trojan!!!!

[andy214ever]

anyone help me please my pc is infected, when i playing instant messaging a web site call (instant messaging name )that can dowload trojan is automatically send   to the other .....what can i do ?the add is http://www.messaging-names.com,the trojan that my pc infected is from here.....i scan with my kaspersky antivirus...and found nothing...... :'(

[FreewheelinFrank]

Hi andy214ever,

this is actually the avast! forum, you know. You should really be trying the Kaspersky forum, you know, but since you're here:

Have you tried the usual free adware/spyware scanners?

AVG Anti-Spyware (Requires Win2k/XP)
a-Squared Free
Ad-Aware
Spybot Search & Destroy

Download, install and update all the programs. Disconnect from the internet (pull the plug) before running scans in

Safe Mode if possible.

[FreewheelinFrank]

Check for IMNames in Start>Control Panel>Add/Remove Programs and uninstall it if you have installed it because it is malware:

Complete scanning result of "IMNames_setup.exe", received in VirusTotal at 05.22.2007, 10:02:31 (CET).

Antivirus   Version   Update   Result
AhnLab-V3   2007.5.21.1   05.21.2007   no virus found
AntiVir   7.4.0.23   05.22.2007   ADSPY/2Searc.H.10.B
Authentium   4.93.8   05.21.2007   could be a corrupted executable file
Avast   4.7.997.0   05.21.2007   Win32:Adware-gen.
AVG   7.5.0.467   05.21.2007   Generic.YVD
BitDefender   7.2   05.22.2007   Adware.2searc.A
CAT-QuickHeal   9.00   05.21.2007   no virus found
ClamAV   devel-20070416   05.22.2007   Adware.Search-15
DrWeb   4.33   05.21.2007   no virus found
eSafe   7.0.15.0   05.21.2007   Win32.KillFW.a
eTrust-Vet   30.7.3651   05.21.2007   no virus found
Ewido   4.0   05.21.2007   no virus found
FileAdvisor   1   05.22.2007   no virus found
Fortinet   2.85.0.0   05.22.2007   Spy/Adload
F-Prot   4.3.2.48   05.21.2007   no virus found
F-Secure   6.70.13030.0   05.22.2007   Trojan.Win32.KillFW.a
Ikarus   T3.1.1.7   05.22.2007   AdWare.Win32.2Search.h
Kaspersky   4.0.2.24   05.22.2007   not-a-virus:AdWare.Win32.2Search.h
McAfee   5035   05.21.2007   potentially unwanted program Adware-2Search
Microsoft   1.2503   05.22.2007   Adware:Win32/IMNames (threat-c)
NOD32v2   2283   05.21.2007   a variant of Win32/Adware.2Search
Norman   5.80.02   05.21.2007   no virus found
Panda   9.0.0.4   05.21.2007   Trj/Multidropper.RER
Prevx1   V2   05.22.2007   no virus found
Sophos   4.17.0   05.21.2007   IMNames Installer
Sunbelt   2.2.907.0   05.17.2007   2Search
Symantec   10   05.22.2007   Adware.2Search
TheHacker   6.1.6.120   05.21.2007   no virus found
VBA32   3.12.0   05.21.2007   AdWare.Win32.2Search.h
VirusBuster   4.3.23:9   05.21.2007   Trojan.KillFW.B
Webwasher-Gateway   6.0.1   05.22.2007   Ad-Spyware.2Searc.H.10.B

Try the Bitdefender, Panda or F-Secure online scanners if the programs I posted above don't solve the problem. Links here:

http://www.geocities.com/dontsurfinthenude/antivir2.htm

[andy214ever]

 thank...i already remove it with Dr.web cure it......1 more thing i wanna ask,the web site (http://www.messaging-names.com) actually is a source of the trojan right?or some kind of unsafe web site?

[andy214ever]

i received my friends call that their pc also infected,they just dowload the program from there but din't install it,but after a while they found that ,that thing already automatically  install in their computer....r all above could be possible?

[FreewheelinFrank]

The web site has an internet messenger program plug-in for download, which is in fact a Trojan horse and installs adware. A visitor has to download and install the software before becoming infected.

There's no sign of exploits on the site itself according to Exploit Prevention Labs:

http://linkscanner.explabs.com/linkscanner/checksite.asp?NS=ChkOnly&SRC=apps.ExpLabs.com&CS=http://www.messaging-names.com/

Congratulations! LinkScanner Online did not find any exploits at:
http://www.messaging-names.com/

Maybe you friend clicked open instead of save when prompted to download in MSN?

[andy214ever]

ooh....thanks, i will inform them.....