My computer problems have been solved. To make a long story short it was a new trojan horse; a very inteligent one.
Here's how it happened:
Two weeks ago on a Saturday night I was updating sounds on my computer for AH. Sometime later during the week someone else used this computer while I was gone for the week. (Every week I travel 60 miles north to college.) Evidently he opened some e-mail that was from someone he knew with the body saying "Check this out!" The attachment was called midget.scr. Guess where it got saved, yep, my AH sound file.
At the time he didn't notice the file had done anything, so he just assumed it was a dud and continued working.
Skip ahead to this Friday. I came home for winter break, and just like every weekend I wanted to play a little AH before I went to work the next morning. Unforunately something was wrong. (Check out "Bug ... Maybe" in the bug forum for details. Also a couple of posts in the tech support forum.) I was able to determine that AH files were being saved in my windows\system folder. In addition I was getting random errors when working with any program that needed an internet connection.
I spent MANY hours working on this trying among other things: 4 Scandisks (1 through, taking 3 hours) (no errors found), 2 Norton Antivirus scans (no viruses found), a repair of IE5, deletion and reinstall of Java Virtual Machine (2 hour download). The problem was improved, but still present. Curiously I couldn't seem to log onto
www.symantec.com, but thought nothing about it. I was able to get to
www.mcafee.com, but found nothing useful there.
I began look in my Windows\system folder next. There were the files from AH called things like tmp*.bmp ( * being the name of a squad CO.). In addition there were strange files ending in .ooc and other UNREGISTERED extensions I'd never heard of before.
Around this time I fired up Dr. Watson and during one of the errors (totally random errors, but always related to networking) there was a message that <unknown> had modified windows system files. Again I tried to log onto symantec's web site, but I couldn't. I got the standard message that it was unavailable. (That made 2 nights in a row, and I was then a little suspicious.) Earlier tonight I posted in the off-topic forum a question asking whether others could access
www.symantec.com. Immediately after posting the message, another error occured. A few minutes later I again tried to get to
www.symantec.com, and was successful. In about 15 minutes I found a message about W95.Hybris.gen. (EVERYONE should read
http://www.symantec.com/avcenter/venc/data/w95.hybris.gen.html for information.) In this write up I found the name midget.scr listed, and I knew I had found the answer. $3.95 earned me another year of definition files and after a 3.5 meg download and 45 minutes of scanning 31000 files for viruses,
the problem was solved! (My last virus def file update was in August, one month before the virus was created.
) Norton repaired one file and quarantened 6 others. These 6 files were the strange files I reported earlier ending with .ooc, .hba, etc. I later deleted them.
Take a guess what the one repaired file was?
Did you guess Wsock32.dll, if so you are right. That was why any internet application was having random errors. AH on the other hand was going crazy because the midgets.scr file was downloaded into my AH sounds folder. (I had found it in there on Friday and deleted it. I didn't think anything of it at the time.)
The scary part about this virus (more correctly trojan horse, and not in the Symantec write-up) is that it blocks access to the Symantec web site. Because of an error earlier in the day through, I was able to connect to it. The virus is able to send off copies of itself to anyone you send e-mail to, so the file appears to come from someone you trust.
I'm just glad it's all over now.
Be very careful everyone, this one is easy to catch. It is also only detectable with the very latest NAV update. The McAfee virus program doesn't seem to scan for it yet.
If you get AH problems like the ones in my bug thread, be on the lookout!
------------------
bloom25
THUNDERBIRDS
