- This topic has 26 replies, 15 voices, and was last updated 17 years ago by
.
-
Posts
-
A lot, and I mean a lot of people are infected with Magic PS. Especially with Magic PS 1.5 Second Edition. If you don’t know what is Magic PS. Magic PS is a trojan, simply a program that steal your Yahoo! Messenger 5 or 6 user name and password to the sender. Magic PS 1.5 SE no longer show itself in the Message Archive, so checking there won’t help.
If the sender is stupid enough, he/she would sent you the file “sender.exe”, DO NOT accept it because it is the default name for a MPS created file.
Check your computer for certain files such as these:
regsvr.exe in c:Winnt or c:Windows ; depends on version of Windows
MsAgent32.exe in c:*Win installed folder*system 32
Perflib-Perfdata in c:*Win installed folder*System32
PIF in c:*Win installed folder*
NTMSJRLN in c:*Win installed folder*system32NtmsDataSender.exe
MPSmmtask0.exe in c:Documents settings*User Name*Local settingsTemp
The sender.exe (can be any name) file may also contain a text string “UPX-Scrambler RC1.x -> ©OnT®oL”. You can see this by using a hex editor, etc.
MPS 1.5 SE hides the (sender/hacker) Yahoo! ID in the sender.exe file, it is scrambled so even with a hex-editor, you still cannot view it. To reveal the (sender/hacker) Y! ID, simply reverse-engineer the sender.exe file.
Be warned that Magic PS 1.6 will be release in the near future. Keep an eye out on the file that whoever sent you, you’ll probably be safe.
Hope this helps everyone and understandable, because I’m so sleepy when I wrote this =P
thanks SS antihacker about the update, although it was released pretty much ago. but anyways. I figured out that webroot spysweeper does identify it in the scan and can help in deleting the trojan n securing ur computer. So i guess its a nice software, which works better than my norton av 2004.
Thank you SO MUCH SS_Antihacker for the information…especially about the upcoming release. Spybot was able to find the other versions…so let’s hope it will find these. STILL, your information on what files and WHERE to find them is very helpful.
=) Am I glad to be back with the NEW BBB. I have been very busy lately to help out anyone in here but hopefully I can squeeze in some extra time to help as much as I can. I’m also very glad my information are being appreciated. Thank you Neo & Oreo, as well as everyone else.
just wondering if anybody has any info how to remove Magic-PS v1.5 SE++ i have 2 friends that have been infected with this program. regedit is disable and task manager as well
Have you tried Spybot Search & Destroy? It worked on earlier versions and it is always worth a try. 🙂
Hi Yisdiren,
You can manually get into Safe Mode, and try to delete the files that I mentioned above. Please make sure that those file(s) is in the same location that I specified, DO NOT delete the file if it is located in another folder, especially if it is located under Windows. The reason for this is because the trojan/virus might take the same name as one of Windows system file(s) but just in a different folder. So make sure you delete the virus file, not the system file.
Second, try to see if you can run the registry and remove all the start up entries that have the trojan/virus filename.
The best and safest way is to support and buy an anti-virus and anti-spyware software. Norton Antivirus, PestPatrol…They both do detect and remove Magic PS 1.x. I haven’t tested Spybot and Ad-aware yet, but I don’t think they can remove Magic PS. Anyone tested this yet? if so please let me know =)
Hope this helps
@SS_AntiHacker]A lot, and I mean a lot of people are infected with Magic PS. Especially with Magic PS 1.5 Second Edition. If you don’t know what is Magic PS. Magic PS is a trojan, simply a program that steal your Yahoo! Messenger 5 or 6 user name and password to the sender. Magic PS 1.5 SE no longer show itself in the Message Archive, so checking there won’t help. If the sender is stupid enough, he/she would sent you the file “sender.exe”, DO NOT accept it because it is the default name for a MPS created file. Check your computer for certain files such as these: regsvr.exe in c:Winnt or c:Windows depends on version of Windows MsAgent32.exe in c:*Win installed folder*system 32 Perflib-Perfdata in c:*Win installed folder*System32 PIF in c:*Win installed folder* NTMSJRLN in c:*Win installed folder*system32NtmsData Sender.exe MPSmmtask0.exe in c:Documents settings*User Name*Local settingsTemp The sender.exe (can be any name) file may also contain a text string “UPX-Scrambler RC1.x -> ©OnT®oL”. You can see this by using a hex editor, etc. MPS 1.5 SE hides the (sender/hacker) Yahoo! ID in the sender.exe file, it is scrambled so even with a hex-editor, you still cannot view it. To reveal the (sender/hacker) Y! ID, simply reverse-engineer the sender.exe file. Be warned that Magic PS 1.6 will be release in the near future. Keep an eye out on the file that whoever sent you, you’ll probably be safe. Hope this helps everyone and understandable, because I’m so sleepy when I wrote this =P[/QUOTE wrote:
:post me:nguyenkhaihoan175@yahoo.com.
can you send to me a magic ps 1.5 se++, you can post me by:nguyenkhaihoan175@yahoo.com. thank a lot.
somebody post me a “magic ps 1.5 se++” @yahoo.com
PLEASE do post email addresses, simply wait for some one to post. If you are ASKING for Magic to use this is NOT the place for it. We DO NOT support hacking, viruses or trojans of any sort.
sir, thanx for giving such a valuable information, but still i m not able to remove this trojan, i shall be obliged if u send me a detailed topic on the subject, how it works and all this.
love & regards
pallviSS_AntiHacker wrote:A lot, and I mean a lot of people are infected with Magic PS. Especially with Magic PS 1.5 Second Edition. If you don’t know what is Magic PS. Magic PS is a trojan, simply a program that steal your Yahoo! Messenger 5 or 6 user name and password to the sender. Magic PS 1.5 SE no longer show itself in the Message Archive, so checking there won’t help.If the sender is stupid enough, he/she would sent you the file “sender.exe”, DO NOT accept it because it is the default name for a MPS created file.
Check your computer for certain files such as these:
regsvr.exe in c:Winnt or c:Windows ; depends on version of Windows
MsAgent32.exe in c:*Win installed folder*system 32
Perflib-Perfdata in c:*Win installed folder*System32
PIF in c:*Win installed folder*
NTMSJRLN in c:*Win installed folder*system32NtmsDataSender.exe
MPSmmtask0.exe in c:Documents settings*User Name*Local settingsTemp
The sender.exe (can be any name) file may also contain a text string “UPX-Scrambler RC1.x -> ©OnT®oL”. You can see this by using a hex editor, etc.
MPS 1.5 SE hides the (sender/hacker) Yahoo! ID in the sender.exe file, it is scrambled so even with a hex-editor, you still cannot view it. To reveal the (sender/hacker) Y! ID, simply reverse-engineer the sender.exe file.
Be warned that Magic PS 1.6 will be release in the near future. Keep an eye out on the file that whoever sent you, you’ll probably be safe.
Hope this helps everyone and understandable, because I’m so sleepy when I wrote this =P
- You must be logged in to reply to this topic.