new Virus/worm in MSN ?

[zeromechanic]

On april 2, i got a link from a friend

But when i clicked it.............
(hehe he didnot send it to me  )
MSN started to live its own live.
Opening chatscreens, sending this link to all my friends etc.
and when they click it, receiving the links back
No mouse and tons of adware installed (driveclean eg.)

AVAST dit not detect this in the IM protection (high level).

Cannot find anything about this, not avast, norton, mcafee, etc...
Even spybot, ad-aware didn't find anything.

This is the link (DO NOT CLICK)

yo wtf youre nude in this photo htt p://ww w.s tupidpictures.info/p hoto13.ph p
(added some spaces in the link, incase of accidental clicking).

Could someone tell me wich worm/virus this is?

re-installed msn and (before/after)
ran several full scans, normal mode and safe mode, with avast, spybot and adaware and every thing looks clear, only msn still has his own live (once and a while) but no link.

[Lisandro]

I hope Alwil team improve detection of this one...

[Frankie 7]

sorry i opened up one about this same thing. How can i get rid of this now ? It is relly annoying me now bigstyle There must be a way to get rid of this. .

[Lisandro]

sorry i opened up one about this same thing. How can i get rid of this now ? It is relly annoying me now bigstyle There must be a way to get rid of this. .

If avast is not detecting it, I suggest full computer on-line scanning:
Kaspersky
Trendmicro housecall
Ewido
F-Secure
Panda ActiveScan
BitDefender (free removal of the malware)

[Frankie 7]

why avast has'nt spotted this, i dont know. very bad.

[Lisandro]

why avast has'nt spotted this, i dont know. very bad.

Not a software is perfect... next time, the others will miss what avast will detect...

[zeromechanic]

If avast is not detecting it, I suggest full computer on-line scanning:

Online scanning with mcafee and norton no results, everything is clean 
even there they dont't speak about this virus/worm or whatever it is

re-installed msn and everything looks quiet
Only  once and a while avast gives a warning about Win32:VBStat-C[trj]
and some annoying popups form drivecleaner.com and some antivirus program that says that the pc is not protected against the SerWab (?)

Also ran scans with spybot and adaware, no results. (also in safe mode windows)
(On my own pc ran a scan with pc doctor from google pack, and discovered 60 infections wich where NOT detected with spybot and adaware)

[DavidR]

A new tool RogueRemover, available here http://www.malwarebytes.org/rogueremover.php, this should hopefully deal with the rogue av program.

What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?  Check the avast! Log Viewer (right click the avast icon), Warning section, this contains information on all avast detections.

If you haven't already got this software (freeware), download, install, update and run it, preferably in safe mode.
1. Ewido, a.k.a. avg anti-spyware If using winXP. or a-Squared free if using win98/ME.

[Lisandro]

zeromechanic, please test the tools posted by David and run avast at boot time (again, if necessary). avast shouldn't be given you intermittent warnings about infections if you're really clean...

[DavidR]

avast shouldn't be given you intermittent warnings about infections if you're really clean...

I don't think these messages come from avast but a rogue program.

and some antivirus program that says that the pc is not protected against the SerWab (?)

This is the scum ware rogue program trying to get you to purchase an AV product to cure a non-existent problem.

[Figment]

OK guys well there is another one to worry about and this virus also comes from MSN and looks you out of everything.  The only program that will stay open is msn, everything else will open and close immediately, this includes task manager.

It is sent under the same pretense "hey look at this...weblink" and the file extension is bush.exe,.  I got it from a family member and so immediately clicked it,  I know not smart.  Avast also did not catch it in MSN and later scanned it in safe mode and still did not pick it up.  The scariest part is that it was reported in USA Today on 08/16/2001.

Now don't get me wrong cause I love my avast and I thank the team that put it together and made it free to home users.  I truly love this program.  What scares me is did I fully remove it?

So far it seems to be gone because I am able to write to you on the pc that would open nothing.  I am hoping that perhaps a member can suggest a tool to advise that will scan for this particular virus?

For those who want to know how I got it off my pc manually, I did a ran msconfig, under boot.ini, booted in safe mode, then ran a search all files, searched the files to remove it.

Any help you can give is appreciated.

My heartfelt thanks goes out to the creators and team involved with such a freat program such as avast.

[DavidR]

There will always be something like this coming along, it is social engineering, appealing to people sense of curiosity and you have to apply a degree of pro-active action, don't click on links in unsolicited, unknown messages or emails and don't open attachments.

avast won't catch anything like a link in msn there is nothing to detect, it doesn't scoot off and scan all links in emails or messages it only scans the existing content. The malware wasn't in the message but at the other end of the link, avast is primarily an anti-virus and a single application is unlikely to catch everything.

Something that was reported in 2001, what was reported in 2001, that type of tricking a user to click on a link or the specific malware bush.exe ?
Any of which could have different variants that are different to the original, unfortunately there really is insufficient information to say what it might have been and if it is completely gone.

If you haven't already got the software I mentioned in a previous post try installing that to improve overall detection.

A google search for bush.exe returns many hits, http://www.google.com/search?q=bush.exe, but there could well be many different bush.exe files totally unrelated, like faces-of-bush.exe so if your file was slightly different to just bush.exe then this search is not worth much.

[zeromechanic]

Looks like i got rid of it.

After searching the net, google remove drivecleaner, I found that it might be a Vundu infection.
According tho the site it's the most common one....
used several scans, like norton, mcafee etc etc and none of them detected anything.
strange, it was "released" in 2006

The removal instructions where updated at 9 jan 2007.........

used the vundu remover, and nomore $#@##@$ popups at the time.
(it found app. 25 infected .dll files in the system32 folder)
and started to use firefox, seems also to be faster than IE

this are the links, hopefully it works for others also.

http://www.bleepingcomputer.com/forums/topic71782.html

http://www.bleepingcomputer.com/forums/topic18610.html

maybe an idea to add this infection to the Avast scanner, and then be the only one to detect this infection 

[essexboy]

maybe an idea to add this infection to the Avast scanner, and then be the only one to detect this infection 

Unfortunately this comes under the heading of Malware and not Virus although the edges are starting to blur.  This is where a multi layer protection comes in with an anti-virus and anti-spyware protection.  Malware is continually changing the file names/sizes and action so it would need full time staff just to track these, let alone viruses

[zeromechanic]

ok clear,
I thought that it would make Avast even better then is is right now. 

But should avast not detect trojans?
according to the links, the vundu is a familiy of trojans.
Avast detects and stops the VBStat-C trojan......

but it is strange that no scanner detects this.
not spybot, not adaware, not......

and then i start to wonder, what is more annoying
the threat of a virus( most people are already protected by an antivirus)
or beeing bombarded with these popups.

anyhow, thanx for the replies.
problem seems to be solved.
now waiting for the next one