WARNING: SUSPECTED MSN VIRUS

I have come across a file on MSN/Windows Live Messenger that I strongly suspect to be a virus/malicious. I have submitted it to Computer Associates for an analysis. Below is a copy of the email I sent them:

this suspicious file is spreading over MSN/windows live messenger, the instant message pops up with the following text:

*cough* http://www13.im-profile.com/member.php?msn=[recipients MSN username]

where the email address in [] is the recipients MSN username. Following the link prompts you to download a file named like the recipents MSN username. Neither CA eTrust or AVG recognise anything wrong with it, but opening in notepad confirms it is an executable. This is just too suspicious to ignore, especially since a lot of the people on my friend's (the one who 'sent' me the link) messenger are naive enough to download and run it. My friend confirmed he did not intentionally send me the link. I have advised him to uninstall and reinstall live messenger as a precaution.Please could you let me know if it is a virus, as I run an number of online communities where members are heavy MSN users, and I would like to warn them if possible.Thank you for time

Please be wary, guys and I'll update you if and when CA respond.

I would advice you not to log into your msn anymore, this file seems to be a lag mitter...or other words a spyware...which when you click on it, it installs it self into your system similar to the last virus called spammer.............althought this is a new upgrade to that 1.......basically what this program does is it send feedback to the user that created it or to an unknown server thats no longer in use but is active for someone.,.....it will gather information bout your computer and anything you do in it...so I suggest you no longer log into msn til you figure out the problem......and ofcourse no antivirus will detect because its neither virus nor spyware.............its a unknown virus file that contradicts with ms dos.......I download the file but I have no intention installing it cuz of I still need to check for more feed back bout this file......i dont have enought knowlendge bout this file yet...so I also suggest you report this to msn, or hotmail staff bout this....by the way add me to your msn, I wanna try something
this is my e-mail
[email protected]Ill be on MSN Messenger

Im gonna try running it in a sandbox (=isolated machine with nothing on it and no network connection) at some point, I'll let you know if I uncover anything

good luck mate and safe mission, in the mean time Ill search for this file online........... by the way whats the actual name that it says on the file.......that you downloaded?

msn=[recipients MSN username]msn=** will then be the filename suffixed by .com

huh?....................explain :P

The filesnames are determined by your email address. If you're MSN email is [email protected] then the filename will be that.A filename is actually very dynamic, the files on the server doesn't have to be what your browser suggest to call it, if I wanted to I could make all files from romulation download as "seph is the l33t!.yarr"

An update on this: CA's automatic system has not found any virus in the file, however it has forwarded it onto their human researchers, who will get back to me. If you encounter this or any other file you suspect to be a virus; download it, but DO NOT run it. Instead, put it in a passworded zip file with the password 'virus' (all lower case) and email it as an attachment to: [email protected]. In the email detail how you came across the virus, and give any other information that you think may be useful to the people analysing the file. You will receive an automated response, then later a follow-up report from a researcher once the file has been fully analysed.

Here is the response from CA:

File:4067021Possible worm.Single entry.

Do NOT run this file if you encounter it.

thats because it is a worm, an undetectable worm..........not a virus but an unknown worm, worms arent really considered to be viruses, just pests

Final verdict:

Thank you for emailing CA Security Advisor.This is to notify you of the results of your submission, issue number
945667. Please keep this issue number for future reference.
Please see below for the final results of our analysis of your file
submission.We successfully received the following files:FILE SIZE CONCLUSION
------------------------------------------------------------------------
mailpart1 1070 confirmed clean
------------------------------------------------------------------------
[email protected] 78659 clean
------------------------------------------------------------------------
[email protected] 79360 confirmed malware
------------------------------------------------------------------------EMAILS TO [email protected] SHOULD BE FOR SAMPLE SUBMISSIONS ONLY. ALL OTHER
INQUIRIES SHOULD BE BROUGHT TO THE ATTENTION OF OUR CUSTOMER SUPPORT
TEAM AT
HTTP://SUPPORTCONNECT.CA.COMINSTRUCTIONS ON HOW TO PROPERLY SUBMIT SAMPLE FILES FOR INVESTIGATION
ARE AVAILABLE AT
HTTP://WWW3.CA.COM/SECURITYADVISOR/NEWSINFO/COLLATERAL.ASPX?CID=33514This automated scanning service "Virtue" complements our regular
technical support service. It is not a replacement for it. For
technical support please visit http://www.ca.com/about/support.htm.If you would like to comment on the quality of this automated service,
please send your suggestion to [email protected] .CA Security Advisor------------------------------------------------------------------------
For the latest security advisories, including detailed analysis of the
latest vulnerabilities, viruses, trojans, worms and spyware, and for
complete information on how to protect yourself or your organization,
please visit
http://www.ca.com/securityadvisorFILE
------------------------------------------------------------------------
mailpart1
------------------------------------------------------------------------
The Html(no active content) file "mailpart1" has been determined to be
clean. Our researchers have analyzed the file and found nothing
suspicious. Your mail was in HTML format, which we have extracted as
'mailpart.' file.Researcher comment:
This message part contains the HTML source of the e-mail.FILE
------------------------------------------------------------------------
[email protected]
------------------------------------------------------------------------
The PkWare Zip Archive file "[email protected]" has been
determined to be clean. For the results of files contained please see
below.FILE
------------------------------------------------------------------------
[email protected]
------------------------------------------------------------------------
The Windows PE (I386,EXE) file "[email protected]" has
been determined to be malicious. Our researchers have analyzed the file
and confirmed the result.CA antivirus products address this malware as follows:
------------------------------------------------------
eTrust Antivirus r8/v7
We will inform you by email ASAP when we have a signature update
available providing detection.========================================================================

It cannot be detected by AV programs at this time.

huumm...interesting...guess I dont have to find it.....I guess that site I gave you isnt worth looking at since this is just a spammer but a serious file, not to deep but deep, malware isnt good to have,.....on a small file like that.........ofcourse you already know the answermalware cant be detected by antivrus program of any such......the only thing is prob a good anti spyware,.....but then I wonder if that will even detect it............because malware acts as such to a virus same caracteristics that steals information from your computer and sends it to a botserver......just like a trojan would..........(quoting: not a virus but malware interesting) whats the decoding on that file?..............

this would be more serious than malware, it is essentially a virus as it's made to spread itself. A virus does not have to be malicious in order to be classified as a virus.

but this isnt a virus of some sort, this is a malicious malware program if you read ontop it desplays that its malware(malware content) were not talking bout a serious virus were talking bout malware that steals information.....all malware do that...........

it spreads like a virus though.

I would have to agree with you thereI would have to say that Loony got screwed big time in the ARSE!!!! :P ::) Sorry Loony but I had to say it.........lol :P

lol why? He's not infected or anything. :)Neither Loony nor I have executed the code, we merely had a little look at it in a hex editor before Loony sent it in to CA.

loony did get infected............... read ontop were it says............ have come across a file on MSN/Windows Live Messenger that I strongly suspect to be a virus/malicious. I have submitted it to Computer Associates for an analysis. Below is a copy of the email I sent them:Quote
this suspicious file is spreading over MSN/windows live messenger, the instant message pops up with the following text:Code:
*cough* http://www13.im-profile.com/member.php?msn=[recipients MSN username]
where the email address in [] is the recipients MSN username. Following the link prompts you to download a file named like the recipents MSN username. Neither CA eTrust or AVG recognise anything wrong with it, but opening in notepad confirms it is an executable. This is just too suspicious to ignore, especially since a lot of the people on my friend's (the one who 'sent' me the link) messenger are naive enough to download and run it. My friend confirmed he did not intentionally send me the link. I have advised him to uninstall and reinstall live messenger as a precaution.Please could you let me know if it is a virus, as I run an number of online communities where members are heavy MSN users, and I would like to warn them if possible.Thank you for time,or atleast I pressume he did get infected ;D

No I'm telling you he didn't get infected. :)You have to download and then execute the file, and Loony isn't stupid enough to execute a file like that. Well at least not in the afternoon, he might be early morning and late night though.

And another update:

Thank you for emailing CA Security Advisor.This is to notify you of the results of your submission, issue number
945667. Please keep this issue number for future reference.With regards to the file "[email protected]" submitted by
you on 16 Mar 11:17:51 (Australian Eastern Standard Time), we have
added cure instructions for Win32/Nochod.AN to the signature files.The Windows PE (I386,EXE) file "[email protected]" has
been determined to be malicious. Our researchers have analyzed the file
and confirmed the result.Researcher comment:
Win32/Nochod worm variantCA antivirus products address this malware as follows:
------------------------------------------------------
eTrust Antivirus r8/v7
Engine Update version Last Update
30.6.0 30.6.3487 17 Mar
The signature update is currently undergoing testing and should be
available for download within 24 hours.
Once the signature file is ready, it can be downloaded from
http://www3.ca.com/support/vicdownload/

And no I didnt execute it. I'm not that stupid. :P