last week i was in an channel an over 100 persons joined the channel flooded something i didn't understand and i had to reboot my pc....then my antivirus software said that i have an worm on my computer....did the worm comes from the irc?
Printable View
last week i was in an channel an over 100 persons joined the channel flooded something i didn't understand and i had to reboot my pc....then my antivirus software said that i have an worm on my computer....did the worm comes from the irc?
Could be, If all of a sudden so much people came on, I suspect somebody threw in some warbots....
Anyhow you didn't accept a file over DCC ?
no i haven't accept anything
do you by any chance have kazaa?
Just a thought.
i don't use kazaa etc i don't really like it because there are too much possibility's to get a virus
It could have been Fizzer:
Here is the full write-up on the virus / worm from McAfee: W32/Fizzer@MMQuote:
IRC Bot
The worm pings many different IRC servers. When it receives a reply, it connects to a channel on that server using many different internal usernames, and waits for further instructions from an attacker. The list of IRC servers includes:
irc2p2pchat.net
irc.idigital-web.com
irc.cyberchat.org
irc.othernet.org
irc.beyondirc.net
irc.chatx.net
irc.cyberarmy.com
irc.gameslink.net
no is it was win32/klez
Make sure that you are not accepting files automatically. I made that mistake when I first started using IRC. If you need help on how to check that, let us know.
Klez....ah..open any funky mail as of late? as far as I know Klez only spreads through Mail, as for the channel attack..prolly asome warbot's...would't really do much other than knock you offline perhaps...
Oh well...ma 2 cents.
- Noia
yes this can be but i don't open mails from unkwon people or with some attached things i don't really know...
Well if you didnt do anything at all like you said u havent, then you shouldnt have a worm/virus. You must of done something like accept a file over DCC or open a strange email. We cant hell you unless you give us some backround info on what happened or what you did. Sorry if i affended anyone. -Twisted-
Hummm.... Look AOers... If he's running old versions of mIRC then he doesn't even need to download from kazza or anything as a matter of fact he most likely got it because he has 'autoget' enabled in mIRC.... This means that he could have been infected straight out of IRC without even knowing it. Its old... mostly popular with macro virii.
This URL talks all about what I just said... http://www.stiller.com/mirc.htm
However if you don't have anything like mIRC then you could still be infected with some virii if a bot advertises a site and you visit it such as a a normal looking site or site with FTP downloads or a site with some infected plugins & (ect).
probably just a coinsciedence(i cant spell). Unless the war bots were scanning hosts as they joined. Which i have seen in the past. what virus did your A/V software tell you, that you had??
i got tons of viruses through mIRC, always the same one. I've been using Kazaa for ages though, downloaded thousands of files, gigs of warez and i've only ever got 2 viruses.
As a random thought.. what did your AV find infected? Was it by chance in a firewall log? Or the actual attachment ect.?
the first file that was infected was my windows.exe and then all other *exe, *.com files had been infected....but only the exe ect were infected that wondered me...
You may want to consider where you got the mIRC software. There is a download/install package floating around that already includes a trojan. We found a few of those around here recently.
It is my understanding that Klez actually "spoofs" the sender's email address by randomly selecting an email address from the sender's address book, so you may have opened an email thinking that it was from a trusted source, when infact it was not. Visit http://[email protected] for a better description than I am able to provide. Anyone please feel free to correct me if I misunderstand this concept, because I am by no means an expert. :)
theuser,
Like you, I believe Klez spoofs the sender in the From part of an email. If I want to find the indenity of the sender of an infected email in my Outlook Express, I might look in the Details part of the email Properties.
The Reply-To designation may help identify the infected machine.
Sometimes it does & sometimes it does not.
:splat:
theuser is correct regarding Klez. Klez usually comes with with trojan "Elkern" or similar.. simply depends on what patches you DIDN't have installed and if you were using Outlook express AND were running with the preview pain enabled.. simply previewing the infected message infected you.. cool huh.. but if you had all the ie 5.5 or IE 6 updates you "shouldn't have a problem (one of the reports on klez and bugbear claimed that IE6 was imune..what a joke.. most of the systems we fixed had IE 6 and 6.1)
Cheers