Intrusion.Win.Messenger.exploit Keeps Attacking My PC

[zacaroo 0]

Ok guys I would really appreciate some help on this so please try to help. Ok a thing called Intrusion.Win.Messenger.exploit keeps attempting to hack into my computer. My kaspersky anti virus has stopped it over 200 times in 3 days. Every time they attempt to hack in the start of the ip address is 65 but the last lots of numbers keep on changing can someone please tell me what this bloody thing is and help me by telling me how to get rid of it thanks alot guys, zacaroo.

[twitch 0]

You can't get rid of attacks, and it seems to be automated, so it will stop on it's own accord sometime. When, I don't know though.You are best downloading ZoneLabs ZoneAlarm. It has helped me in times like this and it should help you. I prefer not to have every part of my computers defense under one software developer, for example I have McAfee VirusScan, but I have a differen Spyware sweeper and firewall to McAfee products.As for your problem, it is directly linked to windows messenger (stating the obvious), so I would suggest installing MSN messenger. Windows Messenger is very nasty to remove, so it is best downloading the latest MSN 7.5.--mik

[zacaroo 0]

thanks for that...i have msn messenger 7.5 already windows messenger is built into my internet explorer and i cant get rid of it...i have a firewall, pest patrol, spy bot search and destroy, kaspersky anti virus and anti spyware and firewall, it hasnt got in yet but this problem is p!$$!ng my dad off and i decided to post here becuase i thought you guys would know some more info on it....i know it is attacking because kaspersky has an auto matd thing that pops up when something trys to attack and is succecfully blocked....why would it only be attacking my pc and why would it keep trying if it cannot enter my system???thanks in advance, zacaroo

[miCRoSCoPiC^eaRthLinG 0]

thanks for that...i have msn messenger 7.5 already windows messenger is built into my internet explorer and i cant get rid of it...i have a firewall, pest patrol, spy bot search and destroy, kaspersky anti virus and anti spyware and firewall, it hasnt got in yet but this problem is p!$$!ng my dad off and i decided to post here becuase i thought you guys would know some more info on it....i know it is attacking because kaspersky has an auto matd thing that pops up when something trys to attack and is succecfully blocked....why would it only be attacking my pc and why would it keep trying if it cannot enter my system???
thanks in advance, zacaroo

See - most likely the worm is on another infected computer on the same network as your ISP. It might not be making you the SOLE TARGET. Quite possible that after a prefixed interval it simply tries to broadcast itself to all systems on that network - that's how these worms spread. Any relatively insecure system will let it pass through and infect itself. At least you've got your tools informing you about the blockage - definitely a good point rather than a hindrance - tells you whatever it was was successfully stopped from infecting you. Anyway, I'll post back if I can find more info on this.

Try and explain to your dad that it's rather good that you're being informed - that means the security tools are effective. Wouldn't you prefer that to some weakly designed tool that silently lets these worms slip by ? Besides, these popups can help you trace down the source - if it's some infected system on your ISP network, you can easily inform your ISP to take some action. I've done it quite a few times.

[zacaroo 0]

ok thanks alot mate, oh and do you know how i could contact my isp about this?

Edited March 1, 2006 by zacaroo (see edit history)

[miCRoSCoPiC^eaRthLinG 0]

ok thanks alot mate, oh and do you know how i could contact my isp about this?

Start taking notes. See which all IP are trying to attack you - note down the message that your AV shows too. Make a list of 10-12 such attacks and send the list to the support division of your ISP. You should be able to find their contact email under some Contact Us or Report Abuse link on your ISPs homepage. That's how it generally works out. Any further problem, feel free to drop a line.

[zacaroo 0]

thanks so much guys i am greatful for this help this site is truly great

[Reaver 0]

Zacaroo another point to maybe calm your dad as i know the popups wether they are from your security programs or just virii can be annoying anyways, so if your mcafee has silent alert on it which many security programs do these days then you can activate that while your dad uses the pc and it logs all the attempts so u dont lose the info that you can pass on the the isp and at the same time cut down on the alerts that you computer receives, also note that this method when available does not restrict or hinder the security process in any way or by any means it is mainly used by administrators or on public computers where the admin either doesnt want the users to know a security systems is running or for the obvious benefits of having less pop ups and all it takes on your part is to read the logs at the end of the day,Good Luck.

[zacaroo 0]

i wrote down 5 ips then it has stopped attcking thanks guys

[zacaroo 0]

Ok sorry for double posting....it has re-started attacking my computer i hyave like 30 ips written down and am going to try and tell optus broadband about my problem today. Ok now i have a new problem, a new thing trying to hack my system, the name of it is Intrusion.Win.MYSSQL.worm.Helkern . Ok we have had helkern try to get in by itself before but kaspersky stops it in its tracks every time, now the concern with this new one is that it says .worm in it and worms are very dangerous, does anyone know why i have a new thing trying to attack??? and should i do the same thing about with the other one??Help is appreciated ,thanks,zacaroo.

[joeeeeeee 0]

i have the same problem, and same range of IPs as well. wonder if MS will fix this exploit with an update?

[vizskywalker 0]

Couple of questions, first, what version of windows, and second, do you have any service packs installed. I know that Windows XP had a large bunch of Messenger cracks found early on which SP1 fixed, and so did SP2, in which messages which were essentially advertisements, usually for registry editors and things kept popping up on computers. This sounds like a similar issue. so make sure you have the most up to date service packs for your windows version.~Viz

[cherri 0]

Try one of theseOption 1:Uninstall Windows messenger.it's that simpleOR option 2:Update mindows messengerOr 3:Block all IP addy's that have affected you or cane.g.123.123.123.1 attacks you then123.123.123.56 attacks you then123.123.123.36 attacks youso.. block all Ip addys from123.123.123.1to 123.123.123.999but replace 123.123.123 to that number that is attacking you

Edited April 21, 2006 by cherri (see edit history)