MSN Messenger Spread Virus By URL Link
Previously MSN virus was spread by zip image file. Once the computer got affected, it will automatically send a image file to all the online contact of the infected user. But, it did come with some funny message whereby one would doubt the integrity of the message.
Now, the virus was spread through an URL Link. It will send you some http:// link. Just like the normal way where you share a link with your friends, you copy and paste the link, maybe you don’t bother to explain further what it is. Once you visited the website probably you will get infected and you will send out the link to your friends and so on. I have not click on any of the links sent by my friends and I do not intent to click or try out the link. Most of them are offline message. If my friends still online I will definitely ask them what’s the link and what’s the details and if they reply with authentication then I will know it’s a real link shared by my friends if it’s not and most of the time they will reply you “What link you are talking about then you know it’s not send by your friends”. DO NOT CLICK ON THE LINK OR YOU WILL BARE THE CONSEQUENCES.” This is only an advise from saimatkong 
Example:
———————————
xxx says:
http://www.rkntbp.info/
xxx says:
bye with a smiley face.
———————————-
other links like
http://www.nkcfh.info
http://www.dbnyxc.info
http://www.qmnfct.info
http://www.mxbpkr.info
http://www.xjctsp.info
http://www.rhqwcp.info
http://www.mgtwdn.info
http://www.kfytsj.info
http://www.dsbpzg.info
http://www.gmnzby.info
http://www.dbnyzc.info
http://www.jcyhzr.info
http://www.dsbpzg.info
http://www.dbnyzc.info
http://www.bzjnxd.info
http://www.zjdgxq.info
http://www.qvsgwy.info
http://www.cdystp.info
http://www.hmybqw.info
http://www.yvmjzc.info
http://www.vmytks.info
http://www.nhcswv.info
http://www.ztmrcj.info
http://www.wkfbmt.info
http://www.fvkgcz.info
http://www.zcxrjb.info
http://www.jtyqkv.info
http://www.xhzsrg.info
http://www.hqnxmv.info
http://www.srbgxz.info
http://www.pghzvq.info
http://www.bgpmwr.info
http://www.ndkzcy.info
http://www.tpyhzx.info
http://www.unixxkpv.info
http://www.friendly-offer.com
http://www.shorty-link.com
http://www.shortifynow.com
http://checkdiz.info
http://click.and.be-c00l.info
http://minakossy.t0nez.info
http://0594.com/qifu/
http://www.Awe-s0me.info !!!!!
http://www.AcquireBonus.info
http://get-that-stuff.info
http://coooool.info
http://your-msn-email.imagrshak.info
http://your-msn-email.imageswitch.info
http://your-msn-email.imagedino.info
http://your-msn-email.imageloko.info
http://your-msn-email.hosthdd.info
http://your-msn-email.imageloco.info
http://your-msn-email.holyimage.info
http://your-msn-email.lostimage.info
http://your-msn-email.picshak.info
http://xxx.youtubeimgs.com ?!?
http://xxx.myspacedimg.com
http://xxx.youtubeimgs.com
http://xxx.pixxchecker.com
http://5834255126/ 
http://www.faocazae.mobi
http://www.mnmaro.net/
http://www.ccikan.net/
http://www.lrkcaa.net/
http://www.eoroal.net/
http://www.inonrc.net/
http://www.rnamot.net/
http://www.tnnnol.net/
http://www.karrac.net/
http://www.ttilia.net/
http://www.omoiii.net/
http://www.keteel.net/
http://www.cmcrtr.net/
http://www.imcalr.net/
http://www.rklmkr.net/
http://www.ikemtuxm.mobi
http://www.zzgivdgo.mobi
XXX check out these awesome pics from the awesome party http://XXX.bobyup.com
hey, looks alot like your pic or ?
http://msngallery.awesomewebspace.com/index.php?=xxx@hotmail.com
Check who has blocked you
www.blockchecktoday.com
Check who has blocked you
www.blockcontrolled.net
Check who has blocked you
www.blockcontandchecke.info
Look at this site
www.blckchcknew.info
click here and get your bonus
www.seahealthplus.info
Get your Bonus Ringtone
www.BonusSoon.info
听我最新祝福语音，顺便帮我刷点分:-) http://www.msnvoicecn.com
Hey XXX this site is giving away free $250 dollar gift cards to starbucks but hurry before they are all gone http://XXX.bobzop.com
XXX check out these awesome pics from the awesome party http://XXX.pics-at-the-party.com
Hey XXX hey check this out this is amazing http://XXX.bambok.com
XXX hey check this out this site tells you who has a crush on you, i found out the person i knew had a crush on me actually does, this is great try it out you’ll be surprised http://XXX.bakblu.com
Hey XXX hey check this out this site tells you who has a crush on you, i found out the person i knew had a crush on me actually does, this is great try it out you’ll be surprised http://XXX.illzingya.com
Hey XXX check this out go to this site and vote who will win the next game and they send you a jersey and a $250 gift card i got mine and it was so easy http://XXX.yourfavtns.info
Hey XXX i found the best thing ever this is a new site that is giving away free giftcards for christmas after you give them your email i got mine in the mail go here to get yorus before they are all gone http://XXX.specialoffer4u.info
XXX Hey check out the pics from the crazy party!! they are great LOL! go here to see http://XXX.amazingareaz.com
This is the page where after you click on the above link will bring you to and it required your email and password. Do not ever try to key in your email and password! It will leak your account details to them and your friends in your address book list will be affected by this link too.
Example only, DO NOT CLICK and DO NOT TRY THE LINK. Most of them are .info domain and .info domain now is very cheap and I think that’s why they are using .info here.
If you click the link they will ask for your msn email address and password! Do not ever key in your email and password, if not your account details will be gone! This is the trick how they get access into your account.
How to clean the MSN Link Virus?
1) Install anti virus e.g. AVG Anti-Virus Free Edition 7.5.516
2) Spyware detector or remover e.g. Ad-Aware 2007 7.0.2.6
3) Trend Micro™ HouseCall is an application for checking whether your computer has been infected by viruses, spyware, or other malware. HouseCall performs additional security checks to identify and fix vulnerabilities to prevent reinfection.
4) Ok, I think this can be solved if you change the password to you MSN account? I’m not infected so if those infected please try and share if it’s working or not. This is because I heard those who infected actually check MSN who blocked you and have to login, so I suspect it might be the problem. -Latest Update-
Hope it helps. Any information or comment feel free to share will us.
39 Responses to “MSN Messenger Spread Virus By URL Link”
By synical on Mar 1, 2008 | Reply
I got a couple of those too… hope I’m not infected…
By iCalvyn on Mar 2, 2008 | Reply
alot of my msn friend get this virus, some of them using AVG, but still infected
By cyrus on Mar 6, 2008 | Reply
I have AVG, and used to run it every morning.
I say I used to, since my computer crashed about a month ago. I did use that stupid “who blocked you” link, and definitely see that as a cause of this issue at this point.
I will try the solutions proposed and will get back to you on it.
All I know is that, without me logging on, or have my computer on, the msn signs itself on, sends annoying text messages to my friends and I am ready to say bye to msn all together.
By Michael on Mar 9, 2008 | Reply
LOL food thing i didn’t press the link xD
By shayne on Mar 13, 2008 | Reply
i have clicked one 1 of the links be4 and i don’t got the virus. i did download the file, and its a compressed zipped file containing an exe. after noticing that i deleted it. i am not infeceted. at the time i was using a free trial of live onecare antivirus.
By sally on Mar 14, 2008 | Reply
i clicked the stupid msn who blocked you link!
i think i have been infected but have changed my msn password…hopefully that will solve the problem:(
By saimatkong on Mar 14, 2008 | Reply
Yes, it should solved your problem as I told my friend and tested out and in the end no more fwd link from her. but some other ppl still sending me the link coz I have not inform all my friends. Cheer! =)
By saimatkong on Mar 14, 2008 | Reply
hi shayne, ya because you smart enuff to delete the exe file without executing it. =)
By RelationSheep on Mar 20, 2008 | Reply
http://www.zataz.com/ forum/index.php?showtopic=2012
By jennicarla14 on Mar 20, 2008 | Reply
slt tous
By Erin on Mar 24, 2008 | Reply
How come these sites are not shut down?
I googled this link because of the emoticon.
Most viruses are followed by an emoticon or something suspicious.
I know when a legit link is sent, so I seldom check.
But it is the .com that threw me off.
Most viruses, as you said, are zip files or really nonsensical websites.
I’m suprised these sites are not simply gotten rid of.
By Patty on Mar 27, 2008 | Reply
I received one yesterday, although it was different from what you described. For this one a message was sent appearing to be someone from my list and it said something like “this picture kind of looks like you” and contained a link. Don’t quote me on the link either, but it was something like msngalleries.megacities.com and then continued on with my MSN ID in the URL. Firefox asked me if I wanted to save the file. I did not. Then I wrote back to the person it came from, and was informed that he didn’t send it, but got one just like it from a friend earlier that day.
By saimatkong on Mar 27, 2008 | Reply
hey, that’s the new thing i guess. those said pictures looks like you or asking you if my sexy pictures nice or not those usually come with an attach zip or rar file that contain malware or virus or trojan.
By Patty on Mar 27, 2008 | Reply
Well there was no file sent in the message, just the URL which takes you to a website that would then put a trojan or virus on your computer. But yes, that’s the one.
By Montis on Mar 27, 2008 | Reply
A colleague of mine has a similar problem, his Messenger account randomly logs-on post a spam link, usually a “see who’s blocked you” one. Then quickly logs off.
Does any one know whether this is a trojan or an account hijacking, his password has not been changed, but I suspect he has used their ’service’ and they have his info.
Any suggestions?
- Montis
By saimatkong on Mar 27, 2008 | Reply
as I suggested in the post / article, try to change the password and it works for some of my friends. =)
By Patty on Mar 28, 2008 | Reply
Montis, do you know if your colleague has his password saved by MSN messenger, so he can log in automatically instead of having to type it each time? If so, maybe unchecking the Remember Password feature will help to prevent those. However, if there is something on his computer doing it, then that needs to be taken care of as well.
By Danny Bee on Mar 28, 2008 | Reply
Ok People please listen!
Where these Websites and spyware are coming from is when people go onto fake websites such as whoblockedyou.com and so on!
Please inform all your contacts to not go on these such sites as they store log-in information and then when you sign out they sign in and flood your contacts with these websites (http://www.unixxkpv.info/ ;)) and .zip files with messages such as \”Hey Would This Photo Look Good As My Profile Picture\” & \”Hey Look At This Photo That I Found Of Us From Years Ago\” and so on
PLEASE
INFORM
YOUR
MSN
CONTACTS
NOW!!!!
| AND NEVER SET YOUR WLM FILE TRANSFER SETTINGS TO AUTO FILE ACCEPT! |
By ahmed on Apr 4, 2008 | Reply
ok, itz gud
thankx
By ahmed on Apr 4, 2008 | Reply
all of you thanks
By ahmed on Apr 4, 2008 | Reply
yeah i got the idea, thanks alot and good cooperation
By AustralAZN on May 4, 2008 | Reply
So would AVG pick it up? Or would I need other programs?
By saimatkong on May 5, 2008 | Reply
nope I AVG would not pick it up as I using the AVG free version for the premium version I’m not so sure about it, maybe the rest could comment on this.
By Elias on Jul 12, 2008 | Reply
Ok i solved the problem i found my way to remove the virus and prevent it from comming back unless u click more stupid links! okey here it is
By Elias on Jul 12, 2008 | Reply
Okay, you have noticed that you send links with something like http://blablabla.info=yourmail.com to people totally unaware!. This is a giant new virus spread quickly through that people click on links. When you pressed it.then saved it down a malicious program that can have its name somewhat similar to videotube_mpq_.exe. or,in principle, anything file.exe .you may be taken to a page where it was blank but still saved the program. but a tip Check your received my files folder.
where it should certainly be a suspicious file of around 50/85 kb. (Note: this is not the actual virus. But it is the program that was downloaded. Which subsequently creates the file that creates the virus!)without icon!.This file is opened even if you do not double-click it, even if you just insert a USB memory in your computer with This starts it and save the demise virus file in C:\Windows This file is hidden, so you have to put on show Hidden folders!.To do this, you should start the “My Computer” then into the top corner, you see “archives”, “edit,” “show”, “favorites”, “Tools”, “help” You must now go into”Tools”. See “map options”
click on “View” in the small section “Hidden files and folders, click in with a black dot” Show
hidden files and folders. “NOTE THIS IS NEEDED TO REMOVE IT. After you arrive in the C:\Windows and
localize “Svhost.exe” which is the virus file. NOTE. This is not the same as Svchost.exe, which is a system process to run the computer!
The next step after you delete the file and cleared away trash bin will be to
remove it from the register!. the register is controlling your computer’s functions as the start, how
file endings are handled and so on. It is so that the virus will start each time you start your computer, this file is started and we want it to!. So I’ll show you how to remove it!
First, click “Start” button in the lower-left corner. then take the “Run” and type in “Regedit”. Now, you get up
a rather large box. and the left is HKEY_LOCAL_MACHINE. click on it, therefore, the + symbol as you go
up subfolders. then click the + SOFTWARE and after the + Microsoft. Now, click + Windows. Now, press
+ CurrenVersion and finally + Run! Woila! there is a string key to the right of the column, called Svhost.exe
the name may be Windows Messanges Control Center or Massanger Control anything. this key is your
virus that starts every time the computer starts up! Now, you should, therefore, right click on Messenger control anything
to the right
Selecting and REMOVE Click on YES.
This is the path If you find the key. in regedit on your own,here it is:HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
I ask you never click on links sent to you. unless the person really asked you to
do it and not just “hey look at this” http://cooooool.info where you click!
the same applies. Zip files and mail!
There may be an old file that is located in C:\Windows\System32 file named Tmp.reg and is a file that
added the virus in the registry! one tip is if you delete it immediately as the continuation of infections are
more difficult.
____________________________________
׀Human Knowledge Belongs To The World׀
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
This guide was designed Of me Elias, and the discovery of each file, and where it is located. is Mia lund. =)
09/07/2008 ©
By Elias on Jul 12, 2008 | Reply
lul file to big .. email me at Dru32@hotmail.com to get the guide in text
By D.C on Aug 19, 2008 | Reply
i got this one “nsfw http://gurlx.com/bjx?/Jessica+Alba :)” i didnt click it, i was the idiot who got it and now sends it every time, its realy annoying because i cant get rid of it!!
By DC Office user on Sep 16, 2008 | Reply
I’m having the same Jessica Alba link, and I’m using Office Communicator, not MSN Messenger! I don’t even have MSN Messenger installed! It’s making me look like an idiot since I’ll have business conversations and this will pop up. Is there a link that says explicitly how to remove this thing manually?
By DC Office user on Sep 16, 2008 | Reply
Figured out how to get rid of it.
I went to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in my registry and found a fake lsass.exe that was located in my temp directory that was starting. I deleted the registry entry and also killed the process in task manager. Make sure you kill the right one or you’ll accidentally kill a Windows system process. (On my Vista Enterprise system it was the one only using 200K memory.)
By Gabriel Cristian on Oct 8, 2008 | Reply
Hi!
I am really impressed about these iPhone clones. I just bought from Shanghai an A09 model and it’s fantastic. I noticed that it’s working very well, even in very poor signal, where my 6500s Nokia is completely dead. It works with 2 SIM cards simultaneously. It has a lot of facilities and a very good sound. I don’t know how long it will last, but I will take care and I will not install any application on it, to not damage the operating system. The batteries are lasting about 3 days in normal use, but in standby I think they last more. I am a little sad that I cannot have the user manual. The one that I found it in the box is from a previous model that works with dual SIM switching. So to conclude, I think that A09 it’s a very good phone for everyday use and even much more than that.
By sam on Oct 11, 2008 | Reply
Hello. I thank everyone who contributed to this site. The great effort. Regards.
By sam on Oct 11, 2008 | Reply
Hello. I thank everyone who contributed to this site. The great effort. Regards
By Azo on Oct 26, 2008 | Reply
Yo!
I’m with you, daug!
I’m contacting netblock/inetnum owners and registrars to see if they take them away.
By Rachel on Oct 28, 2008 | Reply
I accidently opend the file with my Blackberry. Does anyone know how to rectify and delete this virus??? Please let me know !!! thanks
By nebbia on Oct 30, 2008 | Reply
viva la vida
By andrea on Nov 1, 2008 | Reply
hi
By Salko on Nov 6, 2008 | Reply
Its also a virus where it shows “Here are the pictures from the crazy party!” and after that it comes a .zip file.. Its a Virus that too but its new, i think?
By JJ on Nov 14, 2008 | Reply
Hi!
I got a similar message today but the link was slightly different. I click de link by mistake and it took me to that “PICS for MSN Friends” page, of course I didn’t input my account information there, so hopefully I didn’t got infected. Any way has a precaution I changed my passwords right away.
This is the message I got in case someone get’s this new message:
“XXXX check out these awesome pics from the awesome party LOL http://XXXX.blubak.com “