Anyone know about a IM phishing/Trojan that ends in realdealzz.com?

Question

Just sitting happily chatting on Live! IM when up popped a url from a guy I hardly every chat with the URL was http:/(myIMname).realdealzz.com.

I didn't open it but checked the whois and it is a really new site advertising a very scammy ringtone business (the type that charge u every week or month for stuff u don't want).

Has any1 opened it? (I certianly don't suggest u do) and does it just copy ur address-book or is there a more serious kickback? :-(

Is there a good way of getting rid of these things once you have opened them (besides creating a new account)?

I hate them and I have lost a couple of really good IM pals because of one i opened a couple of months ago.

Answer 1

Most likely it really didnt come from your friend. Although it looked like it did, it was really a BOT. Read here abour realdealzz.

http://www.siteadvisor.com/sites/realdea...

Answer 2

I received one from a friend not online and a friend received one from me.  I reported it to MSN, they said if anyone goes to the site and puts in their ID and Password, they should change their Windows Live Password.

Answer 3

I just got the link sent to me, but luckily didn't click it. I came on here and decided to type it in. Seeing as it's a friends friend who added me I had no reason to trust them and thought I'd better check it out. Unfortunately though I think my friend did click it :l  

Answer 4

Well, to answer your question, 2 days ago, unfortunately I had a weak moment (being tired and sleepy) in "trust issues" and so I ended up clicking on the url. This opened up an advertising site and some moments later there was the normal looking msn popup which requested to refresh my sign in because apparently I was signed in also with another account, which was the case at that moment since I was performing some MS registrations for my boss.

So being even more "blonde", stupidy won again and I simply refreshed the sign in as requested. Nothing happened and I was not aware of the consequences which would follow up till this morning.

One of my collegues asked me why I sent him a URL and on top of that... in the middle of the night... while my machine wasn't even active, so I was not signed in at all.When he showed me the link "http:/(myIMname).realdealzz" I new it was very urgently time to change my password, since that "fishing b*****d" apparently stole it 2 days ago.

Only thing I can hope now is that there was no harm done using my account the last 2 days.

So my suggestion to all who reads this: don't open it please and definitely don't do the requested refresh of your sign in in case you did open it already. Otherwise: change passwords asap.