"crazyfrog" is driving me crazy.. Is it a virus?

[MALFIE]

Received a file attachment while using Messenger (I know..I know..) called crazyfrog. It contained an obscene graphic..

Now I can't talk to anyone.. that is.. I see them connect.. and I send a message.. then when they reply it shows the C drive (as in My computer) for a second then drops back to Messenger and I cant use it again unless I reboot.
It wont let me run my virus proggie in normal mode and when I do, in safe mode.. it finds nothing (it is up to date as yesterday..)

Looking about it seems similiar to bropia-R worm but the removed tool for bropia doesnt find anything..

Any suggestions??

"We do not stop playing because we are old, more likely we grow old because we stop playing...

 

[aquias]

Try running this scanner

housecall.trendmicro.com

 

[erikhertzel]

It's probably a new virus that just came out with messenger, there have been some very recently.

Download AVG Free AntiVirus from

http://www.grisoft.com

Also MS Antispyware from

http://www.microsoft.com

and finally Spybot (

http://www.safer-networking.org/en/download).

Hope that helps.

Erik

 

[diogenes10]

Do you have (or have you had) messenger plus installed on the machine?

If so, if you look in c:\programfiles do you see a folder for c2media and/or 1 to 3 folders with really odd name combinations?

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[MALFIE]

Thanks for that....

I run Ca Vet (Innoculate) on my own PC and after I found all these files in the root directory of TWO PCs ( 1 XP Home, other Win2000 )just in for service I copied them onto a usb pen drive with the intention of "zipping" them to forward onto the Virus package tech..

However, as soon as I placed the drive into my PC Vet promptly wiped the lot , telling me it was the SUMON worm virus...

Both the other PCs have the same virus package running.. the only difference being mine was right up to date whereas theirs was a day or two old...

As it would not run the virus prog in normal mode I updated the viral defs manually then rebooted in SAFE.

It then found hostlblock. trojan in system32/drivers/etc/hosts

then went on to detect and delete

system32/serbw.exe (sumon)
system32/formatsys.exe (sumon)
windows\msmbw.exe (sumon)


It places a dozen or so MSDOS .pif shortcut files, hidden, in the root directory + a few others elsewhere that look menacing.. Of course you have to turn on View Hidden Files to find them, even in search.. But deleting those is a waste of time as they reappear on reboot.. probably being "seeded" but the above generating files..

Happily, both PCs are not operating correctly and there is no sign of the earlier problems..

Another case of why to keep virus defs RIGHT up to date..



"We do not stop playing because we are old, more likely we grow old because we stop playing...