"Hey is this you..." MSN Virus

Shrimp

Just yesterday my friend(John) was using msn messenger 7.5 when one of his contacts(Mary), unknowingly sent a message to everyone on her contact list who happened to be online, it read:

Mary says:
hey is this you ... (link with receivers email at end)

When you click on the link it asks you to download an MSDOS file, i declined however John didn't, he accepted it and opened it, he's new to computers, plus, coincidental he was just talking to Mary, asking her to send a photo of him over which she had. So it was unlucky he clicked that.

Anyway, to cut to the chase.

The virus has stopped him from logging into msn or his email. It for some reason stopped him from logging into another site, but we've reset the password on that one and it works fine now. I've reset the password of his email on a different PC, and you can log into it fine, but when you try to log in on his PC it wont let you.

When I write in his email, then the new password, it immediately says page could not load the second u click log in. This is defiantly not cos of hotmail acting up, it's got to be the virus. Also when you open msconfig it closes it after like 2-3 seconds. It seems to block use of any apps that may possibly be used to delete the virus.

I've googled and it's defiantly a popular virus, but there does seem to be different variations on it, so the solutions I've found aren't too much help.

Has anyone experienced this, if so what can I do to rectify it? any help i appricaited..

if you need to ask me any details please do?

BTW it's Windows XP Service Pack 1

Sully

Hrmm..

Running on Windows XP SP2 would be a good start anyway. If you were on that, you could run Windows Defender (aka MS Anti Spyware).

I would suggest running NOD32 Anti Virus from safe mode, aswel as a good Spyware application such as Ad-Aware (im not sure if MS product is available for SP1) -- just make sure both are up-to-date.

Shrimp

Yeah, I was intending on doing all of the above, however it's just a matter of getting the stuff on CD, and going to his house. Thanks..

Any other suggestions?

Sully

When your going to backup his files (I presume you will have need to), how are you planning on doing that?

I know of a program called "BartPE" which lets you create a special type Operating System (using your OS Disk) - allowing for the rename of the "Windows" and "Programing Files" folder. Its suggested that you backup all his stuff into a folder called backup, then rename those two folders, install XP, boot up and retrieve the info from "backup" which is still present

Shrimp

or could i not just back them up to a external HD?

I've installed SP2.. and Ad-Aware.. it wont let me update definitions of ad-aware, this is actually one for the symptoms of the virus, I am going to see if i can get an external download for the update. Plus it wont let me run windows malicious file detector..

Sully

You could, whatever is easiest

It looks like something is blocking the programs and sites to update.

Have you checked the "HOSTS" file?

Windows XP = C:\WINDOWS\SYSTEM32\DRIVERS\ETC
Windows 2K = C:\WINNT\SYSTEM32\DRIVERS\ETC
Win 98/ME = C:\WINDOWS

Whats the contents? It should be just localhost 127.0.0.1 (if I recall correctly).

Have you tried running Windows Defender?