Two weeks ago, when I was doing my blogging thing, one of my friend sent me a message via MSN messenger. The message only contain a link. So I clicked the link, and a website opened and asked me to sign in using me MSN id. I thought this was one kind of community site which using MSN id to sign in, introduced by my friend. Didn’t want to let him down, I just sign in right away with my MSN id. I was signed in, and my MSN messenger signed out automatically. The site didn’t got my interest, so I just closed it and back to what I was doing. Then strange things happened.

There was couple of times my MSN messenger signed out by itself with the reason that the id had signed in somewhere else. I just clicked the note to sign back in again. Rob sent me message saying that he just received link from me, and he suspected that my computer is infected by virus. I run the virus scan right away, and the result was that my computer running normally.

And today, Ed asked me about the link that I sent to him which I didn’t. I explained to him, and he suggested me to change my password which that what I did soon after that. And Rob sent me a message that saying he received three messages already today from me, which he aware that I didn’t actually sent the messages. He sent me the link to let me know what I was facing. Here’s the explanation..

MSN Virus, is a password stealer. You will received message via MSN from one of your friend contain a link in form like this :

http://yourloginnick.picfriendz.com:81/

http://yourloginnick.friendsz.com

http://yourloginnick.thatyou.com

http://yourloginnick.imguser.com

or other domains are possible.

When you click on the link, you are asked to log in, looks like this :

That’s fake! If you received this type of message sent by MSN by one of your contact, don’t open or even worse don’t give your password away. If you already done that, just change your password.

The only purpose of this is stealing your password. The victim my experience disconnection from messenger along with message “You’re signed in elsewhere. Click here to sign in again.”

friendsz.com : IP address: 219.136.252.211
City (per outside source): Hong Kong, Hong Kong (Sar)

picfriendz.com : IP address: 121.54.173.87
City (per outside source): Beijing, Beijing

thatyou.com : IP address: 208.109.181.209
City (per outside source): New York, New York

Thank you to Maccabu for posting this and made me understand what I was facing. And thank’s to Rob for this link. I had changed my password, so I hope everything back to normal again.

Popularity: 9% [?]