Tech: MSN trouble

Subject: BS: MSN trouble
From: *Laura*
Date: 12 Feb 05 - 05:59 PM

I'm sorry - i know I just put all of this in the hotmail thread but I then thought it's quite a different problem so I'm putting it in a new thread.

HELP ME!
I'm having a problem with MSN - and I can't sort it out :(
I got sent a virus thingy over messenger, which i opened before I realised it was a virus. I then deleated the files, once I realised what it was, and ran my full-system virus scanner which turned out nothing and said no viruses had been found.
So I thought it was Ok - but now every time I go on MSN I'm fine for a few minutes, then all my conversation windows flash up and close really quickly and those virus files get sent - and then I can't open up any windows to talk to anyone.
I had 2 versions of MSN on my computer so I uninstalled one of them, but the other won't uninstall - and I can't think of what to do. My virus scanner says there is no virus but I am apparently still sending a virus of some sort to people - HELP ME!
It doesn't seem to affect the computer in any other way - just messenger, the internet is still working and everything, and I'm fine so long as I don't sign in, or try to talk to anyone, so I thought if I unistalled messenger it would be ok - then I could put it in again later, but I can't uninstall it becasue for some reason when I go to 'add/remove programmes' it isn't in the list of programmes!
ANd it won't exit on my toolbar - whenever I try to exit it it says I need to close other things (e.g. outlook and explorer) first - but they arent open!
*waaaaaiiiiiiiiiiilllllllll* god I hate computers!
Why is nothing ever simple!?!?!?!?!??!?!
Please please please help me! I don't even know whose problem this is so I don't know who to call to help!

:-(

Subject: RE: BS: MSN trouble
From: artbrooks
Date: 12 Feb 05 - 06:31 PM

Laura, have you updated your virus checker in the last week? If not, your virus program may not have the tools needed to kill that bugger. Also, get and run Ad-aware from Lavasoft...its free.

Subject: RE: BS: MSN trouble
From: Bassic
Date: 12 Feb 05 - 06:42 PM

It could be the the one that is discussed here . There is a solution posted. Hope it works for you.

Subject: RE: BS: MSN trouble
From: Stilly River Sage
Date: 12 Feb 05 - 06:47 PM

If you can't get a virus to exit your system on your own a visit to http://www.symantec.com/index.htm and letting them scan your computer might help identify the bugger and possibly remove it. To keep that stuff out, Ad Aware, Spybot Search&Destroy, and Spyware Blaster are the three I use regularly along with Norton Antivirus.

SRS

Subject: RE: BS: MSN trouble
From: Bassic
Date: 12 Feb 05 - 07:00 PM

I agree SRS. Also, if Norton is beyond anyones financial means then AVG is a good replacement and is free, as are Ad Aware, Spybot and Spyware Blaster. It costs nothing to be well protected. All the above are regularly recomended by `Catters who know far more than I do and their advice has kept me clear of major problems for over 2 years.

Subject: RE: BS: MSN trouble
From: JohnInKansas
Date: 13 Feb 05 - 09:06 PM

*Laura*

If you have a "real" MSN account, telephone support from MSN has been very helpful for us. Look for a phone number under "Support" and/or "Contact us." Just hope you get an English speaking agent. If you are working via a Hotmail account, the ONLY support offered is via email. (So if your email doesn't work, send us an email?)

Your descriptions sound like you may be dealing with Spyware rather than a virus. These are two distinctly different things, and your AntiVirus (AV) program may not be much help. Since you did say you saw what might be a virus, a little(?) on that first:

A virus received via Messenger presents a sort of special problem. In the normal setup, Messenger starts when you boot up, so it always has its own files in RAM. Most Anti-Virus programs are unable to delete or modify a file that is open (in RAM), and some don't even scan open files since they can't delete them.

Note that there is a "Windows Messenger" and a separate program "MSN Messenger" and it is possible to have both running at the same time. It's not always clear which one you're using if you don't look carefully. KB 330117: Running Both gives some details.

IF you're using WinXP, you can turn off Windows Messenger: KB 302089 so that it won't have files open, and your AV may be able to find an infection on your drive and clean or delete the main infected files.

I don't have anything on turning off MSN Messenger, if that's what you use; and the method(s) for turning off Windows Messenger may differ if you're using something other than WinXP.

The process for preventing Windows Messenger from starting is a little bit picky and requires editing your Registry, so you probably would be better off just booting to Safe Mode and running your AV - full scan - from there. Safe Mode starts Windows without starting most other processes, but a few do get loaded. Your AV should run normally in Safe Mode. For WinXP, hit F8 while the machine is starting, and follow instructions to open in Safe Mode.

If an AV scan in Safe Mode doesn't find anything and you still think there might be something there, the next step would be to Boot to DOS and run your AV in DOS, if your program can be run there. You may need to visit your AV maker's website for instructions.

You should always update your AV to be sure you have the latest virus signatures immediately before scanning if you suspect an infection.

If you're using one of the Windows versions that offers System Restore (WinXP and I believe WinME) you must turn it off before cleaning up most viruses that your AV doesn't remove automatically. When you turn it off, it deletes all old copies of your System Files from the System Restore hidden folder. If System Files are left there that contain your virus, it could be put back after you remove it, the next time you start up. In Windows Explorer (NOT Internet Explorer or MSN Explorer) right click on My Computer, Click Properties, select the System Restore tab, and put a check mark in the box where it says "Turn off System Restore on all drives." When you close the Properties box, old and possibly infected System copies should be deleted.

It's recommended that you remember where this setting was so you can turn it back on after you get your system clean. New "Restore Files" will be created the next time you shut down after you turn System Restore back on by removing the check mark.

If your AV finds a virus, you should write down the name of the virus found, and anything else it gives you in the way of identifying information. It is highly recommended that you go to the web site for your AV and look for instructions on complete removal before proceding beyond the steps your AV can do automatically. Since different AV products may use different names for the same virus, the site for the program that finds it is the best place to look. If you don't find instructions at your own AV site, you should look at one or two of the other makers' sites before proceding.

After you verify that any virus infection has been removed, if your program still doesn't work it's possible that one or more files were corrupted by the virus. You may need to uninstall and then reinstall any affected programs. You should always use your Control Panel Add-Remove Programs first, if the program appears there. For web and/or email programs reinstalling will likely mean resetting all your connection and login info. In WinXP, Start – Settings – Network Connections should show most of what will need to be reset if you want to make notes before removing/reinstalling.

In the U.S., MSN telephone support has been quite good about doing walk-through fixes on setup; but I haven't had to contact them recently. A current phone number for telephone support should be on the MSN website, possibly unde "Contact Us" in the "Support" area. In the past there have been "800" numbers available, but it may be a toll call now and the best number may depend on your location.

More to follow on Spyware

John

Subject: RE: BS: MSN trouble
From: JohnInKansas
Date: 13 Feb 05 - 09:14 PM

If your AV does not find a virus when you run it in Safe Mode and/or in DOS Mode, it's likely that you have a Spyware or Adware "infection." Most "plain vanilla" AV programs do not detect these, so you'll need to use programs specific to these kinds of crud. Ad-Aware and Spybot are still highly rated, and there are free download version for both. As far as your AV knows, when you clicked on the message you gave permission for a program installation – even if you didn't know you were doing so. Your AV permits it to install, because you told it to. It can't detect it as a virus because it's a "perfectly valid program" that you were tricked into installing.

This month only, Webroot's Spy Sweeper 3.5 is the "top rated" program for protecting yourself from Spyware infection, but it's not free. It's pretty good at removing infections, but may need some help from another program (like Spybot) for a few known ones.

Since there is no central organization for defining, detecting, and spreading the word about spyware, the new crud that comes up almost daily makes "best program" a very transient thing. Spybot was pretty well the top program only a couple of weeks ago, and remains a good (free) choice. There was an attempt to start a clearing house group for Spyware, but it pretty much disintegrated last week. Three (or more) of the "founders" cancelled their memberships when someone sold a new membership to one of the major Spyware distributors.

You can go to the Webroot Spy Sweeper web site and get a free on-line scan. It's fairly quick, and it won't hurt your machine; but it won't fix anything unless you buy the program. It has been suggested also that sometimes it finds things that aren't really there – a little advertising leverage, perhaps. If it identifies something, you can do a Google search and look for more info before you pay up, or go to your AV site. They often offer removal info on crudware that isn't viral if you know its name so you can look it up. Most other AntiSpyware makers offer similar free scans, although some of them take a very long time to run and find nothing significant.

Note that there is no universal agreement on what is Spyware and what's just "market research" so many AntiSpyware programs report a lot of "stuff" but still miss the most harmful ones.

If you can identify a specific infection, there are many websites set up to help; but you have to figure out what the problem is before they can do much.

John

Subject: RE: BS: MSN trouble
From: JohnInKansas
Date: 13 Feb 05 - 09:25 PM

Some general comments.

If you are going to be on the web:

1. You MUST HAVE AntiVirus protection. Not too long ago it was sufficient to scan your disks occasionally; but now you need AV that automatically scans, in real time, all incoming and outgoing connections. You must have frequent updating of both your AV "engine" and of the signature files used to detect viruses.

2. You MUST HAVE a firewall of some kind between your machine and the internet. If you have WinXP, with SR2, the built in firewall is not too bad, although there are better.

3. You MUST HAVE the ability at least to detect SpyWare and AdWare. Most simple AV programs don't do this. It is much better to have an AntiSpyware that checks in-and-out traffic in real time and blocks this stuff before it gets on your machine. Frequent update of SpyWare and AdWare signature files is as important as for AV. Because this is a "growth industry" you may need more than one program: one for blocking and one or two others for detecting and removing the "odd stuff."

4. You do need to understand the difference between Viruses, Spyware, Adware, Popups, and Spam, and understand which of your system programs deals with each kind of malware.

5. Most people will want to have a Pop-Up Blocker of some kind. WinXP SR2 does a fair job of this, and the recent versions of the Google toolbar offer some protection. There are lots of others available, but NEVER CLICK ON A POPUP that offers ANY KIND OF SECURITY FIXES.

6. You probably want some sort of Spam filtering. Most email service providers give you some control here, but there are "addable" filters available.

7. If you have kids using your computer, or if you're "sensitive," you may want a Content Filter to block the porn sites etc. and/or to report when the kids beat the system and go there anyway.

Each of these functions generally requires a separate program (and/or hardware), and there are numerous freeware and/or "pretty cheap" programs if you want to assemble your own protections. If you assemble your own set, cost does not necessarily relate to performance.

If you want a "suite" program that provides all of the needed utilities in a single package, the current leaders probably are Norton Internet Security 2005 and/or ZoneAlarm Security Suite 5.5. Which is best for you depends largely on which features you consider most important. Even with either of these, an additional separate AntiSpyware program (or two or a few) is suggested. Each of these "suites" list for $69.95, I believe, but may be worth it if you don't want to assemble individual program pieces.

A pretty good, and current, review of Security Suites is at PC Magazine Feb 2, 2005. Several cheaper, or free, programs that may fit your needs are also reviewed there, and looking at what each suite does best or not so best will help you to understand what you're trying to accomplish. If you don't want to keep clicking the "Next" button, you can click on "Print" near the bottom of the page to get most of the article in one piece. (This site usually blocks direct links to the "printable" version, or I'd have linked directly.)

John

Subject: RE: BS: MSN trouble
From: Mr Red
Date: 14 Feb 05 - 09:53 AM

I'm getting worried - I haven't seen a virus since I unloaded Norton and installed AVG. All a bit like whistling in the dark. Mind you - the only time I came close to opening a virus was when they sent me an attachment that purported to be the contents of a returned e-mail from [e-mail]

Now as the domain owner, administrator, genial host, and all round good guy. Why would I be telling myself (not my ISP) that e-mail was undeliverable? But I was curious and Norton had removed the attachment so I had to think - and there you have the warning.

Think before you link

Subject: RE: BS: MSN trouble
From: JohnInKansas
Date: 14 Feb 05 - 10:35 AM

For Laura and other Messenger users:

Posted at Geeks to Go
Quoting:

According to a message posted on February 9th at the MSN Messenger download site, all users on 6.1 and 6.2 are being forced to upgrade to the latest build or be 'blocked' from the service.

The short announcement simply states "This upgrade includes the most robust security measures currently available for MSN Messenger. You will only be able to log onto MSN Messenger if you have upgraded your MSN Messenger software.". A link to the security bulletin provides more information, an excerpt from the page reads:

Microsoft is aware of exploit code available on the Internet that targets an issue addressed this week by Microsoft Security Bulletin MS05-009. Microsoft is not currently aware of any active attack utilizing this code or any customer impact. We will continue to actively monitor the situation and provide updated customer information and guidance as necessary.

Windows Messenger 4.7 is also affected and there is an update available for users running v4.7.0.2009 (update) on XP Windows SP1 and v4.7.0.3000 (update) on SP2. MSN Messenger 7.0 BETA users are unaffected.

Endquote:

I haven't attempted to confirm this at Microsoft or at MSN, so treat it as a "good rumor." This won't fix your present problem, but keep it in mind to update when you get cleaned up.

John

Subject: RE: BS: MSN trouble
From: *Laura*
Date: 15 Feb 05 - 09:42 AM

I'm downloading a different virus scanner at the moment - Norton didn't work.
I think it's windows messenger I've got - I just removed my other messenger, and I'm trying to remove windows messenger but I need the XP disk and I don't know where it is!
I am so out of my depth I hate computers aaarrrgh!
Thanks for all your helps though!

xLx

Subject: RE: BS: MSN trouble
From: *Laura*
Date: 15 Feb 05 - 09:53 AM

AAAAARRGH! woop woop he-hay-haar! yayyayyayayayayayay!
I just ran housecall scanner and it said a thingy (malware?) has been detected AND DESTROYED! woop! woop!
No - for the reboot - if this hasn't worked I will throw the computer out of the window! See how the virus/spyware whatever thingy likes that!
splat!