HELP Question about Viruses

Atrocities · #1 February 10th, 2004, 06:27 PM

I was wondering if a PC could be infected with say a spy bot virus while connected to say MIRC? Your IP is displayed, and if you happen to have the fire wall off so you could play a IP game of SEIV could someone sneak it in?

I am asking this because this morning I was on only two web pages, shrapnel and PBW and was getting anti virus warnings about this spy bot. (W32SpyBOT Open_Me.exe) It just happened again and I have just reconnected to one of the web pages.

Second question could one of these pages be attempting to send the virus to my computer?

To the best of my knowledge I have not opened any file from anyone that has not been scanned first. Only from poeple I was expecting files from. Today is the first day that this has happened.

I was on MIRC most of the day yestarday and recall reading that sometimes it can be exploited for such a thing as sneaking a virus onto someones PC. (A blanket attack.)

I simply do not know. I am running a full scan at the moment and will try and find if I am infected.

Shrapnel · #2 February 10th, 2004, 06:47 PM

It would be difficult to do, as most trojans and spyware need to be "installed" in a way, either by running a program (ala attachments in OE), or through open network ports. Are you running with file/print sharing on?

QUOTE:
"To the best of my knowledge I have not opened any file from anyone that has not been scanned first. Only from poeple I was expecting files from. Today is the first day that this has happened. "

Any chance someone might be infected that you recieved files from?

Regarding your second question, again, it would have to come through an open port that a firewall would normally block.

Hope everything works out!

Atrocities · #3 February 10th, 2004, 07:03 PM

Thanks, I appreciate the response and information. I was fishing to see if anyone else had had a simular experience.

I think it was MIRC from yestarday. So far I have followed all the recommendations to find the buger, but with no luck. I don't run Kazaa so the only other culprit could MIRC.

Thanks again.

Here is some info on the virus I am talking about:

W32.Spybot.Worm is a detection for a family of worms that spreads using KaZaA file-sharing and mIRC. This worm can also spread to computers infected with common Backdoor Trojan Horses.

W32.Spybot.Worm can perform different backdoor-type functions by connecting to a configurable IRC server and joining a specific channel to listen for instructions.

Note: The October 8, 2003 virus definitions contain a modified W32.Spybot.Worm detection which accounts for a minor variation discovered on October 7, 2003.

Also Known As: Worm.P2P.SpyBot.gen [KAV], W32/Spybot-Fam [Sophos], W32/Spybot.worm.gen [McAfee], WORM_SPYBOT.GEN [Trend], Win32.Spybot.gen [CA]

Type: Worm
Infection Length: various

Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Macintosh, OS/2, UNIX, Linux

Fyron · #4 February 10th, 2004, 07:32 PM

Go get Ad Aware (www.lavasoft.com IIRC), as well as the other major anti-spyware program, SpyBot IIRC. Install both and run them. This should kill any spyware that is on your computer that AV programs WILL miss.

PvK · #5 February 10th, 2004, 09:13 PM

Depending partly on how well patched, and largely on your firewall, a hacker with your IP address and the right tools could break into your computer, especially a Windows computer without a good firewall, and without the latest MS security patches. I don't think it's at all likely, though, unless you're inciting hackers. With a good firewall and latest patches, I think you'll blunt almost all script kiddie attacks.

PvK