New MSN WORM

Error message

Deprecated function: implode(): Passing glue string after array is deprecated. Swap the parameters in drupal_get_feeds() (line 394 of /var/www/pied-piper.ermarian.net/includes/common.inc).
AuthorTopic: New MSN WORM
Warrior
Member # 3035
Profile Homepage #0
Watch out for instant messages -even when they come from good friends and family- which look like this:

"OMFG! http://[some_domain_name]/handcuffs.pif"[/url]

OMFG can be similar words, like LOL, LMAO, SO COOL or ROFL. This is a new worm, probably a Bropia variant, spreading around MSN Messenger disguised as a hyperlink to a file called handcuffs.pif (which is hosted on random domains, like for instance members.chello.nl/g.geurts). When you click the link and thus activate the download of this file, a jpg of a handcuffed girl will be extracted (which some of you didn't seem to mind) and in the background a similar message will be sent to online MSN Messenger contacts. Don't help this worm propagate... don't click links to .pif files!

Seems to be a varient of the w32.bropia virus

Update your definitions!

--------------------
Maker of the Geneforge 3 Trainer for windows.

[NEWEST v.0.9 ~~ Trainer D/L [URL=http://www.ironycentral.com/cgi-bin/ubb/ubb/ultimatebb.php?ubb=get_topic;f=19;t=000423;p=2[/URL](.zip, 103kb)
Posts: 73 | Registered: Monday, May 26 2003 07:00
Master
Member # 1046
Profile Homepage #1
Yea, i nearly took this up the ass after blowing my mind with Reading Week studying... no wait, i actually got it, but i fixed it. oh well.

--------------------
Polaris - Weather balloons, ninjas, and your big daddy Wise Man. What more could you want?
Undead Theories - Don't Ask, Don't Tell
Posts: 3323 | Registered: Thursday, April 25 2002 07:00
Shock Trooper
Member # 3719
Profile Homepage #2
I clicked on it for kicks, btu nothing happened. I am saddened by this.

--------------------
Scandalous Stories, fishing,and great photos
Posts: 294 | Registered: Monday, November 24 2003 08:00
...b10010b...
Member # 869
Profile Homepage #3
That is because "[some domain name]" is not a legitimate domain name. :P

--------------------
My BoE Page
Bandwagons are fun!
Roots
Hunted!
Posts: 9973 | Registered: Saturday, March 30 2002 08:00
Shock Trooper
Member # 4942
Profile #4
What exactly are the results of the virus? Does it harm MSN messenger itself?

--------------------
Wham Bam Shizam
Posts: 247 | Registered: Monday, September 6 2004 07:00
Master
Member # 4614
Profile Homepage #5
Pyro, your link doesn't work! :( :D :P

--------------------
-ben4808

For those who love to spam:
CSM Forums
RIFQ
Posts: 3360 | Registered: Friday, June 25 2004 07:00
Law Bringer
Member # 2984
Profile Homepage #6
Don't worry Ben, I'm sure you can google for it if you really really want to get infected.

--------------------
The Encyclopaedia Ermariana <-- Now a Wiki!
"Polaris leers down from the black vault, winking hideously like an insane watching eye which strives to convey some strange message, yet recalls nothing save that it once had a message to convey." --- HP Lovecraft.
"I single Aran out due to his nasty temperment, and his superior intellect." --- SupaNik
Posts: 8752 | Registered: Wednesday, May 14 2003 07:00
Infiltrator
Member # 154
Profile #7
People stupid enough to click on links to .pif files deserve what they get.

Windows Shortcuts, people. They could easily be links to format c: or whatever.

--------------------
Inconsistently backward.
SWOH. IM, PATF, ND.
Posts: 612 | Registered: Saturday, October 13 2001 07:00
Law Bringer
Member # 2984
Profile Homepage #8
That's a type of virus that exploits no faults in Internet Explorer or Windows, but the weakness in any system: Idiocy.

I guess it makes use of people confusing .pif with .tif endings and expecting an image instead of a program. Many don't even know what a .pif file is.

--------------------
The Encyclopaedia Ermariana <-- Now a Wiki!
"Polaris leers down from the black vault, winking hideously like an insane watching eye which strives to convey some strange message, yet recalls nothing save that it once had a message to convey." --- HP Lovecraft.
"I single Aran out due to his nasty temperment, and his superior intellect." --- SupaNik
Posts: 8752 | Registered: Wednesday, May 14 2003 07:00
Off With Their Heads
Member # 4045
Profile Homepage #9
I admit I had to google it and read this page, since I'd never heard of it before.

That kind of makes sense, since I'm on a Mac, and I guess pif files don't do anything on a Mac.

--------------------
Arancaytar: Every time you ask people to compare TM and Kel, you endanger the poor, fluffy kittens.

Kelandon's Pink and Pretty Page!!: the authorized location for all things by me
The Archive of all released BoE scenarios ever
Posts: 7968 | Registered: Saturday, February 28 2004 08:00
Shaper
Member # 247
Profile Homepage #10
No they certainly don't :)

--------------------
I stop rubber at 160km/h, five times a week.
CANUCKS
RESPEK!
My Style
The Knight Between Posts.
Posts: 2395 | Registered: Friday, November 2 2001 08:00
Shock Trooper
Member # 3719
Profile Homepage #11
quote:
Originally written by Thuryl:

That is because "[some domain name]" is not a legitimate domain name. :P
Or because it's a Windows virus...

--------------------
Scandalous Stories, fishing,and great photos
Posts: 294 | Registered: Monday, November 24 2003 08:00
...b10010b...
Member # 869
Profile Homepage #12
Well, it depends on whether you tried to click the link in this thread or in the actual virus email. If you clicked the link in this thread, it won't do anything regardless of your operating system, for the reason I mentioned above. :P

--------------------
My BoE Page
Bandwagons are fun!
Roots
Hunted!
Posts: 9973 | Registered: Saturday, March 30 2002 08:00