Msn Messenger Keeps Sending People Messages

[Neferious01]

Now I don't think this is a typical "you got a virus" type deal.
Heres my problem..

I installed Messenger Live (newest one) I noticed the programed jumped to the 45-60MB usages of ram and messenger would lock up. Then a chat window would pop up, then close itself, pop up and close itself. It would keep doing this till I ended the process...

Now heres my Question, This is a fresh format, I received no msgs from people sayin "Click here to see my pr0n pr0n pr0on!".. or anything of the sorts, this just started to happen out of nowhere. People msgs me and said "What with the same msg like 5 times" I asked em, wtf? but aparently it was sending the message "hahaha Sexxxy Display" over and over. Now I didnt type that any time recently except I do remember type that to the same person weeks ago..

It doesnt attach a link, or say "Click here" its just plain text being sent to me, Anyone seen this before? Just incase someone asks, I've attached a hijack this log... Ive done tons of scans and cant find anything. Should I do the hijack this scan on a normal boot?


Any suggestions would help! Thanks.
- Neferious01

 

[bushwhacker]

I have a bad hutch about this programs

Trojan Scanner
Spyterminator

YOu might want to delete / Uninstall these program and Install AVG Anti-Spyware or Webroot SpySweeper

Plus

Have you tried the Trend Micro Housecall ?

 

[Cerberus]

I agree...

You got malware! Also spyware blaster is a handy little program and AVG is a must.

 

[Neferious01]

Thanks for the replies.

I've done full scans with S&D, SpywareTerminator, & Housecall.
To no avail, only came up with cookies and windows patches...

Im currently scanning with AVG anti-V.

 

[bushwhacker]

I have better idea.

You need to follow Howard's recommendation, by doing this.

https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

And uninstall the SpywareTerminator and Trojan Scanner. It is useless. AVG Anti-Virus and Anti-Spywares already have it.

 

[howard_hopkinso]

Hello and welcome to Techspot.

Your HJT log is from safe mode and you need to rename it as per these instructions.

Once you`ve done that, please post a fresh HJT log from normal mode.

Regards Howard :wave: :wave:

 

[Neferious01]

Thanks for the replies!
I have ran a full scan with AVG Anti-V and anti-Spyware. They came up with nothing at all. AVG Anti-rootkit came up with nothing aswell!

Heres is the new hijack this log...
Although Im starting to think this is an issue with MSN messenger client.

 

[howard_hopkinso]

Your system is infected with the Backdoor.Bifrose backdoor. trojan. This is very dangerous and may well have sent your private data to a third part.

You`re also running HJT from the wrong location.

I have moved your thread to our Security forum.

Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

If after reading the above, you wish to clean your system, do the following.

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, AVG Antispyware and Combofix logs as Attachments into this thread, only after doing the above.

Also, let me know the results of the Panda Antirootkit scan.

Regards Howard

This thread is for the use of Neferious01 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Neferious01]

thanks for the reply. How did you end up knowing I'm infected with that backdoor?

Anywho...
I did all those steps that forum thread has and well, To no avail. None of em found anything. and heres the logs...

 

[howard_hopkinso]

The backdoor trojan clearly shows in your HJT log NTSpool.exe.

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Code:

File::
C:\WINDOWS\system32\NTSpool.exe
C:\WINDOWS\pics06.zip
C:\WINDOWS\mozver.dat
C:\WINDOWS\system32\dvdplay.exe

Folder::
C:\VundoFix Backups
C:\qoobox

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.

Regards Howard

This thread is for the use of Neferious01 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Neferious01]

Thanks for stickin this thing out with me!

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

NTSpool.exe
dvdplay.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or folders(if there).

C:\WINDOWS\system32\dvdplay.exe
C:\WINDOWS\system32\NTSpool.exe
C:\qoobox

Reboot into normal mode and rehide your protected OS files.

Post a fresh HJT log and let me know if you`re still having problems.

Regards Howard

This thread is for the use of Neferious01 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Neferious01]

Thanks for the help! this is odd since its pretty much a fresh format.. 0.o

I found the dvdplay & qoobox. But there is no such file as NTSpool.exe.


Thanks again, ill update this thread is msn is upto no good again

 

[howard_hopkinso]

Your HJT log is clean.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.


If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of Neferious01 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Neferious01]

Thank you very much sir, Everything seems to be running fine for now. Msn hasn't locked up, sending any messages.

Also, how could I have got this virus? I don't even remember installing much.
Could my old windows I made this copy from be infected, and it copied into the new version i made for updated drivers?

 

[howard_hopkinso]

How you got infected is anyones guess mate.

In my experience almost 100% of infections are caused through user error.

Take a look at this thread HERE. It`ll show you how you can keep your system more secure.

Regards Howard

This thread is for the use of Neferious01 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Neferious01]

Last time I let my brother on my computer, momment he does and i get this... ARGH!

 

[howard_hopkinso]

Maybe you should consider passwording your system. That`d keep him out, as long as you remember to log out when you`re not using it.

Regards Howard

This thread is for the use of Neferious01 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.