stupid virus

[#18]

Just a moment ago, I am getting this every a few min.


http://www.theforumisdown.com/uploadfiles/users/anon1/files/stupid virus.jpg


The only times I've ever seen the same messages were after I downloaded something. Now it happens every a few min. while I am not doing anything.

I start to think maybe someone got a problem with me and try to send me virus.

And take a look at the virus name - Quick Format

HOW SCARY!

Any ideas?

[Ritalin]

Got an antivirus?

[lanman31337]

It's an IRC virus.

Well, that's enough virii for today, I'll leave you with my own little virus experience I had last week:
Some of you know that I live online, I use or have used many of the programs out there and I had a really kool experience last week when someone joined a channel I happen to be admin of in IRC. This individual joined the channel, typed or most likely pasted a line of text and then waited to see the results. The results? He got kick/banned permanently. What was he looking for? He typed in a script that would run on everyone's computer if they were using a certain version of mIRC, that formats the C drive. Yeah, very kool indeed, 'cuz it requires absolutely no user intervention, you just have to be there and see it when it displays and the rest is magic. Well, my Norton totally freaked out and quarantined the entire log so I even got a copy of the script. Was fun for me, but a few others disappeared. Name of it is: Bat.QuickFormat.Trojan. and it was merely 15 letters of text that you only have to see and you're done. Wow!

Delete your IRC logs and update your virus scan.

[lanman31337]

Delete your logs from 12/24/03 and 12/25/03 from IRC

[#18]

Originally posted by lanman31337
It's an IRC virus.

Well, that's enough virii for today, I'll leave you with my own little virus experience I had last week:
Some of you know that I live online, I use or have used many of the programs out there and I had a really kool experience last week when someone joined a channel I happen to be admin of in IRC. This individual joined the channel, typed or most likely pasted a line of text and then waited to see the results. The results? He got kick/banned permanently. What was he looking for? He typed in a script that would run on everyone's computer if they were using a certain version of mIRC, that formats the C drive. Yeah, very kool indeed, 'cuz it requires absolutely no user intervention, you just have to be there and see it when it displays and the rest is magic. Well, my Norton totally freaked out and quarantined the entire log so I even got a copy of the script. Was fun for me, but a few others disappeared. Name of it is: Bat.QuickFormat.Trojan. and it was merely 15 letters of text that you only have to see and you're done. Wow!

Delete your IRC logs and update your virus scan.


I am not using IRC or anything. The only program is running at this moment is opera. I don't even have IRC installed on this computer. Maybe through another computer on the network?

This message from norton shows up every a few min. now. It started just 20 min. ago. It jumped out 6 to 7 times already by now.

[Blueboy1986]

u gusy got me worried now!!!:eek: am going to download a antivirus now:p

[YellowDart]

Originally posted by #18

I am not using IRC or anything. The only program is running at this moment is opera. I don't even have IRC installed on this computer. Maybe through another computer on the network?

This message from norton shows up every a few min. now. It started just 20 min. ago. It jumped out 6 to 7 times already by now.

Could it have come in as spyware or through an email??? I'd run an antivirus scan, or do a search for that file name on your hdd. If you find it, delete any instance of it, terminate any process w/ the same name, clean out your registry, and be glad you didn't lose your data!

*edit*

Are you behind a firewall or router at all???

[#18]

Didn't install anything today before it happened. Checked email once but all I did was deleting some trash mail.

I just ran a scan with Ad-aware, found 10 new objects and deleted. Doing a full scan with norton now.

[Hagios]

Hrm. If you're getting that error, and you're NOT on IRC, I'd worry. A lot of the mIRC-based DDoS zombie bots don't register as virii. You might want to check into that...

[Tazon]

mmmh really guys this is waaaaay out of topic in this forum. there are places, even in these boards, to get this kinda help. On top of that #18 posts a problem with a virus, even taking a screenshot of it, and later on tells us that he is NOW running a full virus check???? how is it that you first take a screenshot, then post in the wrong forum, and only then you think to run an antivirus?

i am no admin or mod or anything, just my two cents.

emilio

EDIT: o yeah i forgot he ran adaware too before running nav. COME ON! it is a VIRUS!

[#18]

Originally posted by Tazon
mmmh really guys this is waaaaay out of topic in this forum. there are places, even in these boards, to get this kinda help. On top of that #18 posts a problem with a virus, even taking a screenshot of it, and later on tells us that he is NOW running a full virus check???? how is it that you first take a screenshot, then post in the wrong forum, and only then you think to run an antivirus?

i am no admin or mod or anything, just my two cents.

emilio

EDIT: o yeah i forgot he ran adaware too before running nav. COME ON! it is a VIRUS!


My problem was detected by norton autoprotect. It jumps out what shows in the screenshot every a few min. It looks like the same virus try to attack my computer every a few min. I have no idea why this is happening. I had only opera running. Nothing was detected by norton full system scan and online system scan. And it's still happening. Isn't it emergency?

The reason why I did scan with ad-aware and full system scan with norton is from the suggestion of replies.



You see that's why you cannot be an admin.

[Jimbob7]

Boot into safe mode and scan helped me once :)

Also update the virus defenitions if you havent already :)

[fazz33]

i had a virus attack like that before (every few min) i had to reformat to get rid of it maybe you should reformAT too, that will get rid or the virus for sure

[Malpine Walis]

Guys, this is the emergency forum. We have to help him and not just comment on what he is dealing with.

I checked with symantec and they only acknowledge that it exists but they do not say anything about it. Link (http://securityresponse.symantec.com/avcenter/venc/dyn/26907.html)

Actually, the fact that it is coming up as a trojan means that it may very well be dealt with by AdAware. For those who don't know, trojans are not the same as a virus. Trojans are programs that get installed on your system by piggybacking on another apparently legitimate program that you have installed. Just what AdAware is designed to dig out of your system.

Now that you have run AdAware, try rebooting to see if it comes back. If that does not work, then Get an update to NortonAV and use that.

[lanman31337]

Somewhere someone sent you echo j format c:. It's making your norton antivirus freak out. There's a few bugs in norton, this being one of them. Clear out your temp files and temporary internet files thru opera.

[coin]

we use NAV at work and I have found that it struggles with internet cache folders, you will also need to empty your Norton Quarantine folder. Simply search for a folder called 'Quarantine' and empty it :D

[05virulosity50]

What is happening is that the virus has hacked your registry so that it is active before norton is you need to schedule a boot scan.

[Kendan]

Originally posted by lanman31337
Somewhere someone sent you echo j format c:. It's making your norton antivirus freak out. There's a few bugs in norton, this being one of them. Clear out your temp files and temporary internet files thru opera.

I have seen this many times do a search for "echo j format c:" thru windows and delete it. NAV sees it as a virus/trojan. The times I have seen it is was saved into a log of an irc chat but if you want to test it you can save it into any IM chat log and it should alert NAV like a virus.

[chkptcharlie]

strangley enough lanman31337's exact wording can be found on http://www.cpgreeley.com/security/newsletter.htm

norton should have a log of the file that contained the "virus" and where it was deleted from... that might help you figure out where and what it's coming from, and how you cna keep it form happnineg again.