Apparently, this virus simply propagates itself by mass-messaging everyone on your contacts list.
I'm not too sure what it does, but I can be pretty sure that it's something undesirable.
Windows XP (Home, SP2, latest updates, etc)
Windows Live Messenger 8.1
AVG Anti-Virus (I'm assuming the virus is relatively new because AVG didn't detect it).
Method of Infection:
I accessed: hxxp://photoshare.atwebpages.com/image.php...firstname.lastname@example.org**Appears to have been taken down.**
Happened to download it, and run it, while trying to rename it to JPG (had a filename of: IMG00231.JPG-www.imageupload.com) .
**I have the virus saved as a file-extension-renamed file hxxp://homenet.servegame.com/msnvirus/IMG00231.JPG-www.imageupload.txt, as a txt (but originally as a COM). - **PLEASE BE CAREFUL if you decide to take a look at it, or at least more than I was (not).**
New process (msn.com) appeared in task manager/process explorer. <== Name changes (confirmed by a friend).
New startup entry, for the same msn.com (supposedly was in the C:\Windows\ directory, but i couldn't locate it).
New message windows would open, then almost instantaneously close. (Computer slowdown experienced).
I noticed that something was wrong and unplugged my LAN cable (but the damage was already done).
Looked in process explorer and saved strings (why, I don't know... but here).
In process explorer, ended msn.com (Screenshot on my webserver).
Closed MSN Messenger.
Ran MSN-Virus-Removal-Tool.exe from here. (Said system was clean.)
Found the startup entry using Startuplist (and removed it).
I think I've disabled it for the time being, though I'm fairly sure I haven't deleted the file itself... Should I try a System Restore, etc?
Thanks in advance,
Mod Edit: Links disabled, to preclude possible infection.~ TMacK
Edit: Will be back in about 12 hours time, school and such.
Edited by Orange Blossom, 20 March 2008 - 09:46 PM.
Completed link disabling ~ OB