MSN messenger horror

[alihamilton]

Has this happened to anyone else? Today a friend messaged me in MSN Messenger to check out a link which had my email at the end of the string. I clicked on it and immediately, Microsoft Anti Spyware kicked in as well as Spyguard to tell me a bunch of Adware and Trojans were trying to install. I requested removal of all, which took awhile, then did a full system scan and a reboot. On the first reboot, everything was basically OK but on the following reboot, it all tried to reinstall again! I am now scanning again, will do a Spybot and Destroy and then was thinking it might be a good idea to do a System Restore to yesterday, when everything was OK. Any other ideas please and also to warn others. I have never seen this before.

Forgot to mention, had to call the friend who then told me she never did message me!!

[DMR]

1. Scan with SpyBot and also Ad Aware; have them fix everything they find.

2. You can try a System Restore, but although that may remove the effects of the nasties, the actual malicious files will probably still be left on your system.

3. If the problem persists after the SpyBot and Ad Aware scans:

Download HijackThis:

http://www.majorgeeks.com/download3155.html

Once downloaded:

Create a folder outside of any Temp/Temporary folders for HJT and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if HijackThis (and other data that you care about) is living in those Temp folders, it will be erased along with everything else!
Temp/Temporary folders are just that- Temporary. They are not meant for permanent storage, as their contents are often delete in the course of troubleshooting, by running disk clean-up utilities, etc.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...". Save the log in the folder you created for HiajckThis, open the log in Windows Notepad, and cut-n-paste the entire contents of the log here.

[alihamilton]

Thanks....I had run the above antispyware programmes but the worms kept regenerating. When I turned off System Restore and ran them again and then turned System Restore back on, everything seems fine now.

[DMR]

When I turned off System Restore and ran them again and then turned System Restore back on, everything seems fine now.

Yes, turning off System Restore (as opposed to just going back to previous restore point) can flush infections from your system in some cases. There's a bit more info on the "why" of that here.