Weird stuff

Discussion in 'Computer Security' started by zxspectrum, Jan 16, 2008.

  1. zxspectrum

    zxspectrum Terabyte Poster Forum Leader Gold Member

    2,092
    216
    244
    Well folks i had a virus then didnt have a virus and thats whats bothering me

    I got a zip file through someone from msn via the irc chat window. The thing said new pics and i new the woman they were coming from, and yes they were expected to be dirty lol. Anyway when i opened both i knew straight away something was suss, so i deleted them. I scanned my computer and nothing was picked up

    I was just looking today and the automatic setting scan has picked them both up as worms, but they are noton my system, as i have searched for them, my Av picked them ou as worms, and when i opened task manager there were 15 processes for svchost, all running which is ver unusual. so i decided to terminate them and after 3 terminations the computer took it on itself to restart.

    Now ive scanned again and there is no worm there but i feel that this could be wrong, what should i do from here

    Ed
     
    Certifications: BSc computing and information systems
    WIP: 70-680
  2. JohnBradbury

    JohnBradbury Kilobyte Poster

    372
    39
    52
    Dirty pictures ... gets us geeks everytime!

    What AV are you using?
     
  3. greenbrucelee
    Highly Decorated Member Award

    greenbrucelee Zettabyte Poster

    14,292
    265
    329
    I was gonna say that, and ask that :D

    If its nortons then its probably lying to you, I thought nortons was very crap thats why I got rid.
     
    Certifications: A+, N+, MCDST, Security+, 70-270
    WIP: 70-620 or 70-680?
  4. zxspectrum

    zxspectrum Terabyte Poster Forum Leader Gold Member

    2,092
    216
    244
    Im using trend micro, i think its pretty good and keeps my machine going good

    Ed
     
    Certifications: BSc computing and information systems
    WIP: 70-680
  5. JohnBradbury

    JohnBradbury Kilobyte Poster

    372
    39
    52
    If you're concerned that this has left something on your machine and your current AV isn't picking anything up, try another AV.

    You can download a full trial of NOD32 and run a full scan. If this doesn't find anything then you can rest easy.
     
  6. nXPLOSi

    nXPLOSi Terabyte Poster

    2,874
    30
    151
    There are an amazing amount of worms that circulate on MSN. What they usually do is just open chat windows with everyone on your contact list, and try to send "pics" in this sort of manner. Problem is, you obviously dont see the chat windows that are trying to do this, and are unaware until someone copy and pastes what "you" have sent them and the message that appears.

    Perhaps an idea is to ask people on your contact list if you've tried to send them anything, as they might of done the same thing as you and accepted, and are now completely unaware of whats going on! This would also show you that its still active on your machine.

    A little info on this kind of thing - http://www.cisrt.org/enblog/read.php?106
    More - http://www.cisrt.org/enblog/read.php?170

    It may not be the exact ones shown in the links above, but does it sound familar or am I way off here?

    :)
     
    Certifications: A+, Network+, Security+, MCSA 2003 (270, 290, 291), MCTS (640, 642), MCSA 2008
    WIP: MCSA 2012
  7. Sparky
    Highly Decorated Member Award 500 Likes Award

    Sparky Zettabyte Poster Moderator

    10,718
    543
    364
    Perhaps try a full system scan in safe mode, sometimes that can help remove some infected files as they may not be in use when in safe mode.

    More importantly did you get to see any of the pics? :biggrin
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) MS-900 AZ-900 Security+ Network+ A+
    WIP: Microsoft Certs
  8. zxspectrum

    zxspectrum Terabyte Poster Forum Leader Gold Member

    2,092
    216
    244
    You know i didnt get the bloody pics either lol, what a calamity

    Ed
     
    Certifications: BSc computing and information systems
    WIP: 70-680

Share This Page

Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.