Just a friendly warning to all who use
MSN Messenger and / or Windows Live Messenger..
A virus that populates your contact list, then propagates itself to your messenger contacts via a specially crafted instant message, is in the wild..
Virus description:
W32.Funner is a worm that spreads using
Microsoft's MSN Messenger instant message program
and modifies the system hosts file.
Be aware of ANY messages contaning the text:
"OMG.. is this you?" or a similar text,
followed by a link that appears
to have a image extension (.jpg or other)
or a similar text.
The only additional information I have found
on the web so far was publised on the ZDnet.uk website,
[url=
http://news.zdnet.co.uk/internet/security/0
,39020375,39169941,00.htm]
ZDNetUK Story
/url]
A portion of this story below:
"known as Funner, it spreads using the MSN instant-messaging service and tries to direct people to a Web site, www.78p.com. However, security software firm Symantec found no evidence that the virus, which had only spread to a small number of PCs, had caused any disruptions.
"From what we have been able to see, it tries to send itself out to all of your MSN Messenger contacts," said Oliver Friedrichs, senior director of Symantec's security response team. "But we have only seen about 34 submissions in the last 24 hours -- really not that significant."
The virus changes the configuration of an infected computer so that users who try to browse to one of more than 900 Web sites will be redirected to www.78p.com, according to information on Symantec's Web site. The virus may also attempt to download additional functionality from the site. The site, however, appears to be down."
We had an instance of a member posting this link into the chat in 8 ball 1 and it did become an issue for a few that clicked this link and executed the file it pointed to.
In the event that you do get this link in an instant message, DO NOT click on it,
simply close the window and let your contact know
it was sent by them so they can take actions to
remove the virus from their machine.
Symantec has posted removal instructions
on their website...at this location:
[url=
http://www.symantec.com/security_response/writeup.jsp?docid=2004-101116-3507-99&tabid=3
]
W32.Funner Removal Instructions
/url]
GHOST MP
