Valhalla Legends Forums Archive | General Discussion | IRC Worm

AuthorMessageTime
Naem
There's an IRC worm spreading... it basically forces your IRC client to say: "http://www.kromberg.at/pics/show.php?f=drunkchicks.jpg LOL" and it installs god knows what on your system. C:\browsercheck.exe is one, and it opens mshta.exe (?) in a window you can't open so I deleted all instances of that too. If anyone knows if that created some registry values please tell me...

Also, when I deleted mshta.exe I got a windows copy protection error that said I needed the files. Oops. So if someone wants to send me those files and tell me the paths that it's installed in, I'd be grateful.

(win2k pro btw)
September 27, 2003, 4:19 PM
Skywing
[quote author=Naem link=board=2;threadid=2857;start=0#msg22331 date=1064679542]
There's an IRC worm spreading... it basically forces your IRC client to say: "http://www.kromberg.at/pics/show.php?f=drunkchicks.jpg LOL" and it installs god knows what on your system. C:\browsercheck.exe is one, and it opens mshta.exe (?) in a window you can't open so I deleted all instances of that too. If anyone knows if that created some registry values please tell me...

Also, when I deleted mshta.exe I got a windows copy protection error that said I needed the files. Oops. So if someone wants to send me those files and tell me the paths that it's installed in, I'd be grateful.

(win2k pro btw)
[/quote]
mshta runs .hta ("HTML Applications") files. WFP should copy it over if you put in your Windows 2000 CD-ROM.
September 27, 2003, 4:31 PM
MrRaza
Try this program, SpyBot S&D, http://spybot.eon.net.au/ .
September 27, 2003, 4:51 PM
UserLoser
A friend of mine on AIM, doesn't even know what IRC is and he got that link from someone else and relayed it to me.
September 27, 2003, 11:25 PM
Naem
Yeah there are many variants of it.. one of them circulates through AIM and steals your password and buddy list.
September 29, 2003, 2:07 AM

Search