MSN VIRUS ALERT [Archive]

kevmech

13-02-2005, 09:23 PM

some people may try to send you some very strange pictures that dont have the right logo , these files are larger then images etc , ask the person wat it is before accepting!!! it is a MS-DOS program that i cant find a way to delete
IF ANYONE CAN HELP ME I WOULD TRUELY APPRECIATE IT

Achiel

13-02-2005, 09:40 PM

what is the name of the file?
did you have try deleting it in safe mode (hit F8 when starting up)?

Give us some more info so we can help you out m8!

kevmech

13-02-2005, 09:53 PM

theres around 9 files that have an MS-DOS logo, theyre names are stupid and are like 'she could fit her a** in a teacup' etc etc theyre in my c drive and whenever i try to delete them with rycycle bin they just make acopy of themselves back to the original position!!??

this is the freakiest thing ive seen and everytime someone logs in on msn it tries to infect them :S
HELP

edit: moving them into a folder and deleting the folder doesnt work , ive tried they just duplicate themselves bk to drive c :s

Juan90

13-02-2005, 10:14 PM

As Achiel says do F8 when starting, and delete them from the DOS prompt, but before you do that switch off System Restore. You can switch it back on if you wish after restarting the machine.

Do you have an uptodate AV and firewall running, and have you done the MS updates... not that there is a problem with MS OS's... honest! :)

kevmech

13-02-2005, 10:20 PM

ok thanks alot ill try it :)

TrainSpotteR

14-02-2005, 06:36 AM

this really needs to be in the technical forum....
but i'll add my 2 cents...
first thing, make SURE your anti-virus is up to date and you've got all the new critical updates for whatever version of windows you're running. in fact, give us some specs and that will help us assist you w/ removing the virus.
also, if you don't have a spyware proggy, you GOTTA get one... not to mention a firewall, if you're on a high-speed connection.
these are all just streaming thoughts about what to shoot for when locking down your PC to avoid infestation.
if you've for any questions about how to lockdown your computer (after you've gone through the process of getting rid of the little nasties), check this thread:
http://www.truff.net/forum/viewtopic.php?t=5079

kevmech

14-02-2005, 03:32 PM

my antivirus is up to date but still wont pick up on them , like i said i cant delete them like normal programs , also i noticed they are shortcuts but wat they link to isnt on my comp....btw on the start-up f8 menu wat do i do to slect wat ms-doc i delete????? someone help me plz this virus is doin my head in

kevmech

14-02-2005, 05:17 PM

SOMEONE PLZ HELP ME i dont wanna infect my friends but i also dont wanna wipe my comp clean i got too much valuable stuff on here. these are all the details i have :
8 MS-DOS program shortcuts in c drive
1 screensaver in c drive
can be moved but duplicate made in its place
sends itself thro msn messenger

someone said about using the f8 at startup but i dont know wat im meant to select or anything
HELP MEEE

Xepha

14-02-2005, 06:17 PM

Seems you're in a bit of a mess there mate...

Stuff to try:

Stay off MSN Messenger (for now). If someone sent you this crap and you know who it is, I would suggest blocking them - if they did intentionally -otherwise alert them that they might be infected also.

Gather as much information as possible: Full file names, file sizes, programs these shortcuts are a shortcut to, etc. and make a post at:
http://computercops.biz/forums.html

In the mean time, try:

An online Virus Scanner:
http://housecall.trendmicro.com/housecall/start_corp.asp

Give this a shot.
http://www.pcpitstop.com/

Zone Alarm (firewall), for simplicity (I would imagine). See if you can lock it down.
http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp

AVG Anti-Virus Scan:
http://free.grisoft.com/doc/2/lng/us/tpl/v5

Spybot, update it and run it.
http://www.safer-networking.org/en/download/index.html

Let us know how you get on.

(Can someone move this to Technical?)

kevmech

14-02-2005, 06:19 PM

thnaks for the help dude im now trying your ideas.sorry for not putting this on technical but i forgot about that section :p

Xepha

14-02-2005, 06:26 PM

Trainspotter mentioned it already, but make sure you head on over to,
http://windowsupdate.microsoft.com/

at some point. There were quite a few security updates last time I checked, including a mandatory (so it says!) MSN Messenger update.

Might as well post all your info here as well actually. Hopefully someone can help.

kevmech

14-02-2005, 07:12 PM

XEPHA DUDE YOU ROCK!! its identified as bropia.j which ive heard is very bad :s do you know any sites that will remove it? ive tried synatec or soemthin like that and it completely misses it...

Xepha

14-02-2005, 07:18 PM

Well, if your certain that's what it is then Symantec has the following info:

http://securityresponse.symantec.com/avcenter/venc/data/w32.bropia.j.html (Does this sound familiar to you?)

And a removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/w32.bropia.removal.tool.html

Be sure to read everything carefully.

Glad to be of help. :)

Good luck!

kevmech

14-02-2005, 07:30 PM

dude like i said synamac or watever doesnt find it,ive run the download tool about 4 times already and it says i havent got it,i found out i did have it from pc pitstop when i ran the full scan and it was in the 9 files i recieved so i kno i have deffo got it is there any other removal tool apart from synamac??

Xepha

14-02-2005, 09:01 PM

Hmm, strange that symantec doesn't pick it up... Maybe you have a new strain that isn't covered by the removal tool (yet, hopefully).

Have you tried downloading AVG? How about the trendmicro link I gave above? http://housecall.trendmicro.com/housecall/start_corp.asp

There is this:

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FBROPIA%2EJ

but it doesn't seem so straight forward as simple removal tool. You might have to do some digging.

You could also try avast (another free anti-virus program):
http://www.avast.com/eng/down_home.html

I would strongly suggest installing one of these anti-virus programs, as well as installing some kind of firewall, and using spybot now and then.

kevmech

14-02-2005, 09:24 PM

dude trust me ive tried , either the link doesnt work cos the bug messes it up and displays a window with my desktop :s dont ask cos i dont kno , its not a new strain aparently ,or ive already tried it...i am rlly baffled with wat to do and a manual solution is very complicated i dont rlly understand it

Xepha

14-02-2005, 10:51 PM

Are you telling me AVG or Avast dont pick up anything?

Did pcpitstop not suggest any course of action?

Well, I can only suggest trawling google and seeing what you come up with, posting in a more security related forum, or perhaps someone else here will come up with a suggestion.

I'm not sure what else to suggest.

Another online scanner:
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

By the way, I'm only suggesting online-scanners at the moment because its probably better to try and get the thing off your system before you go installing an always-on scanner. I wouldn't rely on an online-scanner for virus protection - because by then it could already be too late, as in your case. Get your computer cleaned up then get it secured.

Keep us updated mate.

kevmech

15-02-2005, 03:37 PM

yo dude good games yesterday :P well my comp still has the program shortcuts that i cant delete,but it hasnt tried to send itself out in a while...
cant remeber if i tried to modify the file or if its kinda worn off but hey its kinda ok for now

Xepha

15-02-2005, 11:26 PM

Well, I don't know what else to suggest, but I know I wouldn't be happy with it still lurking on my PC. But you may have to get your hands dirty and go the Ms-Dos route as someone already suggested.

You never know, it might go dormant for a bit and then one day completely trash your computer! 8O I'd really try and get rid of it if I were you...

kevmech

16-02-2005, 01:23 PM

yea ive been thinkin the same thing...its a little weird how its done nothin...i mean ive downloaded the symantec scanner it doesnt get it...im not sure how to get rid of ms-dos shortcuts either its all very hard for me :P if someone could give me some help it could be pretty nice of you :D

kevmech

16-02-2005, 06:12 PM

XEPHA dude it seems that even tho a scanner cant pick it up cos they suck so bad (sorry symantec but its true your scanner sucks) if you could plz let me kno,if u do kno of course,how to remove ms-dos using any type of code im in need of serious help
edit : ms-dos shortcut programs **** i dont kno wat they link to if i could find it i could probly delete it tht way

Scrappy

16-02-2005, 06:46 PM

ive run the download tool about 4 times already and it says i havent got it,i found out i did have it from pc pitstop when i ran the full scan and it was in the 9 files i recieved so i kno i have deffo got it
Try booting Windows in safe mode, then running the removal tool. Its possible for a virus to 'stealth' itself to avoid detection.

kevmech

16-02-2005, 07:03 PM

and runnin it in safe mode and THEN scanning will find it??? ill try it but i dunno if itll work

Juan90

16-02-2005, 07:13 PM

Hi kevmech, I think as you have had this problem for a few days it may now be worth just wiping the system and doing a clean install rather than messing about trying to cure the problem. :)

kevmech

16-02-2005, 07:16 PM

nah dude i cant do that most of the disks are packed away and most of the stuff ive got installed on my comp were already pre installed on when i got it...also i wouldnt be able to play online with my kool buddies i cant risk tht :P

Juan90

16-02-2005, 07:30 PM

Hey kevmech, did you get my PM, it doesn't seem to work from my end! :?

kevmech

16-02-2005, 07:34 PM

dont think ive got it yet lol try emailin me kevmech@hotmail.com

Sick_aussie

16-02-2005, 07:40 PM

My msn isnt working

unhappy bunny :(

Xepha

16-02-2005, 11:32 PM

My msn isnt working

unhappy bunny :(

Few days old but:

http://computercops.biz/postt105131.html

You guys should make sure MSN Messenger is updated.
http://windowsupdate.microsoft.com/

Btw kevmech, did you make a post on http://computercops.biz/forums.html like I suggested? I'm pretty sure there are plenty of people over there that can help. Go over there and search the forums for "bropia". Try not to break anything if they mention... symantec ! :o

kevmech

16-02-2005, 11:56 PM

lmao no i wont break anything...maybe my monitor screen tho..thnx dude ill try it

kevmech

26-02-2005, 01:55 PM

I'VE DONE IT!!! THE FRICKING VIRUS IS COMPLETELY REMOVED OFF OF MY COMPUTOR!!:D and you were right...xepha i think...i did have a completely new strand that was only updated onto my antivirus yesterday.
thanks to everyone for their ideas but i did it myself! your all useless :D nah only jokin thnx everyone :) hahaha