Warning Msn!!

[Mick]

Originally Posted by cashman

never and won't use MSN, someone once warned me it was dodgy n as i'm completly stupid with computers, i thought ****** it.

Well thats a strange one cashy i have you on my msn list

[WillowTheWhisp]

I don't use MSN myself but my girls do so I'll tell them to be careful - one of them is using my PC at the mo because her laptop is kaput (ish).

[mez]

i got one too last night, sorry if it got through to other people on my msn list, i got shut after chav rang & told me it had gone to him whilst yakking on msn to him, (the naughty thing) they are an absolute pest so i do apologise to all i seemingly sent it too.

[cashman]

Originally Posted by mick

Well thats a strange one cashy i have you on my msn list

told ya i was a dummy, if i have it n i'm on yer list i didn't know, cos i never seen or used it.

[BERNADETTE]

Originally Posted by mez

i got one too last night, sorry if it got through to other people on my msn list, i got shut after chav rang & told me it had gone to him whilst yakking on msn to him, (the naughty thing) they are an absolute pest so i do apologise to all i seemingly sent it too.

When I got back from Mums turned my computer on and it seemed I was very popular because everyone wanted to chat on MSN. Seeing as everyone was sending me the same message knew it was suspect so just deleted it.

[Benipete]

Had about 6 of them to-day luckily the server timed out.Don't know what to do except ignore it.

[slinky]

Originally Posted by Benipete

Had about 6 of them to-day luckily the server timed out.Don't know what to do except ignore it.

I think that is all you can do!!

[Benipete]

Just got another so i've turned messenger off.

[slinky]

Touch wood I only had that one yesterday!!

Watch... I'll get another now

[panther]

I never open emails that i dont know who they are from, because i only give it to people I know!


cheers for the warning though!

[slinky]

Originally Posted by panther

I never open emails that i dont know who they are from, because i only give it to people I know!


cheers for the warning though!

It's not an email though.... It just pops up in your msn window like your friend is sending you something!!

Like I said, mine came through from Jen... who I was talking to at the time on msn !! so I thought she had sent it.

Then I quickly got a message from Chav shouting " do not open anything that has just been sent to you .... VIRUS " It had been sent to everyone on MSN at the time!!!

Dodgy

[david1]

Had the message four times tonight so far . Just been deleting it

[derekgas]

Sounds like a good time not to be on msn, I use ebuddy and although havnt been on it much lately, have had no trouble, dont have all the freezing or crashing issues associated with msn either.

[Less]

It looks like it's a Trojan called:-

scvhost,


Please Note!

SVCHOST.EXE is a Windows process.
SCVHOST.EXE is a trojan.

After several google sessions I've found this site which after following their instructions found it and eliminated it:-

http://forums.techguy.org/malware-re...s-closing.html


Although the title of this page is:

Solved: explorer.exe keeps closing. possible virus?

I found references elsewhere connecting the Trojan to MSN, this just seems to be a good method of removing it.

To save you printing the lot out I've pasted their instructions below:-

Download SDFix and save it to your Desktop.

* Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix and remove some of its embedded files which may cause "unpredictable results".
* Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
* Remember to re-enable the protection again afterwards before connecting to the Internet.


Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :

* Restart your computer
* After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
* Instead of Windows loading as normal, a menu with options should appear;
* Select the first option, to run Windows in Safe Mode, then press "Enter".
* Choose your usual account.

* Open the c:\SDFix folder and double click RunThis.cmd to start the script.
* Type Y to begin the script.
* It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
* Press any Key and it will restart the PC.
* Your system will take longer that normal to restart as the fixtool will be running and removing files.
* When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
* Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt back to the thread.


Next

Click here to download Dr.Web CureIt and save it to your desktop.

* Doubleclick the drweb-cureit.exe file and Allow to run the express scan
* This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
* Once the short scan has finished, mark the drives that you want to scan.
* Select all drives. A red dot shows which drives have been chosen.
* Click the green arrow at the right, and the scan will start.
* Click 'Yes to all' if it asks if you want to cure/move the file.
* When the scan has finished, look if you can click next icon next to the files found:
* If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:

This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
* After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
* Save the report to your desktop. The report will be called DrWeb.csv
* Close Dr.Web Cureit.
* Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
* After reboot, post the contents of the log from Dr.Web you saved previously in your next reply along with a new Hijack This log.


Read through the instructions carefully several times before attempting the cure.

When sdfix is scanning in safe mode it can look as if nothing is happening, PLEASE be patient and allow the scan to finish, (it will ask you to re-boot when it's finished).

I hope this helps,
cheers all,
Less.

[Mick]

Just a note if your on vista the "run this.cmd" file might not run so click on the file below"catch file" this will do a scan for you.