skandy32 Posted August 22, 2005 Report Share Posted August 22, 2005 i expect this has already come up at some point, but i scrolled through a few searches and found nothing..... everytime someone logs on whilst i am, it sends them this "have they blocked you too? download free msn block checker here" crap from me, but i dont see it it seems that all my friends now have it too, and i've seen it in some TF people too.... how did i get it?( im guessing 'cos i clicked on the link) how do i delete it? help? tar andy (Y) Quote Link to comment Share on other sites More sharing options...
Siders77 Posted August 22, 2005 Report Share Posted August 22, 2005 (edited) LOADS of people on my contact list have it. I didn't click it because I read about it a few weeks ago. I'll dig out the post for you. :lol: Have you done a Spyware/Adaware/Virus check? If not do all of those now. :) EDIT: Yeah, you did get it from clicking the link. :angry: EDIT 2: There's a thread here it doesn't give much info though. (Y) EDIT 3: Just searched Google and found out how people got rid of it. here Hope it helps. B) Edited August 22, 2005 by Siders77 Quote Link to comment Share on other sites More sharing options...
crazy_gap girl Posted August 22, 2005 Report Share Posted August 22, 2005 (edited) to get rid of it.. go on to the site you got it from.(i.e the link). and go to term and conditions.. and iv forgotten where on the page but there a link for you to click which you have to download some more software to uninstal it and then the actual uninstall software you've got to go though aload of procedures to get it fully out of your pc.. due t some part of the original software must put its files basically every where, where you don't think of looking.. if you go to your control panel and delete it that way it doesn't hope that helps seen as iv had to find out too (Y) to any of you who are thinking of getting it DONT its bollox! if someones blocked you FINE! lol B) :) Edited August 22, 2005 by crazy_gap girl Quote Link to comment Share on other sites More sharing options...
skandy32 Posted August 22, 2005 Author Report Share Posted August 22, 2005 i couldn't find much on its own website about unistallation stuff, but i did just run loadsa spyware removally type programs and it has picked up a lot of msn related crap (which hopefully is this bug!) trouble is, i can't tell if it has gone, no-one is online, to tell me! ha ha cheers for the help dudes and dudesses! Quote Link to comment Share on other sites More sharing options...
Punkrider Posted August 22, 2005 Report Share Posted August 22, 2005 This can be categorized as "virus", or at least a very dodgy program POST /version.html HTTP/1.1 Content-Type: application/x-www-form-urlencoded Accept-Language: en-us Content-Length: 0 Accept: */* User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: www.block-checker.com Connection: Keep-Alive HTTP/1.1 200 OK Date: Wed, 17 Aug 2005 15:51:18 GMT Server: Apache Last-Modified: Fri, 12 Aug 2005 00:00:51 GMT ETag: "190107-b-34f0d2c0" Accept-Ranges: bytes Content-Length: 11 Content-Type: text/html Age: 1 Connection: close version 1.0 If you enter an address and click check all it does is contact http://blockstatus.com/msn/stchecker with the appropriate POST variables filled in. Effectively ripping off their service. Installs these files in C:\Program Files\Block Checker 08/11/2005 04:50 PM 720,896 Block Checker.exe 08/10/2005 07:46 PM 49,152 block-checker.exe 08/10/2005 07:45 PM 28,672 csrss.exe 08/17/2005 05:51 PM 2,037 setup.log 08/11/2005 04:16 PM 16,384 setup_finish.exe 10/18/2003 05:58 PM 64,512 uninstall.exe 6 File(s) 881,653 bytes "Block Checker.exe" is the one which is the block checker, the others run in the background: csrss.exe and block-checker.exe are executed at the end of installation. csrss.exe is the name of a critical Windows process, obviously why the file was named that. setup_finish.exe (coded in VB) is the file which is executed at the end of installation and it executes csrss.exe and block-checker.exe. It also seems to attempt to delete "system.exe". csrss.exe is written in VB too, and its purpose is simply to constantly scan the process list and make sure block-checker.exe is there. If it isn't, it will restart the exe. And of course our lovely block-checker.exe's reason for running is to search for Yahoo, MSN and AIM conversation windows it can send the following messages to: "Hey you can see who's blocking you on MSN! Download it now *sitelink*" "Did you know you can find out who blocked you on MSN? Check it out, it's free *sitelink*" "I know who's blocking me on MSN because I use *sitelink*" "Did they block you too? Download a free MSN Block Checker *sitelink*" "Find out who's blocking you on MSN, Download it free from *sitelink*" "Find out who's blocking you on Yahoo, Download it free from *sitelink*" "Did you know you can find out who blocked you on Yahoo? Check it out, it's free *sitelink*" "I know who's blocking me on Yahoo because I use *sitelink*" "Did they block you too? Download a free Yahoo Block Checker *sitelink*" "Hey you can see who's blocking you on MSN! Download it now *sitelink*" "Find out who's blocking you on AIM, Download it free from *sitelink*" "Did you know you can find out who blocked you on AIM? Check it out, it's free *sitelink*" "I know who's blocking me on AIM because I use *sitelink*" "Did they block you too? Download a free AIM Block Checker *sitelink*" "Hey you can see who's blocking you on AIM! Download it now *sitelink*" The code has evidence that it also searches the process list for csrss.exe to keep it running, but I think their plan backfired as it will always find the legitimate Windows csrss.exe file. To send messages to MSN Messenger conversation windows it searches for windows containing " - Conversation" and uses sendkeys to send the message. It creates files "exclusion_AOL.ini", "exclusion_MSN.ini" and "exclusion_Yahoo.ini" in the system directory which look like they include the people the message has already been sent to, in order not to resend it to anyone... It adds itself to startup,of course, under HKLM with the name "block-checker" pointing to C:\Program Files\Block Checker\block-checker.exe. This is a new virus, an antivirus can't detect what it doesn't know about Quote Link to comment Share on other sites More sharing options...
crazy_gap girl Posted August 22, 2005 Report Share Posted August 22, 2005 to get rid of it.. go on to the site you got it from.(i.e the link). and go to term and conditions.. and iv forgotten where on the page but there a link for you to click which you have to download some more software to uninstal it and then the actual uninstall software you've got to go though aload of procedures to get it fully out of your pc.. due t some part of the original software must put its files basically every where, where you don't think of looking.. if you go to your control panel and delete it that way it doesn't hope that helps seen as iv had to find out too :blink: to any of you who are thinking of getting it DONT its bollox! if someones blocked you FINE! lol ;) :- ← My mistake go to "help" at the bottom but heres the link: http://www.block-checker.com/remove.php read the "read me" other wise your going to be clueless of how to use it! Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.