MSN Photo Virus

Question

I have got a virus through opening a photo on MSM....How do I get rid of it?

1972vet · Answer

Please perform this online scan: F-Secure Online Scanner Next Generation Beta 1. Click on the link ' F-Secure Online Scanner Next Generation Beta'. 2. You may receive an alert on the address bar at this point to install the ActiveX control. 3. Click on that alert and then Click Insall ActiveX component. 4. Read the license agreement and click ' Accept'. 5.Click ' Custom Scan' and be sure the following are checked: Scan whole System Scan all files Scan whole system for rootkits Scan whole system for spyware Scan inside archives Use advanced heuristics 6. When the scan completes, click the ' I want to decide item by item' button. 7. For each item found, Select ' Disinfect' and click ' Next'. 8. When done, click the ' Show Report' button, then copy and paste the entire report into your next reply.

kagnef · Answer

Result: 47 malware found Adware.Look2Me (spyware) * System (Disinfected) CoolWebSearch (spyware) * System (Disinfected) Exploit.Java.ByteVerify (virus) * C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\29557EE0.0 (Submitted) * C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\295828DC.0 (Submitted) IEHijacker.ZestyFind (spyware) * System (Disinfected) IM-Worm.Win32.VB.ao (virus) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP922\A0080385.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP913\A0077802.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP913\A0077803.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP913\A0078781.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP913\A0078784.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP912\A0077780.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP912\A0077788.0xe (Submitted) * C:\Program Files\Mozilla Firefox\a.0xe (Submitted) Possible Browser Hijack attempt (spyware) * System (Disinfected) Tracking Cookie (spyware) * System (Disinfected) * System Trojan-Downloader.Java.Agent.b (virus) * C:\Documents and Settings\Ken & Aurélie\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-b6836e1-65ccbaae.zip\Beyond.class Trojan-Downloader.Java.OpenStream.w (virus) * C:\Documents and Settings\Ken & Aurélie\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-4514e5ea-255a07a8.zip\javainstaller\InstallerApplet.class Trojan-Downloader.MSIL.Agent.c (virus) * C:\WINDOWS\SYSTEM32\crunner\cloader_installer.0xe (Submitted) * C:\WINDOWS\SYSTEM32\crunner\crunner.0xe (Submitted) * C:\WINDOWS\SYSTEM32\crunner\cupdater.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP922\A0080382.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP922\A0080383.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP922\A0080384.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP922\A0080386.0xe (Submitted) * C:\Program Files\Common Files\cloader\32vegas\logos\cloader_idrpr.0xe (Submitted) * C:\Documents and Settings\Ken & Aurélie\Local Settings\Temporary Internet Files\Content.IE5\OB00AJJZ\126[1].0et (Submitted) * C:\Documents and Settings\Ken & Aurélie\Local Settings\Temp\b126.0xe (Submitted) Trojan-Downloader.Win32.Adload. (virus) * C:\Documents and Settings\Ken & Aurélie\Local Settings\Temporary Internet Files\Content.IE5\CXUZODQB\drsmartload45a[2].0xe (Submitted) Trojan-Downloader.Win32.Adload.gd (virus) * C:\Documents and Settings\Ken & Aurélie\Local Settings\Temporary Internet Files\Content.IE5\WRC0I2EV\313133352D2D2D[1].0xe (Submitted) Trojan-Downloader.Win32.Adload.gg (virus) * C:\kybrdff_e24.0xe (Submitted) * C:
wnmff_e23.0xe (Submitted) * C:
wnmff_e24.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP922\A0080377.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP922\A0080379.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP922\A0080380.0xe (Submitted) * C:\Documents and Settings\Ken & Aurélie\Local Settings\Temporary Internet Files\Content.IE5\XN75Z97O\kybrdff_e[1].0xe (Submitted) Trojan-Downloader.Win32.Adload.gn (virus) * C:\kybrdff_e26.0xe (Submitted) Trojan-Downloader.Win32.Adload.go (virus) * C:
wnmff_e26.0xe (Submitted) * C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP922\A0080381.0xe (Submitted) * C:\Documents and Settings\Ken & Aurélie\Local Settings\Temporary Internet Files\Content.IE5\OB00AJJZ
wnmff_e[1].0xe (Submitted) Trojan-Downloader.Win32.Keenval.f (virus) * C:\Documents and Settings\Ken & Aurélie\Local Settings\Tempemove.0xe (Submitted) Trojan-Downloader.Win32.Small.go (virus) * C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\15397249.0 (Submitted) * C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\759C1EA8.0 (Submitted) UCmore (spyware) * System (Disinfected) W32/DLoader.AKCN (virus) * C:\WINDOWS\Downloaded Program Files\speedtest2.dll (Submitted) * C:\Documents and Settings\Ken & Aurélie\Local Settings\Temporary Internet Files\Content.IE5\0PUJG9EJ\speedtest2[1].dll (Submitted) Statistics Scanned: * Files: 178757 * System: 17249 * Not scanned: 57 Actions: * Disinfected: 6 * Renamed: 0 * Deleted: 0 * None: 41 * Submitted: 38 Files not scanned: * x } x } RITY C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM * C:\WINDOWS\SYSTEM32\CATROOT2\EDB.LOG * C:\WINDOWS\SYSTEM32\CATROOT2\TMP.EDB * C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{34AF0C41-1400-49E8-AEF7-818F75D1E3DE}.BIN * C:\WINDOWS\PCHEALTH\HELPCTR\PACKAGESTORE\PACKAGE_38.CAB * C:\WINDOWS\PCHEALTH\HELPCTR\PACKAGESTORE\PACKAGE_39.CAB * C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP923\A0080411.EXE * C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP923\A0080422.EXE * C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\arrow1.bmp * C:\MY DOWNLOADS\DOWNLOAD11395108953110125.DAT * C:\I386\BIOS1.ROM * C:\FINLAY\SWITCHFOOT SONGS\SWITCHFOOT_THEBLUES_SESSIONS_DL.MP3 * C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\NTUSER.DAT * C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT * C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\NTUSER.DAT * C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\NTUSER.DAT * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F49\T2340.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F38\T2227.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F31\T2271.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F31\T2322.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F30\T2321.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F20\T2311.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F17\T2257.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F08\T2350.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\EMILY'S PICS\IPOD PICS\IPOD PHOTO CACHE\F31\T129.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\10 JAMES BLUNT - NO BRAVERY.MP3 * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF18C0.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF426C.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF66F4.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF771C.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF803D.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF950D.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFA77C.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFA91E.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFBAF2.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFC631.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFC6A7.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFD5E4.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFE289.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFE6E.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT * C:\DOCUMENTS AND SETTINGON\_î ® ; * C:\HIBERFIL.SYS * C:\NWNMFF_E27.EXE * C:\PAGEFILE.SYS * C:\WINDOWS\TEMP\~DF853A.TMP * C:\WINDOWS\TEMP\~DF8C06.TMP * C:\WINDOWS\SYSTEM32\BIOS1.ROM * C:\WINDOWS\SYSTEM32\ENR0L19M1.DLL * C:\WINDOWS\SYSTEM32\IRPUT.DLL * C:\WINDOWS\SYSTEM32\L68MLGL116Q.DLL * C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT * C:\WINDOWS\SYSTEM32\CONFIG\SAM * C:\WINDOWS\SYSTEM32\CONFIG\SECURITY * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM * C:\WINDOWS\SYSTEM32\CATROOT2\EDB.LOG * C:\WINDOWS\SYSTEM32\CATROOT2\TMP.EDB * C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{34AF0C41-1400-49E8-AEF7-818F75D1E3DE}.BIN * C:\WINDOWS\PCHEALTH\HELPCTR\PACKAGESTORE\PACKAGE_38.CAB * C:\WINDOWS\PCHEALTH\HELPCTR\PACKAGESTORE\PACKAGE_39.CAB * C:\SYSTEM VOLUME INFOR– O \ x } ø B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP923\A0080411.EXE * C:\SYSTEM VOLUME INFORMATION\_RESTORE{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP923\A0080422.EXE * C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\arrow1.bmp * C:\MY DOWNLOADS\DOWNLOAD11395108953110125.DAT * C:\I386\BIOS1.ROM * C:\FINLAY\SWITCHFOOT SONGS\SWITCHFOOT_THEBLUES_SESSIONS_DL.MP3 * C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\NTUSER.DAT * C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT * C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\NTUSER.DAT * C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\NTUSER.DAT * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F49\T2340.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F38\T2227.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F31\T2271.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F31\T2322.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F30\T2321.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F20\T2311.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F17\T2257.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\IPOD PHOTO CACHE\F08\T2350.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\MY DOCUMENTS\MY PICTURES\EMILY'S PICS\IPOD PICS\IPOD PHOTO CACHE\F31\T129.ITHMB * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\10 JAMES BLUNT - NO BRAVERY.MP3 * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF18C0.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF426C.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF66F4.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF771C.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF803D.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DF950D.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFA77C.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFA91E.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFBAF2.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFC631.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFC6A7.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFD5E4.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFE289.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\TEMP\~DFE6E.TMP * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT * C:\DOCUMENTS AND SETTINGS\KEN & AURéLIE\APPLICATION DATA\THUNDERBIRD\PROFILES\B31V64UB.DEFAULT\MAIL\POP1.NS.SYMPATICO.CA\INBOX * C:\DOCUMENTS AND SETT Options Scanning engines: * F-Secure AVP: 6.0.171, 2006-10-13 * F-Secure Libra: 2.4.1, 2006-10-13 * F-Secure Orion: 1.2.37, 2006-10-13 * F-Secure Blacklight: 1.0.31, 0000-00-00 * F-Secure Draco: 1.0.35, 2006-10-06 * F-Secure Pegasus: 1.19.0, 2006-08-29 Scanning options: * Scan all files * Scan inside archives * Use Advanced heuristics Copyright © 1998-2006 Product support |Send virus sample to F-Secure F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure

1972vet · Answer

Looks like F-Secure found a few problems. How's the computer running now?

ditto8 · Answer

Hi! I have the same problem, contracted a virus when I opened a file on msn messenger saying 'LOL I found a picture of you online' It disabled my Mcafee, net browers and I couldn't log online. I've uninstalled msn and I've restored my computer to a date before I opened the file so my anti-virus seems to be working again and i can sign online but net access is very slow and sometimes the page cant be found on my browers. I'm worried that the virus is still in my computer, I tried F-secure to scan but it says 'unable to download scanner components please try again'. Please help!

1972vet · Answer

Post your hijackthis log here

char5321 · Answer

Does this program  work on Vista and will work if I have McAfee security on my system. Will it have any conflicts with msn spysweeper , McAfee or windows defender. I downloaded msn photo and additional features it worked for a day and half . The next day when I turn on my computer it came up with error sayiny repair or start in window normally. I let it repair and it removed msn photos and the additional features. What should I do. Iwanted msn photos so they would showw my picture why I was play music on my media player 11.

Bugbatter · Answer

For the time being, the F-Secure Online Virus Scanner does not support Windows Vista.

dyv911 · Answer

Result: 1 malware found

IM-Worm.Win32.VB.dg (virus)

C:\WINDOWS\CONFIG\QIVTPUYPBV\WINLOGON.EXE (Renamed & Submitted)

Statistics

Scanned:

Files: 27323
System: 0
Not scanned: 4

Actions:

Disinfected: 0
Renamed: 1
Deleted: 0
None: 0
Submitted: 1

Files not scanned:

C:\PAGEFILE.SYS
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{F5329734-F3A5-4438-969E-DBA80445DE1D}.BIN
C:\DOCUMENTS AND SETTINGS\ENGLISH\LOCAL SETTINGS\TEMP\HSPERFDATA_ENGLISH\3236

This is my results and i dont know it its removed or not...should i rescan and disinfect it?

Virus & Spyware

MSN Photo Virus

Was this post helpful?