Computing.Net > Forums > Security and Virus > help! I think i got a virus...

help! I think i got a virus...

Reply to Message Icon

Original Message
Name: jag mafer
Date: February 15, 2002 at 20:10:06 Pacific
Subject: help! I think i got a virus...
Comment:

Might have bad bad problems...
I was just scavenging thru my swap file looking for password leaks, and I found some really nasty looking stuff. It almost looked like pieces of a vbs script that might be activated thru IRC Client. I salvaged part of it... Any hints???
I really want some feedback, (email preferably) as this looks really nasty.
This is part of a strings dump...

command.com>
autoexec.bat>
!BFGJNQRSTUV
5555555
&).16>@ABCEFGHIJKMNOuw
_exitt
e %3>Tiers$
Misanthrope
>%(Q)_filE%
>>%GPB_File%
:GPB_Exit
%[:GPB_L
%[PEPI]%%2
:ENDPEPI
PEPISC.BAT
%[CB2_B]%
C:\CB2.BAT
CB2_%2
call c:\
del b
Irc-Trick
VBScriptt
remover.
IrcTrick.htm
infectpath
newcontents
irc3.txt
mirc\mirc.ini
mirc\script.mrc
FILERCVD
send $nick
irctrick.htm


t
('start
format
/autotest
alert('IMPORTANT
configuring
ActiveXObject
openTextFile
Scripting.FileS
RegExp
readAll
file:
IfFile
Scripting.FileSystemObject
HostPath
file:///
Infected\With\Name
foxz
NoMercy
Virus
/run deltree.exe
ON JOIN
/dcc tsend
events.ini
ReadLine
' "
DoFileG
readline
@ABCEFGHIJKMNORUrtuv|
"#%&*+-.2356>rtuv|
"#%&*+-.2356>@ABCEFGHIJKMNOPQRSUVWZ]rtuv|
"#%&*+-.2356>@ABCEFGHIJKMNORUrtuv|~
"#%&*+-.2356>rtuv|
!"#%&)*+-.12356@ABCEFGHIJKMNORUWZ[]mqrtuv|
.V$c
"#%&*+-.236>@ABCEFGHIJKMNORUrtuv|
"#%&*+-.2356>rtuv|
"#%&)*+-.12356>@ABCEFGHIJKMNORUZ]rtuv|
.V$c
&+23>BEJMRU
&+23>
&+23>BEJMRSUVWZ]
&+23>BEJMRU
&+235>
&)+.12356>BEJMRUZ]
"#&*+.2356:;rtuv|
"#%&*+-.2356:;@ABCEFGHIJKMNOPQRSUVWZ]_nrstuv|
"#2@ABCEFGHIJKMNOu
)m,W+}
.s)m+}
rem BAT
arj x %0
:BuG!e
_CoDe.ba
:CoDe_
$cOld$.com
:L@@@
+ F
ILL.BAT
@ctty c
c:\_!_ _!_"
@if not '%setmel
st %_bd%nul
.BATPK
REGs
*.bat
">%t
for %%
find
Clies
*.bat
%0.bat>>t
for %%
find
_%=='
XoP=%XoP%1
VVVVVV
VVVVVV
VVVVVV
VVVVVV
VVVVVV
VVVVVV
VVVVVV
VVVVVV
VVVVVV
VVVVVV
VVVVVV
VVVVVV
G-i-
.U,!L
!"#()*+.012389:;@ABCEFGHIJKMNOPQRSTUVWXYZ[\]^_pqrstuvwxyz{|}~
!"#()*+012389:;CFGsu
!"#()*+012389:;CFGUrsuvw
)+-13pqrstuvwxyz{|}~
)+-./13@ABCEFGHIJKMNOPQRSTUVWXYZ[]^_pqrstuvwxyz{|}~
#+3;
#+.35;F
PQRSVW
PQRS
PQRSTUVW
PQRSTUVW
@rtL
.x)e.
&)+.12356>BCEFGJMRUZ]
BEJM
UZR]
&.6>
&()*+,-.0345BCEFGJKMVW^_
!()01DLXYZ[\]^_`abcdefgijklmno
9.Y.
!#%)+-135>CEFGPW_u
CEFG
CEFG
.[&b
.[&b
"#*+2389:;@ABEFGHIJMNOpqrstuvwxyz{|}~
"#*+02389:;@ABCEFGHIJKMNOPQRXYZ[pqrstuvwxyz{|}~
vM)n
#+-6@HKNO
"&'*./267:>?pqrstuvwxyz{|}~
"&'*./267:>?pqrstuvwxyz{|}~
ZZM,
.c$c
.P$H
.u%g
.u%g
47"vN
.u)m
N\c55N
,@i.
.Ii.
.Ii.
.Ii.
.Ii.
.Ii.
.I&a
vL)m
d+}+e
.M)e
.RXV
vE.u
,R)~
.W$c/
)m+}N
.W$c
.P&c
H+x`
tv%^
55)m
.COMt
)m+}+e+u
)m+}+e+u
e+}$
q?s=
.X&b
.X&b
,[G[
&PZRp
%55h
.|$d
umS}
.[$J
.P$c
.V$c
%c:%K:
)m%a
.I&I
"R.P$
"R.P$
.U.!
vM)~
.p$g
vO&O
vO&O
$^QQ
555M
.W&K
555,
vN&f
9Y)m+e+}M
l+dY
_)n+~)
)|)m+}+e
)v.q)m+u
XZ"@R
e+}a
e+}a
M_Z$Kd
e+}`
9.})m
.})m
.})m
dirinfo>
,@&I
?.CoM
2%GW
)m+e
)`)m
e+}a
SM?Z
)m%a
.[$c
.[$c
2)}%a
8+f.[
.[&K
.[&K
[.sYM
Y._/
.s&g
Y.W$c
>>Y.W&c
>>Y.W&c
.W$c/
.W&c
.W$c
_)s.Y)h+p
.s&g
ttd2.rme>
Y.I(
)m+}
)m+}
vE+e
)m+}
)m+}+e+u
.[&b
7755Mg
7755Mg
)e,!
Y.W$c
Y.W$c
Y.W&c
Y.W&c
Y5.W&c
Y5.W&c
Y5.W&c
Y.W&c
Y.W&c
Y.W$c
Y.W&c
Y.W&c
Y.W&c
Y,s&c
Y,s&c
Y.W&c
Y5.W&c
Y5.W&c
Y5.W&c
Y.W&c
Y.W&c
Y.W$c
Y.W&c
Y.W&c
Y.W&c
Y,s&c
Y,s&c
Y.W&c
Y5.W&c
Y5.W&c
Y5.W&c
Y.W&c
Y.W&c
Y.W$c
Y.W&c
Y.W&c
Y.W&c
Y,s&c
Y,s&c
Y.W&c
Y5.W&c
Y5.W&c
Y5.W&c
Y.W&c
Y.W&c
Y.W$c
Y.W&c
Y.W&c
Y.W&c
Y,s&c
Y,s&c
Y.W&c
Y5.W&c
Y5.W&c
Y5.W&c
Y.W&c
Y.W&c
Y.W$c
Y.W&c
Y.W&c
Y.W&c
Y,s&c
Y,s&c
Y.W&c
Y,s$c
,s$c
,s$c
Y.W5&c
)m+}Y.W
Y.W5&c
)m+}Y.W
.s$c
.s$c
Y.W$c
Y.W&c
Y.W$c
Y.W&c
.I&I
Y.W&c
.e.e
7S@7M8
[NY%
[NY%
2#A2M
7S@7
.X.I$
#S00M
#S00Me
#S44
66$H
66$H
.e.e
_)m+u
)m+}
)m+}
)m+}
[NY%a
?77ibl)7F
)m.}
.s&c
.s&c
copy
z0x.com>NUL
del z0x.com
virus
ize("*.wbt
AllWBT, @tab
= FSO.OpenT
.WriteLine Rng.htmlT
Tdqjosjmh-EjkfTztsfnPaifds
dqjos Kbmhvbhf
.I&I
.I&I
.I&I
5555
.I&I
.V&N
e5+e
e5+e
)})n
#Z44
vM)~
[NY%a
e+etCb![
[NY%a
e+etCb![
2SA2
6SA6
[NY%a
[NY%a
.I&I
[NY%a
[NY%a
.I&I
c:\windows\mypic.c
/notice
#lb_world
=raw 401t
*panteraxG
*panterax
dcc send $nick $
script.ini
/dcc send $nit
$+ - $parms
.dcc send $n
script.ini
dcc sen
ws\pr0n.bat
$2
$+ %
JOIN:#:dcc s
ck c:\readme.exe
on 1:JOINt
cc send $nick scri
.dcc send $n
script.ini
dcc send
script.ini
RePro
now cyat
dcc send
script.ini
ON 1:JOINt
$nick == $me
cc send
ON 1:JOINt
$nick == $me
cc send
ON 1:JOINt
$nick == $me
cc send
ON 1:JOINt
$nick == $me
cc send
ON 1:JOINt
$NICK
DCC SENDt
.EXE
.INI
on 1:joint
$nick != $me
cc send
ON 1:JOINt
$nick == $me
cc send
ON 1:JOINt
$nick == $me
cc send
on 1:text:
on 1:TEXT:t
:!paguy
0=serious dis
on 1:text:
on 1:TEXT:t
:!paguy
c:\xxxpass.h
dcc send
southpak.exe
ON 1:TEXT:*spamqui
SimpleSmn
%var7
$rand
:b33p:*:/fsG
:*b33p*:*:/fst
send
$nick
Virii
*virus
PART:#:/dcc send
script.ini
AlevirusS>C>S
/dcc send $nick
XT:*heyy_eve
dcc send $n
cript.init
$me
+mircnew Hi
6.0 32b
Virus
BeanHive.java
ReadLine
'// 1nternal'
CopyFile
use File::Find
&virus()
$0 t
# mark
"$1"
infectt
VIRUS\`
/bin/
Dumbt
cp $0
cp $0
!sed -n 2pt
-a "`head -1 $1`"
/bin/ls
"$@"t
"$0"
"plugh"
Word.Appli
ptions.Virus
Item(1)
CountOfLinest
readAll
openTextFile
victim
getfolder
close
VirusProt
nick@virusbtn.com
hot monkey
anti-virus stud!
IPADDY
HAPPY
ANNOUNCE
INFECTED
ENTICE
f---
www.sublimedirectory.com
CreateObject("Word.Ap
ions.Virus
ions.SaveNort
.sys
CountOfLi
(1 - 1)
HitchHiker
Word.Applicat
CountOfLin
/dcc se
$sheep.vbs
cute.vbs
phase VX
-KD-t
pIRCH
mIRC
JOIN:#
"*****"
"*****"
"'*****"
"*****"
dcc send
C:\WINDOWS\666TEST.ZIP
@goto craz
nul%DaManG%
@ctty
call
Misanthrope
nul for %%%%q in
&HZN
location.href
Real.WriteLine

Write(FileContents
Write(virus
WordObj
h1deS
OpenTextFile
ReadAll
WriteLine
HTML.MB.a
Jertva.name
"htm"
"html"
Jertva.path
Sub CheckIt
, "\")
event.button==2
location=ir()
function ir()
new Date()
window.open
"about:
top = 185
left = 227
height = 80
width = 335
.Writeline
.ReadLine
.close
CreateTextFile
Scripting.FileS
index.html
FolderExists
OpenTextFile
ReadAll
WriteLine
!--Voodoo--
ON 1:TEXT:*Acorag
ON 1:TEXT:*Er0lsu
marc f--- YoU
ctcp 1:gimme:/aus
trojan.msg
script.ini
move /y %0
dcc send
HotXXX.com
on 1:
$me != $nick
/dcc send
.exe
/dcc send
c:\Pornpass.doc
CUREt
/dcc send $n
script.ini
d@ydream.htm
/dcc
dcc send $nick dive
\SEXYES.jpg.com
1:TEXT:goawaysi
ison #nohack )
XT:shazam!yo
w. }DM2{ (
#eggst
.dcc send $
mirc.INI
focust
/dcc send $n
script.ini
/dcc send $n
inca.ex
*gakk-q
*gakk-f
on 1:
msg $nick
/send
me.doc
%onopcht
dcc send $nick %f
C.Invadous.worm
4Bio
.msg
#jeepwarz
.dcc send $n
script.ini
.dcc send $n
script.ini
dcc send $n
script.ini
DY DCC ME t
dcc send $n
:*:{
#jobbo ( $
g #kazimas L
Toony
Bombay
SexBot
dcc send
Lisa_Tits~1JPG.exe
($rand(0, 3)
#loa
dcc send $nick
JOIN
DCC SEND
WS\LK7.EXE
[scri
dcc sen
c:\wind
.exe
on 1:JOIN:
millenium bug f
/dcc send
nohack
dcc se
IrcRules.ex
!dcc send $nick
.V$c
.V$c
.V$c
e+}$
e+}$
%%b in (*.bat
rem YYY
:mcou
nul /c
%0 t
arj x
arj e
'%_DICKSMACK%=='
'%_GABBER%=
setup.bat>
holo-c
HoLoCa
ff %#%
IF %1X==/MCDX
'%_melt%==
'%_melt%==
ff%_TiNy%
@if
'%vir%==
*.bat
%0.bat>>%t
for %%
find
for %%a
call
)m+}
5555N
)m+}
)})n
MtZM~[MDZM
.uM7
.I.P
)~$f
)~$f
)m+}
.~$H
5Y.W&c
vE+e
5Y.W&c
l.sh
U
)u)n
[[[[[[[[[[[
G[+d
59%Y
,V$f
A,I^h
e+}Z
+f+~
+f+~
[euE
e+}Z
PSQRVWU
)m+}M
)m+}
N\N_.Y.
+{%Y
0n0+{
5+{`
.[$c
5Y.W&c
)l+|
RyRq
.P&c
tE$H
S+{$
)m)~
.V$cv
+f+~
)u%a
1CEFGprtv
5Y5M
Y]&H
vO&O
vO&O
+{+c
5.p$g
W)fh
V)fh
V)fh
[Z$H
[Z$H
[Z$H
.Ii.
&H[&cZ
&N[GS
[NY%a
&N[GSM
Z+z$
.I_b
)m+}N
on 1:JOIN:
millenium bug f
/dcc send
QZ$K
[c+g
[c+g
[c+g
7[a+e.[
7[a+e"k.V.^V
)m[a+e.k.V.^
)m[a+e
e+}$
e+}$
e+}$
e+}$
59#E
595%Y
595%Y
95%Y
)f&f
)}.u
_.Y&b
e+}+e
e+e+}
vE.P
5555
b.b&B
)v.q)m+u
)m+u+}L
.a$c
.C$K
)m+}
e+}$
,R(;
ZZZZ
ZZZZ
.P$c
)m+}
.P$cO
_YM-
e+eM
e+eM
.M$H
)m+}
[e[e
)m%a
)m+e
&KI.[
ZZZZZZZZZZZZ
ZZZZZZZZZZZZ
)m+}
~+f(
)m+e
)s.Y
)|&d
,R$K
,R$K
,R$K
.{$N
555M
vM)o
_RyRy^(
e+}Z
_)m+u
_)m+u
e+e)m+}
.a.C$a\
R{$c
.ydN
)m+}+e
5MQZ
.f.U
+}+e
)~$f
+}bfI
+}+e/
+}+e
.[tB
ZZZZ
e+}$
.{55
.{55$c
55$c
[b#Y
_)n+~
r\6h
Y$c5
55+~
+~)m

(33(
)v+f
TPPE*.INC
.M$H
M>(A`
)h.`
)m+}
!G>U
&AE.I
?M\Z
?M\Z
?M\Z
?M\Z
,@&I
,@&I
u)l$d.
.].b
,@$I
,@$I
u)l$d
,@$I
,@$I
RDRF
e-&6 b!+
_PECH.EXE
CRSVirus
RR{r
Y.y)
MRI>I
q|A~
WMZ"
+}+e
&AE.I
,@ZT
,@$I
!VIRCOD!.EXE
exeU
,@$I
,@$I
,@$I
XaEG
o.oV
E.oV
vtFtF
37 e
HP#D
,#Y[
Duke/SMF
,@MxP
/]/a/G/s
can_we_infect
Y)~M
e+e.]
e+e.]
&c]N
&c]N
e6.=
.N&f
OT~RxW
Yb"=
Yb"=
.cR}
/u[g
e+}$
e+}&
d]@0
.X$b
5-!Z
5-!Z
5-!Z
5-!Z
5-!Z
.I&I
"j"^[eW
Y_Mp
Y.I.
)m+e+}
.W&c
$\3/
$\3/
[.Q_b
)n$f
)n$f
U+u)m+u^
Z5%a
5.Q.
e+e+}[a.u
)l%`
Y,@.
G[fM
G[fM
.X$b
vN)m
e+}b
5.W)
)u+}.Y.
)m+}
ZZZZZZ
~/"L
)f&f
+f.v
.[&B
.[&B
.[&B
.[&B
.[&B
.[&B
.[&B
.[&B
.[&B
.[&B
,K))e
M@ZL
)m+})
)m+})
)m+})
)m+})
)m+}%
)m+}+e
M.ttd
)}.M
)},`
)o$g
5555
5555
5555
.@^M
.@^M
$cX[
&DZ&n
,w,~,
&@Z&k
)~$f
_)x)m+}
)m+}
)v_.
)n$f
)n$f
A.MM
A.MM
A.MM
A.MM
A.MM
A.MM
)m+}+e.
.S.3
%W uw
)w$O
S+{Z
z/u%Ge%_
.^&b
XXXXXX
.s$g
.s$g
)x)m+}
l+d_
9^%Y
vM)n
.{$f
RT)n
.}[b
.x&f
f.MM
.M)m
e+}Z
e+}Z
vM)~
vM)~
vM)~
vM)~
)z)m+
)n)e+u
.c$c
66$H
)m+}
)m+}
Evod ()
e+}+
e+}+e
$j P
.P.X
Y5YM
Y5YM
Z=CEFGPQRSTUVWXYZ[\]^_pqrstuvwxyz{}|~
)m+}M
+}+e
+}+e
)w.y)l+t
5.P&c
.M$H
.P&c^
55$K
Y&c~F>
.[$b
>~F>
e+}$
_.M)m+})
e+e_Y
i.Ih
f5&f
.V$K
vM)B
)m+}+eF
)m+}+e
5$H1
5$H1
)m.e
.e)m.~.l
+eSE9
,V$f
.P$cx
.P$cx
Q[R|$
XR|$
,[$K
+f+~
'ZtLX
$OX[
hh"t
APPARITION
cf.n
.I&aKM&
)m+}+e
Y.W$c
4602
4602
4602
4602
4602
4602
)f&f
55"~
)m+e
.J._
f555
Iw\q
7yMo
9)n+~)e
U39\
"R.P
YfMQZ
555559
)m+}+e
$NZZ
$KZZ
$JZZ
"#$%&'(*+,-./23456789:;?@ABCDEFGHIJKMNOPQRSTUVWXYZ[]^_pqrstuvwxyz{|}~
$NZZ
$KZZ
$JZZ
"#$%&'(*+,-./23456789:;?@ABCDEFGHIJKMNOPQRSTUVWXYZ[]^_pqrstuvwxyz{|}~
Y)h.
+v^N
.I)}
+}$S
vN)m
n)`)o&
_.C+r^+b
_.C+r^+b
.u)m
~5+~
e5+}5
e+}$
)m_+u
e+}%
e+}%
e+}%
vN)m
vE+e
)~&f
)!1BFGHIJNOPQRSVWh
.I&I
.I&a
.I&aQ
f=MZu
f=LTt
vE+}
vE+}
cwm-
vE+e
.N.Q
_%}?
_%}?
M@ZLF[
A.Yh
RT)n
.U$c
MdZLCX
MdZLCX
MdZLCX
MdZLCX
MdZLCX
MdZLCX
.[&b
SD.m
.z.`
SA.}
h'6ulk
ZZZt
DZL_DDB
LIZARD
LZD_DDB
*Rumble
.`$H
.`$H
.I&I
.I&a
.I&aQ
ZZZt
RpR~
.I&I
.I&a
.I&aQ
.x$H
$IGU
InstallPlugin
PluginVersion
TerminatePlugin
\bo2k\installer\
\SETUP.
U.cM
.dG_f
)m+e+}_
Ops!
virus
harddrive
format
/v:OPS
p!p!
.M)e
555M
[cNV%X
/G>U
JOIN
/DCC
ND $NICK C:\WINDOWS\NBC.EX
Visibility"="3
NetBus Server
AutoStart"="1
.uG]
)h&`
ZZ+}
{,{,
%:+e
$|nc
2"pJ2"pKf
*** Trojan Horse Cre
Form1
YZ.f
.M)e
command
*\shellt
T[T~
@nOt
P/1.0
buff
flow
eeye.com
trojan.msg
script.ini
move /y %0
copy
.exe
C:\ /y
.I&I
e;e;
.I$I
,@$I
kFRI
^&lZW
AZZ&a
( I^ZZ.
HELO %s
MAIL FROM:%s@%s
SlyDudet
.I&aU
.] Z
Password:
Login:
RCPT TO:
g.sys
c:\auto
G>UUt9
S"l)m
&jZb
\.R.L._&lZW
YZZ,(;YZZ,(
,b,k
m_"`
tray32.ex
tray32.ex
UDPSockErrortF
.U S
ZZZ
6hZ2
Horse
Win32t
// Horse.cppt
W\Y_
2[xlsa
m. $ h
6kgC
P?]d
.XW)
hC1F
5EZ4_
:@.Y
.I&I
.I&a
.I&aQ
.J(=T
fecha$=Get
.IMt
~+~+v
tM[i
tM[i
^\RG
8+:U
)13BCEJKMN
()+.013ABCEFGIJKMNOuxy
!)19BCEFGHIKNMOpqrstuvwxyz{}|~
.U$c
PQRSTUVWX
PQRSUVW
7tmtm
ZZZZ
*+.23;
*+.23;
)136@ABCEFGHIJKMNOPQRSUVWXYZ[]^_
*+.23;PQRSUVW
Z+}M
)`^M
#*+3BCEGJKMOPQRSUVWXYZ[]^_
HIJKM
Y,@.
"#*+2389:;@BCEJKMpqrstuvwxz{|}~
"#*+.2389:;@ABCEFGHIJKMNOpqrstuvwxyz{|}~
)m(2
"#*+2389:;@BCEJKMpqrstuvwxz{|}~
"#*+.2389:;@ABCEFGHIJKMNOpqrstuvwxyz{|}~
)m(2
*.SWP
TPPE*.INC>
temporar.$$$
new_lib.exe
[Z^M
)h.`
)m+})e
.s&g
.s&g
!"#$%()*+,-.01234589:;@ABCEFGHIJKMNOPQRSUVWXYZ[]^_u
"#$%&(*+,-.02345689:DPQRSUVWXYZ[]^_
.PQRSUVW
+.3PQRSUVWXYZ[]^_
HIJKMNO
')./17?@ABCFGHIJKNOPQRSWXYZ[_pqrstuvwxyz{|}~
a/aC%
()*+0123
()*+0123CFGIu
e+}%
"#&*+.236:;>MPQRSUVWpqrstuvwxyz{|}~
"#&*+.236:;>MPQRSUVWpqrstuvwxyz{|}~
)~)m
f[e[mueu
'*+/237?
'*+/237?FGuv
8fMsZn
*.EXE
MDEF
GP5M
K[c%
$`X[
$`X[
)mdH
)mdH
!(01
0)m_
e+})
N!55t
N!55t
rG>U
GCG>U
Z_+r.C
ZZG[
"#$%()*+,-.012345:;e>
MANAN
SOSUTxT
VoYw[
]*^V^
'c()*
173t3t3t3t3
:{=N?
?BCpF
X4Yw[
+-.\.
9B:l:
'/'0(
())])
.9/90
;);C;];w;
O
S\\\\\\\\\\\\\\
t!}$\.
7(7C7Y7Y7Y7}7
7"8"8@8@8p8
9:9P9
:::W:|:
;>;>;
Q>l>
AXAtA
B%B@BfB
[ \ \|\
d`eze
j!k
xe/d
umumt.NariWS)>C:
gCt.
tV3P
YheTh
PXF.
[P[.[.[
*]+]+]+
0;2_2
3q4q4q4q4
?+?H?a?
?N@N@w@
@(D(D
G7HMHkH
IBI~I
K6K6KWKwK
L4L4L4LXLyL
L+M^M}M
PEPuP
P#QQQ
Q/RHRHR~R
S4TuT
U@UfU
U'VFVtV
WMXMXqX
X.Y.YwY
YIZIZsZ
Z"[u[ \
]2^2^2^2^2^2^
^4_o_o_
_&`T`
`!aNaNaNaka
heheh
i7ici
k]l]l]l]l]l]l
oKpKpKpKpKp
t/utu
u`w`w
5 a
495B6B6
=2@AC
iWk]l
pNrwt
u@w`w
~U~U~U~U~
$c%{%
'9'S'
3d3y3
3!4rgrgrgrgr
vxwvx
%=%3&1'
(1)f*
,,,,,i,i,i,i,i,*-u-}.
1.1F1z1\2
384j4
7F8[:
>(?}?\r_$c$cig
s1t$u`w
{t|t|t|
}J~|~
!6!6!c!
!V%M'e'
*7+i,
4[5[5
9i9i9i9i9
?I@r
vvx>y
8i9i9i9i9i9
jVlyl
m6o6o6oeo
vxwxwxw
wLxLxLx
|>}>}b
#2$}'}'
0F1B2
>_>(?P?
[,],]J]J]
`+aib
q:q$r
v2xXz
$Q$Q)Q)
-F/`/V0p0
4[:}?
^@_r_
_UaQb
r^s1t{t{t:v:v
||~6
3x566
8i9i9i9i9t:
,>
A)BAB
D&EDE
EzF$HmH
J%K%KSK
LVNVN
Q0RbRNS
S;T;T
W>XlX
X*Z*Zv[
b$c$c$c$c,f
iei+j+j+j+j
q;svs
t=u=u
vIw)z
zU{ }
$V%V%V%V%K&i&
.&.L.
2%2S4
4&5&5&5&5&5i6
9?9i9i9i9i9i9
=P?P?
@gBgB:C
E9FPF
GHGHGeG
H[IfJ
Ku(P
PSPS
isPSP
.SR]
!PRV
FZt!
SQPS
P[P[
*^P^
r X"
(E.`.
/T/\1
1r2j3
4B5r5
K}LoM\NfO
YS[ ]^_}_
_E`E`E`E`E`E`q`
e9fTfIg9h
pZrXXXXXXXXX
YkZkZkZkZ
_E``b
b^c^c^c^c
/!3!3
9gXXXXXXXXXXXXXXXXXX
Xy>y
{i}P~
& X r
(.*.*.*.*
0C1\1\1
687|8
o>
GKJdJ|J
JNL}L
M7MoM
N\NuNfO
PzQJS
V$W?W
ZNZS[
[ ]4^
^}_E`E`E`E`E`E`q`
bCc^c
d9fTf`g
g9hah
k:l:l
pDq]qZr
v+v^v^v
| ~P~
*!E!?"?#
'((r(r(r(+)
2|4B5
8&9y9
XXXXXXXXXHB
G4GlG
Q$S@T
UEVvW
fLk"l:l
n8oHp
rsrsr
t7ununu)x
!X"f&B(
*}+A,A,
;gy>y
y%{%{
K$L2
MrMr
MZSQ
H@r3
MZMZ
AAAAAA
AUTOOPENe
FILESAVEAS
AUTOOPEN
FILESAVEAS:
04*k
AUTOOPEN


Report Offensive Message For Removal


Response Number 1
Name: Sue
Date: February 15, 2002 at 20:25:26 Pacific
Subject: help! I think i got a virus...
Reply: (edit)

did you run a virus check.


Report Offensive Follow Up For Removal

Response Number 2
Name: Hmmm
Date: February 15, 2002 at 20:41:32 Pacific
Subject: help! I think i got a virus...
Reply: (edit)

I'm no expert but it could be WM/Viva.A macro
virus looking at this string-

file:///
Infected\With\Name
foxz
NoMercy
Virus

Here's some info-

http://webmastersecurity.net/00011/00011388.htm

http://www.net-security.org/text/viruses/macro/word/j/joxzin.shtml


Report Offensive Follow Up For Removal

Response Number 3
Name: jag mafer
Date: February 15, 2002 at 21:00:52 Pacific
Subject: help! I think i got a virus...
Reply: (edit)

Hey, thanks for pointing me in the right direction. I think I should be able to find software to take care of it now...
guess i'll have to look at my windows swap file more often...
No clue how I got it, maybe my mom opened an infected word file...
+jestar


Report Offensive Follow Up For Removal

Response Number 4
Name: Mark p
Date: February 15, 2002 at 21:15:11 Pacific
Subject: help! I think i got a virus...
Reply: (edit)

Sues did ask the obvious question.

I recomend AVG Antivirus. Some so called great boxed commercial products are crap by comparison.

Lately I've done a bit of reading about McAfee in the early days and they where just as ruthless with compeditors as MS was. So they certainly don't get my penny's.

F-Prots good too as a secondary check.


Report Offensive Follow Up For Removal

Response Number 5
Name: dabigpig
Date: February 15, 2002 at 23:21:57 Pacific
Subject: help! I think i got a virus...
Reply: (edit)

upon flying over it i saw the /run deltree.exe my friend totaly killed off his computer by not listening to me and he ran a string in dos that erased his whole hard drive i don't want to say the string because there are other people like him out there that i could see doing this themselves.

i would run a virus scan.


Report Offensive Follow Up For Removal


Response Number 6
Name: Mark p
Date: February 15, 2002 at 23:28:32 Pacific
Subject: help! I think i got a virus...
Reply: (edit)

Saw that to. I bet your freind will listen to you next time ahh ;)

At least you had the sense warn him.


Report Offensive Follow Up For Removal

Response Number 7
Name: DBPowerWCRulez
Date: February 16, 2002 at 00:31:09 Pacific
Subject: help! I think i got a virus...
Reply: (edit)

Whoa! I noticed the virus string says bo2k is a BackOrifice 2000 backdoor program.

Time to kill the trojan off the system by the AntiVirus program and put the firewall to block the DCC File transfers.

ZoneAlarm very best recommended software :)

the new mIRC version have a /run and /dll options, you can CHECKED on it to disabled and prevent it.

yea, in 3 years ago I was puzzled my system was opened the DOS box and deleting whole windows dirs while I am on the mIRC.. Oh boy it's fk'd up by the hackers on the mIRC channel. So I restore the system from QuickRestore CD went reformat HD and restoring the Win95b.

so I gaves up cannot afford to buy for the firewall softwares, then a year later woooooo!! finally found a on PCMags about FREE ZoneAlarm I love the best software! I thanked ZoneAlarm company!

Go get ZoneAlarm :)
I've use it up for 2 years!


Report Offensive Follow Up For Removal

Response Number 8
Name: someone
Date: February 16, 2002 at 19:29:44 Pacific
Subject: help! I think i got a virus...
Reply: (edit)

ahh so u got the virus i sent u heeeeeehheheheheheheheheheehheheehehehehe

shame


Report Offensive Follow Up For Removal

Response Number 9
Name: ballz
Date: February 16, 2002 at 19:33:22 Pacific
Subject: help! I think i got a virus...
Reply: (edit)

pornpass.doc is in there.. huh? what the heck u been looking at boy!


Report Offensive Follow Up For Removal






Use following form to reply to current message:

   Name: From My Computing.Net Settings
 E-Mail: From My Computing.Net Settings

Subject: help! I think i got a virus...

Comments:

 


  Homepage URL (*): 
Homepage Title (*): 
         Image URL: 
 
Data Recovery Software




How often do you use Computing.Net?

Every Day
Once a Week
Once a Month
This Is My First Time!


View Results

Poll Finishes In 2 Days.
Discuss in The Lounge