unforum

drizjr · Unfictologist Joined: 28 Nov 2003 Posts: 1700

WARNING: cid?

**Posted:** Wed May 05, 2004 10:33 pm

Caterpillar

Wish I didn't read unread posts from the bottom up......lol

No idea what it is, but tis weird.

**Posted:** Wed May 05, 2004 10:53 pm

Mosz0rz · Guest

I accessed it in Mozilla, and when I tried to refresh this page in IE my address bar became weird and gave some cid thing

**Posted:** Wed May 05, 2004 11:00 pm

Varin

Yep I get it too.

**Posted:** Wed May 05, 2004 11:19 pm

_________________
"I still miss him to this day and probably always will." - Todd Keeler, Chasing the Wish

"meta meta meta, I made you out of play..." ~ j5

drizjr · Unfictologist Joined: 28 Nov 2003 Posts: 1700

ATTN MODS: DELETE IT!

Caterpillar

**Posted:** Wed May 05, 2004 11:25 pm

Varin

Re: ATTN MODS: DELETE IT!

**Posted:** Wed May 05, 2004 11:50 pm

_________________
"I still miss him to this day and probably always will." - Todd Keeler, Chasing the Wish

"meta meta meta, I made you out of play..." ~ j5

drizjr · Unfictologist Joined: 28 Nov 2003 Posts: 1700

Thank you, Varin!

**Posted:** Wed May 05, 2004 11:55 pm

Mosz0rz · Guest

I updated and ran a virus scan, no virus so far. The problem has also gone away. Probably some weird bug involving iframes. Try closing all of your browsers and restarting IE, or alternatively just rebooting.

**Posted:** Wed May 05, 2004 11:59 pm

drizjr · Unfictologist Joined: 28 Nov 2003 Posts: 1700

Mosz0rz wrote:

**Posted:** Thu May 06, 2004 12:33 am

Mosz0rz · Guest

Okay folks, here's the deal:

this isn't a virus. Actually, it's a worm. It will cause no actual damage to your system. The problems you got was probably the worm trying (and failing) to execute itself. On newer systems, the infection will fail and the worm will have no effect. You DO want to get rid of this worm if you have it - it's a mass-mailer.

Want to find out if you have the worm for sure? (in other words, don't trust your anti-virus?)

Step 1. Check your Windows directory for the existence of any of these files:

Firewallogger.txt
base64.tmp
zippedbase64.tmp
zipo0.txt
zipo1.txt
zipo2.txt
zipo3.txt

Step 2. Check your registry for this:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"SysMonXP"="C:\WINNT\SysMonXP.exe"

(note: minor variations allowed if you're primitive and your Windows directory is still "Windows" rather than "WINNT."

If one of these is found, you're infected. Update your anti-virus and run, or if that doesn't work, try manual disinfection. (but don't screw up your system)

**Posted:** Thu May 06, 2004 8:16 am

AnthraX101 · Entrenched Joined: 18 Mar 2003 Posts: 797

I didn't see the post so I can't say anything for sure, but I doubt it was infectious. Generaly when those things go onto email message boards they have the binarys stripped, meaning the iframe (which was an infection attempt) had no actual virus/worm attached to it.

AnthraX101

**Posted:** Thu May 06, 2004 2:08 pm

_________________
VGhlcmUgaXMgbm8gc3Bvb24u
ll----ll--ll--ll----l---ll---llll---ll--l--ll---llll-ll-l-ll-llll--l-.