| Author | Message | Time |
|---|---|---|
| Naem | There's an IRC worm spreading... it basically forces your IRC client to say: "http://www.kromberg.at/pics/show.php?f=drunkchicks.jpg LOL" and it installs god knows what on your system. C:\browsercheck.exe is one, and it opens mshta.exe (?) in a window you can't open so I deleted all instances of that too. If anyone knows if that created some registry values please tell me... Also, when I deleted mshta.exe I got a windows copy protection error that said I needed the files. Oops. So if someone wants to send me those files and tell me the paths that it's installed in, I'd be grateful. (win2k pro btw) | September 27, 2003, 4:19 PM |
| Skywing | [quote author=Naem link=board=2;threadid=2857;start=0#msg22331 date=1064679542] There's an IRC worm spreading... it basically forces your IRC client to say: "http://www.kromberg.at/pics/show.php?f=drunkchicks.jpg LOL" and it installs god knows what on your system. C:\browsercheck.exe is one, and it opens mshta.exe (?) in a window you can't open so I deleted all instances of that too. If anyone knows if that created some registry values please tell me... Also, when I deleted mshta.exe I got a windows copy protection error that said I needed the files. Oops. So if someone wants to send me those files and tell me the paths that it's installed in, I'd be grateful. (win2k pro btw) [/quote] mshta runs .hta ("HTML Applications") files. WFP should copy it over if you put in your Windows 2000 CD-ROM. | September 27, 2003, 4:31 PM |
| MrRaza | Try this program, SpyBot S&D, http://spybot.eon.net.au/ . | September 27, 2003, 4:51 PM |
| UserLoser | A friend of mine on AIM, doesn't even know what IRC is and he got that link from someone else and relayed it to me. | September 27, 2003, 11:25 PM |
| Naem | Yeah there are many variants of it.. one of them circulates through AIM and steals your password and buddy list. | September 29, 2003, 2:07 AM |