PCTech Forums

now the real file enables special keys on Chicony keyboards.

but check this out....
i found vbs/peachy@mm virus inside my mhotkey.exe .

C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\default.d1b\Cache\EC16126Bd01

upon that file being loaded it hijacked my mhotkey.exe and started turning it into a virus?
my mcafee caught that page right away..... and about 5 minutes later i did a scan and found the same virus inside mhotkey.exe? strange.....
just figured id throw that one out there .

the virus has something to do with outlook and sence i havent found any site saying that it can infect mhotkey.exe i decided to post a little bit of info... sence i instantly noticed my outlook sending mails to my contacts (thankfully this computer dosent have any contacts relly exept 3 of my own email address) but all 3 of my mailboxes got this for a email too which i found interesting...

Date: Mon, 25 Oct 2004 08:45:50 +0000
From: "Yahoo!" <o0obrian0o0@yahoo.com> Add to Address BookAdd to Address Book
To: o0obrian0o0@yahoo.com
Subject: Your Yahoo! ID - o0obrian0o0@yahoo.com
D‮rae‬ Ya‮!ooh‬ M‮ebme‬r,

We mu‮ts‬ c‮eh‬ck t‮tah‬ yo‮ru‬ Ya‮!ooh‬ ID was r‮eretsige‬d by real peop‮el‬. So, to he‮pl‬ Y‮oha‬o! p‮never‬t auto‮etam‬d
regi‮rts‬ations, plea‮es‬ c‮cil‬k on t‮ih‬s li‮kn‬ and co‮elpm‬te c‮do‬e veri‮itacif‬on pro‮ssec‬:

w޳ww­.޶y޾a޸h‭o޳o‬.޾c‬o‏m‬/?BB8xyrsXg2yv9AdCfwK8s792v81k42v8k3abfCVNQPJhYPrTr6HHdMm9ib1

Tha‮kn‬ you



now the link lead to this page ... http://www.62nds.co.nz/62nds/documents/ol_pdfworm.tx(t)

which appears to come from this site
http://www.62nds.co.nz/pg/e90.php



if neone would like to talk more about this feel free just figured id throw it out there

o yes and btw do not click on the first link you will be infected.
IF YOU CLICK THIS LINK ***LINK REMOVED*** YOU WILL BE INFECTED.

one other thing i found interesting if i try to go to that page again it is telling me

ALERT! The file /62nds/documents/ol_pdfworm.txt cannot be found. Please check the location and try again.

good as done

62NDS does have the source code for several viruses on its website ( http://62nds.com/pg/e90.php ) - and your virus scanner may complain when you try to download them. HOWEVER, o0obrian0o0, you are not correct here. Just because a virus scanner alerts you to the fact that it is a virus, doesn't mean that the virus has installed itself in your computer and is active damaging your system. These VBS virus scripts can sit harmlessly on your computer, providing the file extension remains as TXT.

Publishing source code like this has no impact on virus writers - they all know the key weaknesses of operating systems and related products - (and besides, the VBS virus code included on the site is so poorly written, that prospective virus writers shouldn't use the code anyway)

Remember, the problem is with YOU (the visitor to this page) using MSIE. Change to a different browser, and 90% of your virus (and spyware) problems will disappear overnight. Even the US government (Computer Emergency Readiness Team) is recommending to ditch IE.



I would be very interesting in seeing the original email (with headers) that directed you to our site. Please email it to us, and we will chase it up: we do not send spam; we do not send out viruses.

Regards,
Phil
62NDS Solutions Ltd