT your program without your placed ads, making
you lose money from advertisement space not used.

On Wed, 19 Sep 2007 18:10:00 -0700, DC wrote:

> "N. Miller" wrote:
>
>> This has always been a problem with IM services; being directed to sites
>> with malicious code. I am not sure about the mechanism by which senders
>> masquerade as known contacts, though. That may be a recent security issue,
>> or just an old one only now being exploited. The trick is to not click on
>> the links.
>
> The trick is to not click on
>> the links.
>
> The trick is to not click on
>> the links.
> The trick is to not click on
>> the links.
>
> OOOOH, you mean, THAT'S how you avoid being attacked by, say... GETTING AN
> INVITE LINK FROM AN UNKNOWN CONTACT TO CHAT WITH WEBCAM?? WOW, the fix is
> THAT SIMPLE, eh? Kinda funny as hell that this thing is coming along through
> Live and not MSN. I've never seen unknown links sent and never gotten a
> virus the entire time I've ever been online (read almost every day for 7
> years), and I will not use Live, just like about a couple MILLION people.
> Microsoft had better start searching the web for the real number of ****ed
> off people in this matter.
>
> The tiny amount that actually find your blogs...

You have lost me, there. What are you rambling on about? *I* am not MSFT...

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

These LINKS... are being sent by people in your friends list!!! These are NOT
OFFLINE MESSAGES.... You get these messages sent to you while chatting to
friends..... Its NOT JUST LINKS!!!

I just had an attempt to send a ZIP FILE to me while i was talking to
someone.... THEY TOLD ME IT WAS NOT THEM!

SO THIS IS NOT JUST LIMITED TO LINKS....

This has only started since using Windows LIVE... I had used MSN for 8yrs
without a problem...

Now 7 people in my chat list have been infected in 3 days!... not to mention
that thier friends have it, as it was passed onto them....

Again... these are NOT OFFLINE MESSAGES FROM PEOPLE YOU DONT KNOW !....
These messages come from people on your friends list.... it can be a link..
or zip file......


Does ANYONE FROM WINDOWS LIVE ACTUALLY READ THESE MESSAGE BOARDS????



"N. Miller" wrote:

> On Wed, 19 Sep 2007 18:10:00 -0700, DC wrote:
>
> > "N. Miller" wrote:
> >
> >> This has always been a problem with IM services; being directed to sites
> >> with malicious code. I am not sure about the mechanism by which senders
> >> masquerade as known contacts, though. That may be a recent security issue,
> >> or just an old one only now being exploited. The trick is to not click on
> >> the links.
> >
> > The trick is to not click on
> >> the links.
> >
> > The trick is to not click on
> >> the links.
> > The trick is to not click on
> >> the links.
> >
> > OOOOH, you mean, THAT'S how you avoid being attacked by, say... GETTING AN
> > INVITE LINK FROM AN UNKNOWN CONTACT TO CHAT WITH WEBCAM?? WOW, the fix is
> > THAT SIMPLE, eh? Kinda funny as hell that this thing is coming along through
> > Live and not MSN. I've never seen unknown links sent and never gotten a
> > virus the entire time I've ever been online (read almost every day for 7
> > years), and I will not use Live, just like about a couple MILLION people.
> > Microsoft had better start searching the web for the real number of ****ed
> > off people in this matter.
> >
> > The tiny amount that actually find your blogs...
>
> You have lost me, there. What are you rambling on about? *I* am not MSFT...
>
> --
> Norman
> ~Oh Lord, why have you come
> ~To Konnyu, with the Lion and the Drum
>

You're describing a "social engineering" attempt to get unsuspecting people
to click on links that connect to malicious web sites containing viruses,
spyware, worms, trojans, etc. The payload includes the virus and the
message used in the chat window to get the next person to click on the link.
It typically then sends itself back out to your entire contact list. These
appear to come from a friend, since they replicate through real contact
lists. There are literally thousands of different messages, viruses, etc.
in existence. If you want to learn more about this type of attack and how
to prevent infection (if you're in a workplace), see the IM Security Center
at www.imsecuritycenter.com.

-Don-


"Slipperysam" wrote:

> Hi there, 3 people i chat too have had a message sent to them from someone on
> their chat list. The message contains a link to a website ... this is an
> example of what was sent to me....
> http ://imageshack.opendns.be/pic2.jpg-www.imageshack.com Hey, do you know
> t s girl? She said she knows of you and I t nk she might like you "
>
> This message is sent via people your talking to live.... so it appears that
> they have sent it. It just happened to me tonight. I have used MSN
> Messenger for 7yrs and this has never occured before.... Is there now a
> sercurity issue????

On Thu, 20 Sep 2007 03:46:01 -0700, Slipperysam wrote:


> "N. Miller" wrote:

>> On Wed, 19 Sep 2007 18:10:00 -0700, DC wrote:

>>> "N. Miller" wrote:

>>>> This has always been a problem with IM services; being directed to sites
>>>> with malicious code. I am not sure about the mechanism by which senders
>>>> masquerade as known contacts, though. That may be a recent security issue,
>>>> or just an old one only now being exploited. The trick is to not click on
>>>> the links.

>>> The trick is to not click on
>>>> the links.
>>>
>>> The trick is to not click on
>>>> the links.
>>> The trick is to not click on
>>>> the links.

>>> OOOOH, you mean, THAT'S how you avoid being attacked by, say... GETTING AN
>>> INVITE LINK FROM AN UNKNOWN CONTACT TO CHAT WITH WEBCAM?? WOW, the fix is
>>> THAT SIMPLE, eh? Kinda funny as hell that this thing is coming along through
>>> Live and not MSN. I've never seen unknown links sent and never gotten a
>>> virus the entire time I've ever been online (read almost every day for 7
>>> years), and I will not use Live, just like about a couple MILLION people.
>>> Microsoft had better start searching the web for the real number of ****ed
>>> off people in this matter.
>>>
>>> The tiny amount that actually find your blogs...

>> You have lost me, there. What are you rambling on about? *I* am not MSFT...

> These LINKS... are being sent by people in your friends list!!! These are NOT
> OFFLINE MESSAGES.... You get these messages sent to you while chatting to
> friends..... Its NOT JUST LINKS!!!

<snipped a bunch of ranting>

> Does ANYONE FROM WINDOWS LIVE ACTUALLY READ THESE MESSAGE BOARDS????

Does anybody who posts to these groups (these *are* "News Groups", not
"boards") actually read the posts?

I will say it again...I AM NOT MSFT. I have never seen anyone who posts to
these groups who has admitted to working for MSFT. They may read these
groups, or they may not read them.

As for Messenger viruses, they are much older than Windows Live Messenger.
Just because you have never seen them before doesn't mean that it hasn't
happened before. IM services, *all* of them, have been virus vectors for
years. I know somebody who got infected clicking on a file they received
while using ICQ (back in 2000), which they thought that I had sent them; I
had not.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum