Warning - IRC Virus!

By ernstaugust·
hi guys,

some of you have already seen this IRC virus, but I want to warn you with this news.

How can you get infected with this virus?
The users, which are already infected, will write a message like
"http://steam2******.com/index.php steam v2.0 released. go get it. NOW!".
Don't believe this message,don't click on this link and you won't get infected!
If you see someone writing this message, tell him to delete his virus (cause he can't see that he's writing it).

OMG I clicked the page and launched the Virus, what can I do?
Here's a little tutorial on how to remove this virus (thx TROUbl3m4k3R):
- first of all, download security task manager.
- leave the internet (deactivate your lanconnection).
- delete every file called Winamp.exe and SteamInstall.exe in "C:\\WINDOWS\\Prefetch"!
- delete your current IRC client and check your system with the downloaded security task manager.
- if you find an infected file, delete it or move it into quarantine (the infected file of TROUbl3m4k3R was "c:\\windows\\system32\\winamp.exe"!!!).
- restart your system and connect to the internet (after you checked your system again with security task manager).
- reinstall IRC and change your Qnet authpassword.
- start steam and change your password!

I hope this news could help some users :-)

Comments

You need to be logged in to post a comment.

26/08/2006 18:22:00

1) leave the internet 2) download manager :D

26/08/2006 18:23:00

Nice <3 thanks to TROUbl3m4k3R! brb, I don't see why some people clicked it in the first place -.-

26/08/2006 18:25:00

<3 <3 <3 :D

26/08/2006 18:25:00

lol.. idd soul|ftw ur right.. dumb ppl.. oops.. i clicked it 2 :O (not) :P

26/08/2006 18:27:00

haha Dragon.. fixed it :)

26/08/2006 18:32:00

soul|ftw normally i don't click such links too but i downloaded and checked first with virusscanner... and the scanner did'nt find anything so i thinked ok, maybe a fake but not a virus ^^ but after firewall alerts that this stupid winamp.exe want to make regisrty entries and a connection to internet then it was on point to say ok something is not good on my computer :D

26/08/2006 18:33:00

btw* not brb :E

26/08/2006 18:42:00

I always click on those links cuz I want to have virus. I can't get them in real life :(

26/08/2006 18:46:00

maybe u should permban -> ndR donakos h1m1 Cuz thoose ppl wrote it @ irc. I didnt click @ the link but anyway :/

26/08/2006 18:52:00

DHT-: If you still didnt get it: The virus automatically sends the links via amsg to all IRC channels you are in. (like every virus). And it hides your own message from you, so you dont even see that you just posted the link to the virus...

26/08/2006 18:58:00

lol soul brb :P thx4info

26/08/2006 19:02:00

thx cuz im infected now gonna fix that :) thx troublemaker :P <3

26/08/2006 19:26:00

Thanks :>

26/08/2006 19:39:00

Best protection: do not run your XP with administrative rights. Make an account (normal user) and these dump trojans can't write into your windows-dir = no problem ;).

26/08/2006 20:24:00

im lucky i didnt use irc in the last few days :D :D thanks a lot

26/08/2006 21:12:00

agree with Guenhwyvar when i was run xp pro i had that too but in home i cant find the right settings for this normal user :S cause when i want to go into usermanagement it's forbidden with home ^^

26/08/2006 21:22:00

gueni ftw :D <3 ya

30/08/2006 22:06:00

what the virus does?

03/09/2006 01:58:00

I think its only for a keylogger to steal the steam accounts