Gnutella Forums

Gnutella Forums (https://www.gnutellaforums.com/)
-   Open Discussion topics (https://www.gnutellaforums.com/open-discussion-topics/)
-   -   fun lil viruses that have been floating round limewire (https://www.gnutellaforums.com/open-discussion-topics/39602-fun-lil-viruses-have-been-floating-round-limewire.html)

CrazyChicken132 June 19th, 2005 11:36 PM

fun lil viruses that have been floating round limewire
 
earlier today i dled a file, this file was 851.7K accourding to limewire, this seems to be the generic file size for this virus. -- also it seems to be mainly a .zip

anyways after you have downloaded the file inside it will be another file called setup.exe, after running the setup.exe the user will get a classic install screen, but, after clicking the next button the havoc is wrecked.

the installer will pop up an error saying that the program is outdated and to please download the newest version, subsequent runnings of the file will do nothing.

now for the damage

program creates a folder on your harddrive, called my shared folder, if u alreadly have this folder it just adds a bunch of files to it. these files are all the same size (852K accourding to windows explorer) these files are almost all zips, a few wma and mp3s are sometimes created as well. but inside each of these zip files is a file called setup.exe.

this entire folder is shared out onto the limewire network further spreading the virus. it sucks up your system resources, blocks access to the taskmanager, sometimes is able to block command prompt, and spreads itself even more, i am sure that this virus does even more, but i really dont feel like finding out.

this little bugger is very nifty at hiding in your machine. it requires a few steps to remove:

first a command window must be opened
this can be done through
start-> all programs-> accessories-> command prompt
now type
C:\WINDOWS\system32\taskkill.exe /IM winupdates.exe
and push enter
this kills the process and allows access to command prompt
now type
attrib "c:\program files\winupdates" -s -h
this allows the user to see the folder that is required to delete
now type
del "c:\program files\winupdates"
confirm the delete
now to prevent from loading
type
del "c:\windows\prefetch\winupdates*
this prevents any error message you would see from trying to load a file that isnt where its supposed to be

i hope this helps someone
-crazychicken132


All times are GMT -7. The time now is 02:09 AM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
SEO by vBSEO 3.6.0 ©2011, Crawlability, Inc.

Copyright © 2020 Gnutella Forums.
All Rights Reserved.