Computing.Net > Forums > Security and Virus > msn messenger virus

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

msn messenger virus

Reply to Message Icon

Original Message
Name: jerry
Date: August 6, 2002 at 04:06:24 Pacific
Subject: msn messenger virus
Comment:

hello. i appear to hav a virus that affects msn messenger. without me knowing it asks the other person to whom im speaking the question 'hey want to see my new pic?' and then says 'ok cool'. it then tries to send itself to the other person. i am not aware of any of this but everyonre i talk to tells me about it. any ideas on how to be rid of it?


Report Offensive Message For Removal


Response Number 1
Name: danboy
Date: August 6, 2002 at 04:57:48 Pacific
Reply:

The same happens to me aswell. also im in the middle of a conversation and the kryptonice ghost virus comes up and infects there computer with it. when i don't know its going on. anyone know why. -Trojan maybe??


Report Offensive Follow Up For Removal

Response Number 2
Name: Andi
Date: August 6, 2002 at 09:02:58 Pacific
Reply:

MSN Messenger users are again the victims of a chat application worm. Known by a few different names--Troj_Brain.A, W32.Choke.b, W32.NewPic, Worm.JerryMsg--this MSN Messenger worm will infect anyone contacting an infected PC by asking if the user wants to see a new picture. If the correspondent says Yes, the worm then sends a copy itself via MSN Messenger. If chat application other than MSN Messenger is used to contact the infected PC, the worm might install on the new PC but it will not spread to others. MSN Messenger users were victims in June of the tasteless Choke worm. This latest MSN Messenger worm is not destructive, and even contains its own removal instructions. Because of its limited infection capabilities and relative harmlessness, this MSN Messenger worm only ranks as a 2 on the ZDNet meter.

How it works
The worm arrives via MSN Messenger as a file called PIC1324.EXE. If executed, the worm then displays an Error message box on the infected computer with the following text:

"Cannot open file. May be corupted. Replace the file with a new one and try again".

The worm then installs itself to run every time the computer is booted. The worm appears in the task manager as MsgSprd. The worm monitors chats on MSN Messenger and will attempt to engage anyone who contacts the infected computer with the following exchange:


hey, want me to send my new pic? i took it yesterday
Depending on the response, the worm will send the file with the following text:


User Worm
send there
sure [no response]
maybe pweese ? :-)
i guess i hope you like it
ok alright, here ya go
yea alright, here ya go
yes alright, here ya go

The worm does no damage and its own removal instructions can be found in a file located at C:Messenger1324Brain1Read Me.txt. The text file reads:

I come in piece. My name is Jerry. The purpose of me is to spread. I'm not annoying, nor dangerous.

How to remove me:
1) Click Start, select Run. The Run dialog box pops up.

2) Type: msconfig The System Configuration Utility pops up.

3) Click the Startup tab at the top. In the list, find MsgSprd, Messenger, or pic1324, uncheck, press Apply, then press Ok.

4) Restart your computer Or press Ctrl - Alt - Del, select MsgSprd from the list, then press End Task.

You may freely delete the files or the 'C:Messenger1324' directory.


Report Offensive Follow Up For Removal

Response Number 3
Name: danboy
Date: August 6, 2002 at 09:35:55 Pacific
Reply:

andi wot about my kryptonic ghost episode


Report Offensive Follow Up For Removal

Response Number 4
Name: Psyda
Date: August 6, 2002 at 15:44:35 Pacific
Reply:

For the kryptonic ghost message, go back to the Virus and Security message board and scroll down a bit. Depending on when you get this message, it may even be on page 2.


Report Offensive Follow Up For Removal

Response Number 5
Name: ricky
Date: September 6, 2002 at 01:16:29 Pacific
Reply:

hey im infected:( with kryptonic ghost ive found out that the file has been sent to my system files under the name 'Mtr2' and i cant delete it:( coz it seez "cannot delete this file is being used by windows" can u plz tell me how to get rid of it
Thanx,
Devastat|0nX


Report Offensive Follow Up For Removal







Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home



Results for: msn messenger virus

MSN Messenger Virus - IS THIS YOU
    Summary: Hi, Please can anyone help? My laptop has been infected with a virus today (4 August 2005). I received a message from someone in my contacts list saying "hey, is this you?" and a URL. http://www.vbule...
www.computing.net/answers/security/msn-messenger-virus-is-this-you/16305.html

MSN messenger virus
    Summary: after i login to msn messenger, if someone sends me a instant message or i try to do so, the chat window goes blue and MSN is closed with a fatal error.. could someone please help me out with this pr...
www.computing.net/answers/security/msn-messenger-virus/2615.html

MSN Messenger Virus / Bot ?
    Summary: MSN Messenger is now sending out an instant message to all my contacts, about every 15mins. It sends a message and all thats in it is a "." Period Have used all the free spyware/malware and antivrus ...
www.computing.net/answers/security/msn-messenger-virus-bot-/23696.html








Which MP3 player do you have?

iPod/iPhone
Zune
Something Else
None


View Results

Poll Finishes Today.
Discuss in The Lounge
Poll History






Data Recovery Software