MSN Messenger Facebook Virus

[Wicked_and_Crazy]

Anyone come across an MSN Virus via a facebook file it tries to send.

NOD32 doesnt detect a virus but there is definately something there as MSN sends messages without you typing them

[Wicked_and_Crazy]

Bump

[grandmaster]

I vaguely (sp?) remember something being spread about the MSN messenger network although I think it was way before facebooks time.
IIRC it sent messages to your friends list offering them a link to a website that downloaded malware etc.

[bmxbandit]

What do you mean by a 'facebook file'? Do thorough virus/malware scans, and reinstall messenger...

[Wicked_and_Crazy]

Originally Posted by bmxbandit

What do you mean by a 'facebook file'? Do thorough virus/malware scans, and reinstall messenger...

It tries to get you to download a file for example called "Facebook_07.JPG.COM" which is obviously a bit iffy. I had one of these an cnd somehow it appears to have executed. Since then someone in my address book has reported that ive sent them similar things which i havent sent

Carried out scans for ad aware, viruses etc using kaspersky, NOD32 and adaware and found nothing

[grandmaster]

Try Hijackthis! and spybot search and destroy.
They may spot something that the others have missed.

[Wicked_and_Crazy]

Hijackthis didnt pick anything up, will try spybot tonight when i get home

[bmxbandit]

Originally Posted by Wicked_and_Crazy

It tries to get you to download a file for example called "Facebook_07.JPG.COM" which is obviously a bit iffy. I had one of these an cnd somehow it appears to have executed. Since then someone in my address book has reported that ive sent them similar things which i havent sent

Ok, makes a bit more sense... looks something similar to this kind of thing? Removal may well be similar. If you have the msn executable in your windows directory, there's something dodgy about it!

[Wicked_and_Crazy]

Solution:

Turns out there is a hidden file called C:\WINDOWS\system32\ppnsvc.exe which kept recreating facebook19.zip in C:\Documents and Settings\User\Local Settings\Temp and also creating a file called 87.exe. Renaming the ppnsvc.exe file seems to have solved the problem, as would removing all references to it from the registry