Subscribe: Subscribe to BigBlueBallRSSSubscribe to BigBlueBall by emailEmailSubscribe to BigBlueBallTwitter


Go Back   BigBlueBall Forums > Instant Messaging > Windows Live Messenger Support
Reload this Page Please BE CAREFUL about opening attachments in WLM
Forgot Password? Register
Connect with Facebook
Register FAQ Members List Social Groups Search Today's Posts Mark Forums Read

Closed Topic
 
LinkBack Topic Tools
  #1 (permalink)  
Old 10-25-2007, 07:21 AM
Philip's Avatar
WLM Guy
  

Join Date: Jun 2006
Location: Penang, Malaysia
Posts: 1,702
Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)
Send a message via MSN to Philip Send a message via Yahoo to Philip
Please BE CAREFUL about opening attachments in WLM
As reported in this thread the photo album.zip worm is still making its rounds through Windows Live Messenger. If you receive a file attachment in your WLM purportedly from a contact, and especially if it contains images, DO NOT open it immediately. Instead, call or email the contact first. This is how photo album.zip "worms" its way through the internet. If you have any doubts, then don't open the file! And pass this info to anyone else who uses your computer.

This worm is also very smart. When I received the images.zip file from a contact, I didn't accept the transfer. After a while, another message popped up in my chat window: "OMG just accept please its only some pics!!" I refused and closed the window. You have been warned.

Additional info here at Sophos, but I'll repeat it here:

Quote:
W32/IRCBot-VR is an IM worm for the Windows platform.

W32/IRCBot-VR attempts to spread via MSN, and may send the following itself as "photo album.zip" to open chat windows with one or more of the following messages:

"Lmfao hey im sending my new photo album, Some bare funny pictures!"
"lol my sister wants me to send you this photo album"
"Hey i been doing photo album! Should see em loL! accept please mate "
"HEY lol i've done a new photo album ! Second ill find file and send you it."
"Hey wanna see my new photo album?"
"looooooooooooooooooooooooooooooooooooooo!! "
"OMG just accept please its only my photo album!!"
"Hey accept my photo album, Nice new pics of me and my friend's and stuff and when i was young lol..."
"Hey just finished new photo album! might be a few nudes lol..."
"hey you got a photo album? anyways heres my new photo album accept k?"
"hey man accept my new photo album.. made it for yah, been doing picture story of my life lol.."

W32/IRCBot-VR has functionality to:
- connect to IRC
- setup a backdoor for remote access
- download remote code
- steal passwords
Last edited by Philip; 10-25-2007 at 08:35 AM. Reason: Additional info from Sophos
 

 
  #2 (permalink)  
Old 10-25-2007, 08:10 AM
patndoris's Avatar
Staff Member
  

Join Date: Nov 2006
Location: Maryland
Posts: 1,886
patndoris has left a lasting impression (500)patndoris has left a lasting impression (500)patndoris has left a lasting impression (500)patndoris has left a lasting impression (500)patndoris has left a lasting impression (500)patndoris has left a lasting impression (500)patndoris has left a lasting impression (500)patndoris has left a lasting impression (500)
Send a message via Yahoo to patndoris
If you have an add-on program, with the option to "auto-accept requests", I'd go check and make sure you[re settings don't leave you vulnerable!

I don't use the feature, but Plus! has it. However, they do give the options to "auto-accept every request", "auto-accept file transfers only" or "auto-accept everything but files." It's probably better with this kind of worm, not to auto-accept anything, but certainly you don't want to have accepting files automatically enabled.

Just thought it might be worth a mention. I'm sure other add-ons out there offer simiar options, and it's up to the individual user to decide what features they want or don't. Be smart and protect yourself - err on the side of caution!!

-Doris-
  #3 (permalink)  
Old 10-25-2007, 08:29 AM
Philip's Avatar
WLM Guy
  

Join Date: Jun 2006
Location: Penang, Malaysia
Posts: 1,702
Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)
Send a message via MSN to Philip Send a message via Yahoo to Philip
Hey thanks for reminding me of that auto-request thing, Doris! In Messenger Plus! Live, it's in the Conversations tab > Main. Make doubly sure that Automatically accept requests by default is NOT checked.
  #4 (permalink)  
Old 10-25-2007, 06:38 PM
detn8r's Avatar
Moderator
  

Join Date: Jan 2002
Location: Uxbridge, Canada
Posts: 5,707
detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)
I'm having issues downloading that antivirus suggested. I tried twice, both times it was corrupted.

Either way, my current (but outdated) Symantec (finally) detected the virus. It told me it couldn't delete it, but gave the location of it.

Check here:

C:\Documents and Settings\(**user**)\Local Settings\Temporary Internet Files\Content.IE5\EXCNALST

You can just flush the folder, or look for any .exe's specifically. The one I found was called s4p[1].exe.

W32.Spybot.Worm - Symantec.com
  #5 (permalink)  
Old 11-13-2007, 01:29 PM
Junior Member
  

Join Date: Nov 2007
Posts: 10
rcweb is on a distinguished road (10)
thanks i read before about that.
  #6 (permalink)  
Old 11-18-2007, 09:03 PM
Philip's Avatar
WLM Guy
  

Join Date: Jun 2006
Location: Penang, Malaysia
Posts: 1,702
Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)
Send a message via MSN to Philip Send a message via Yahoo to Philip
Another MSN/WLM Trojan spreading
As reported here in eweek, there is yet another trojan spreading via MSN/WLM purportedly sending users pictures from their other contacts. As has been said before, be VERY CAREFUL about opening pictures and other attachments in your WLM. If you have the slightest doubt, DON'T.

Make it a point to always update your antivirus and antispyware scanners, and do periodic scans of your systems. Let's be safe out there.
  #7 (permalink)  
Old 11-24-2007, 03:09 PM
detn8r's Avatar
Moderator
  

Join Date: Jan 2002
Location: Uxbridge, Canada
Posts: 5,707
detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)detn8r has much to be proud of (1000)
It was suggested to me to try an antivirus called NOD32. I didn't have any issues downloading, or installing it. Plus it actually found 8 variants of that virus/worm on my computer.

Just one piece of advice -- if you have any other antivirus installed REMOVE it before installing this one! You have no idea the hell I went through with that little mistake!
  #8 (permalink)  
Old 11-24-2007, 03:30 PM
VvWolverinevV's Avatar
I really just became a moderator so I could change this title, bwahaha...
  

Join Date: Mar 2006
Location: Rockville, MD, USA
Posts: 400
VvWolverinevV is a name known to all (400)VvWolverinevV is a name known to all (400)VvWolverinevV is a name known to all (400)VvWolverinevV is a name known to all (400)VvWolverinevV is a name known to all (400)
Send a message via AIM to VvWolverinevV
Does this virus infect your computer without you even opening the archive? This is painfully reminiscent of Microsoft's other failure: Internet Explorer 6
New members: Please read the Posting Guidelines before posting
  #9 (permalink)  
Old 11-24-2007, 08:40 PM
Philip's Avatar
WLM Guy
  

Join Date: Jun 2006
Location: Penang, Malaysia
Posts: 1,702
Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)Philip has much to be proud of (1000)
Send a message via MSN to Philip Send a message via Yahoo to Philip
Graham, nice to know you've rid yourself of that virus. And NOD32 is supposed to be a very good AV too (pity it's not free, but maybe it's worth the money).
Closed Topic

« Previous Topic | Next Topic »

Currently Active Users Viewing This Topic: 1 (0 members and 1 guests)
 
Topic Tools


Similar Topics
Topic Topic Starter Forum Replies Last Post
A compiled list of the awefulness of WLM DragonQ Windows Live Messenger Support 4 10-16-2007 07:49 AM
Having WLM problems? Read this first... Philip Windows Live Messenger Support 3 01-21-2007 09:22 PM
Inbox not opening from WLM? saad_786 Windows Live Messenger Support 3 09-20-2006 03:35 PM
Opening hotmail from WLM keithscarfe Windows Live Messenger Support 0 08-17-2006 11:39 AM

 

All times are GMT -5. The time now is 09:31 PM.