There's an IRC worm spreading... it basically forces your IRC client to say: "http://www.kromberg.at/pics/show.php?f=drunkchicks.jpg LOL" and it installs god knows what on your system. C:\browsercheck.exe is one, and it opens mshta.exe (?) in a window you can't open so I deleted all instances of that too. If anyone knows if that created some registry values please tell me...
Also, when I deleted mshta.exe I got a windows copy protection error that said I needed the files. Oops. So if someone wants to send me those files and tell me the paths that it's installed in, I'd be grateful.
(win2k pro btw)
Quote from: Naem on September 27, 2003, 11:19 AM
There's an IRC worm spreading... it basically forces your IRC client to say: "http://www.kromberg.at/pics/show.php?f=drunkchicks.jpg LOL" and it installs god knows what on your system. C:\browsercheck.exe is one, and it opens mshta.exe (?) in a window you can't open so I deleted all instances of that too. If anyone knows if that created some registry values please tell me...
Also, when I deleted mshta.exe I got a windows copy protection error that said I needed the files. Oops. So if someone wants to send me those files and tell me the paths that it's installed in, I'd be grateful.
(win2k pro btw)
mshta runs .hta ("HTML Applications") files. WFP should copy it over if you put in your Windows 2000 CD-ROM.
Try this program, SpyBot S&D, http://spybot.eon.net.au/ .
A friend of mine on AIM, doesn't even know what IRC is and he got that link from someone else and relayed it to me.
Yeah there are many variants of it.. one of them circulates through AIM and steals your password and buddy list.