MSN Messenger - cute.pif

[downquark1]

There's virus going around called cute.pif that automatically sends a link to everyone on ur MSN list.

I have a copy of the file (not run) but I don't know exactly what it does, I can't find the details on google.

So just beware

[Jarandco]

Yea ive just had aboiut 10 people all pop up at once trying to get me to click the link!
__________________

www.mess.be has a little bit on information, which will be updated when they can get more info, they say:

It has been reported by many messers in the last few hours that there is a virus that is currently doing the rounds.
This is spreading automatically by sending a link to itself out to all your MSN Messenger contacts.

If you receive and messages from your friends which end in .pif be warned it contains a virus.

All messers should make sure thier anti-virus software is up-to-date. More information will be posted when available.

[zovat]

Originally Posted by Jarandco

Yea ive just had aboiut 10 people all pop up at once trying to get me to click the link!
__________________

www.mess.be has a little bit on information, which will be updated when they can get more info, they say:

just had my wife ask me about this - downloaded it on my linux laptop - looks like it autoexecutes and sends to all your currently online MSN contacts. Other than that - can't tell too much on first check apart from it appears to be signed by "Rich"....

more as I hunt through it

[downquark1]

Originally Posted by zovat

just had my wife ask me about this - downloaded it on my linux laptop - looks like it autoexecutes and sends to all your currently online MSN contacts. Other than that - can't tell too much on first check apart from it appears to be signed by "Rich"....

more as I hunt through it

It didn't autoexecute on mine, thanks to firefox, it just saved it and sent it to norton.

[zovat]

Originally Posted by downquark1

It didn't autoexecute on mine, thanks to firefox, it just saved it and sent it to norton.

Same for my wife - she runs firefox

unfortunately - the mate that sent it runs IE : looks like it installs "PowerScan" toolbar (spyware) as well unless she already had that..

She (the mate) Just did a full scan and Norton picked it up as "bloodhound.W32.1" - which is roughly translated as "we reckon this is a virus, but we have no listing for it yet" - looks like the heuristics work !!!! (shame she didn't keep her definitions up to date...).
__________________

It also appears to install "powerscan" toolbar - listed as spyware on most registers...
__________________

It appears that even IE asks if you want to open the file - but if you say yes, it autospawns a conversation window to each of your online MSN contacts, sends the popup, then closes them all again...
Ah well, time to help some friends clean up the mess....

[nffc]

Who would run a PIF file anyway- but good advice anyway and you can have a rep

[bmxbandit]

im pretty sure messenger doesn't auto-execute anything... mine wont anyway. if it does, turn it off asap!

[Kliro]

Its a link, will run through your browser not msn.

It's a worm that is lurking around. I've heard it stops you from using the right mouse button and keeps trying to send it's self on messenger.

[zovat]

Looks like symantec have already released an update, and defined the virus as below :

http://securityresponse.symantec.com....kelvir.a.html

although the payload (from people who have told me they followed the link) also appears to install some spyware...
__________________

From that link - you have to follow the link in the popup - then it starts to autoinfect - so as long as you don't :

a) follow the link
and b) accept the download

you should be ok

Originally Posted by Symantec

When W32.Kelvir.A is executed, it performs the following actions:

1. Sends the following message to Windows Messenger contacts:

Message:
omg this is funny!
[Link to the jose.rivera4.home.att.net domain]

2. If the link is clicked, W32.Kelvir.A downloads a file and executes it.

3. Upon execution, the worm attempts to download a file from home.comcast.net domain and saves it as c:\patch.exe.

4. Attempts to download an additional file from www.yoursite.com domain. The downloaded file is a W32.Spybot.Worm variant.

Note: At the time of this writing, the file was unavailable.

5. When the downloaded file is executed, it moves itself to the following file:

* %System%\hotkeysvc.exe (with attributes hidden, read only and system)

6. Adds the value:

"CPQHotkeys" = "hotkeysvc.exe"

to the registry keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
HKEY_CURRENT_USER\System\CurrentControlSet\Control \Lsa
HKEY_CURRENT_USER\Software\Microsoft\Ole
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\Lsa
HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
HKEY_USERS\.default\Software\Microsoft\Windows\Cur rentVersion\Run
HKEY_USERS\.default\System\CurrentControlSet\Contr ol\Lsa
HKEY_USERS\.default\Software\Microsoft\Ole

so that a W32.Spybot Worm variant runs every time Windows starts.

7. Sets the following registry key to disable DCOM:

HKEY_LOCAL_MACHINE\Software\Microsoft\Ole\"EnableD COM" = "N"

[downquark1]

A hour later Norton responded with this:

We have analyzed your submission. The following is a report of our
findings for each file you have submitted:

result: This file is infected with W32.Kelvir.A

Developer notes:
C:\Documents and Settings\*\Desktop\cute.pif is non-repairable threat. NAV with the latest rapidrelease definition detects this. Please delete this file and replace it if neccessary. Please follow the instruction at the end of this email message to install the latest rapidrelease definitions.

Symantec Security Response has determined that the sample(s) that you provided are infected with a virus, worm, or Trojan. We have created RapidRelease definitions that will detect this threat. Please follow the instruction at the end of this email message to download and install the latest RapidRelease definitions.
Downloading and Installing RapidRelease Definition Instructions:
1. Open your Web browser. If you are using a dial-up connection, connect to any Web site, such as: http://securityresponse.symantec.com/
2. Click this link to the ftp site: ftp://ftp.symantec.com/public/englis...asedefsi32.exe. If it does not go to the site (this could take a minute or so if you have a slow connection), copy and paste the address into the address bar of your Web browser and then press Enter.
3. When a download dialog box appears, save the file to the Windows desktop.
4. Double-click the downloaded file and follow the prompts.
----------------------------------------------------------------------
This message was generated by Symantec Security Response automation

Should you have any questions about your submission, please contact
our regional technical support from the Symantec website
(http://www.symantec.com/techsupp/)
and give them the tracking number in the subject of this message.

It may be heavy on the RAM, but it works

[Stephen]

I appear to have been infected, thanks to my little brother, however I cannot figure out how to remove it as it is variant N or O of the Bropia Worm that is going around. It shuts down any attempt to run virus scans and system programs. Also any attempt to goole for the word Virus or Norton ends in the browser closing. Also tried safe mode but that has the same problems.

A mate sent me the norton removal tool but when I try and run it I get 'this is not a valid win32 file'.

Please does anyone have any suggestion.

[Aragorn]

If you PM me an email address, I can send you a zipped copy of the tool and a pdf of the instructions.

[Stephen]

Originally Posted by Aragorn

If you PM me an email address, I can send you a zipped copy of the tool and a pdf of the instructions.

I have tried this already but it still comes up with the not valid win32 file. have emailed them to my self from work so will check them when I get home. see if I have any luck. I have the details of how to remove the registry entries but I cannot open regedit as it closes straight away.
Would installing windows on a different partion and trying to run the tool or virus scan from there work?

[Aragorn]

Would installing windows on a different partion and trying to run the tool or virus scan from there work?

It would identfy any files left by the worm but wouldn't be able to edit the registry. By deleting the files it may get you in to a position where you can run regedit from safe mode. The other advantage of a temporary copy on another partition is you can move any data of the main partition.

If you have all the OS and app disks available, it may be quicker to save the data and reinstall the OS