Warning To All Sythe Members!

[Zenith]

If you use MSN there is a link that may be sent to you that contains a .exe program which is most likely malicious.

The Message I received was from [email protected] and it said this:

Matthew says:
is this you on pic? http://migre.me/[email protected]

Do not click the link in the quote as it is a malicious link.

This is a warning to all members.

I am not blaming [email protected] as I do not know who it is and it may be a hacked account, but most certainly do not click any links given by him.

 

[Slithereen]

Thanks for the heads up.

 

[Necromancer24]

Basically, don't click any links given to you by people you don't know. Be cautious when clicking any links sent over msn. Thanks for the heads up.

 

[Sup3r 4ut03r]

Obviously it's malicious, but it's a poorly thought-out attack. Anyone mind running it in a VM or some sort of sandbox to see what it actually does? Cause the download is linked to your MSN.

 

[cp]

[root@serv ~]# wget "http://migre.me/[email protected]"
--2010-08-03 02:24:10-- http://migre.me/[email protected]
Resolving migre.me... 187.61.16.234
Connecting to migre.me|187.61.16.234|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://64.202.120.38/PIC6777658-JPG-www.facebook.com.exe [following]
--2010-08-03 02:24:11-- http://64.202.120.38/PIC6777658-JPG-www.facebook.com.exe
Connecting to 64.202.120.38:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 69632 (68K) [application/x-msdownload]
Saving to: `PIC6777658-JPG-www.facebook.com.exe'

100%[===================================================================================>] 69,632 216K/s in 0.3s

2010-08-03 02:24:11 (216 KB/s) - `PIC6777658-JPG-www.facebook.com.exe' saved [69632/69632]

It redirects to an executable, presumably the same one that sent the message you got. It uses the same icon as a bmp file, probably to trick users into running it. It's just a generic trojan. How boring :'(

 

[Plznate]

Thanks for the heads up, I am really bad about not clicking links : /

 

[Example Of Death]

Thank you very much for the heads up. I've recently gotten a message very similar; I never a click from someone I rarely talk to (on MSN).

 

[theezakje]

Lol.
"`PIC6777658-JPG-www.facebook.com.exe'"

You'd be a completely idiot if you'd open "picture.jpg.exe"
Thanks for the warning though.

 

[cp]

I took a look at it even further. It does more than it seemed at first... It stopped a service, replaced a few key executables in system32 with its own copies, and added itself to windows firewall's exception list. Surprisingly doesn't copy itself to startup, but it does modify your network card drivers. It accesses some pages on myspace, and connects to an irc network. It gets the IRC server information from some myspace profiles, I'm thinking...

Nothing special. Just don't run it, could cause some damage...

 

[theezakje]

I took a look at it even further. It does more than it seemed at first... It stopped a service, replaced a few key executables in system32 with its own copies, and added itself to windows firewall's exception list. Surprisingly doesn't copy itself to startup, but it does modify your network card drivers. It accesses some pages on myspace, and connects to an irc network. It gets the IRC server information from some myspace profiles, I'm thinking...

Nothing special. Just don't run it, could cause some damage...

That actually is the perfect reason to quit Windows, and get a Mac :idea:

 

[Dejan]

Thanks for the heads up =)

 

[Tim Burton]

Lmao, I almost clicked it out of habbit!

Thanks for letting the community know

 

[Zero_Rush]

thank for the heads up i got a message just like that 10 mins ago

good thing i didn't open it

 

[Sanctuary]

Does anyone really fall for these...?

 

[theezakje]

Does anyone really fall for these...?

>_< Actually, yeh..

 

[Miracle Man]

You should delete it from this thread, I'm sure at least a couple of people have clicked it lol

 

[Sanctuary]

SCAMMER: ROFL HEY LOOK AT THIS PIC I FOUND OF YOU AT THAT PARTY LAST NIGHT!!!!shift1 http://mikeystripslolroflfuckitsavirus.com

ME: ohh HELLLLL NAWWWWW. Who the FUCK was taking pictures?! God DAMNIT.

*clicks link*

 

[simmo help]

Do not click on the link, becouse it is Virus, if matthew64 has virus on computer then he msn automatically send everyone a picture that is contained Virus.

 

[Homefrydgangsta]

That actually is the perfect reason to quit Windows, and get a Mac :idea:

GG!

And also, thanks, but it is sort of common sense.

When friends on facebook say is this you in the video? with a link that's like trogan.monkeyhaxporno.virus it's common sense not to click the spam.


but thanks anyways xD

 

[goku usa]

i have done many bad thins and i would like to know if i was ever caught :S