New Virus

[mikey2003]

Download the latest skin from KaZaA and you won't get a slick-looking piece of software. Instead, you'll install a virus that wipes out your music files. It is the eightball2.zip file. If you run XP and install this skin it will delete all MP3's. Win98 users are missing a required dll. There is not an antivirus fix out for this, so watch out.

[ShareDaddy]

Originally posted by mikey2003@Nov 29 2002, 11:01 AM
Download the latest skin from KaZaA and you won't get a slick-looking piece of software. Instead, you'll install a virus that wipes out your music files.  It is the eightball2.zip file.  If you run XP and install this skin it will delete all MP3's.  Win98 users are missing a required dll.  There is not an antivirus fix out for this, so watch out.
Then I would presume you did not download it from KAZAA then as you stated. You may have downloaded something that said it was a skin from/for Kazaa, but Kazaa has nothing to do with viruses. And that is if this is legit. What about a filesize or filename, what kind of warning is this, just trying to spook us or really warn us, warn us with the file info, thanks.

[random nut]

Are you sure it's really a virus and not a mistake by your anti-virus program? They're really not that good at detecting REAL viruses. Not so long ago a lot of McAfee users got virus warnings when they weren't infected. Today when I built a PE loader I got a message from Norton Antivirus 2003 that I have a virus:


W95.Fono
Detected as:
W95.Fono

Aliases:
None

Area of Infection:
.EXE Files

Characteristics:
Memory Resident, Encrypting, Polymorphic, Wild


No additional information.


It's my code it thinks is a virus when it isn't. It just happens to look like that virus someplace in the file.

[Jonne]

the only thing i found about it on google is this:
link to google groups (http://groups.google.com/groups?q=eightball2.zip&hl=af&lr=&ie=UTF-8&oe=UTF-8&selm=0324069520021129%40onego.ru&rnum=1)
but i can't read russian, perhaps it's another fake warning.
who would write a virus and make it a .zip?

[Jonne]

and i haven't found the file on kazaa either...

[mikey2002]

No I have not downloaded this file. I read about it on techtv website. Here is the article as it read.

http://www.techtv.com/news/security/story/...3409350,00.html (http://www.techtv.com/news/security/story/0,24195,3409350,00.html)


I was not trying to spook anyone, I do not know this filesize, although I did a search on Kazaa and found a 52k file named Eightball2.zip. I assume this is the file the article is talking about. Just trying to help out my fellow Kazaa users. Sorry about the lack on info in my first post.

[Jonne]

I found 2 users sharing the file, and when i did 'find more from this user' they were still sharing mp3's.
this could mean 4 things:
-the guys sharing it run win98
-the guys sharing it haven't installed it yet
-the guys sharing it made the virus
-it's a hoax... (however, is techtv a reliable source? i don't know...)

[ShareDaddy]

TechTV is as reliable as it gets, however they can only report on what they know and or find out from other sources.

[jetje]

Eightball......? Must be Cornerpocket. :lol:

[Jonne]

let's get him :P

[Ardor]

zeropaid (http://www.zeropaid.com/news/articles/auto/11272002b.php) has another story about it and so does www.broadbandreports.com (http://www.broadbandreports.com/forum/remark,5155190~root=poll,swapping~mode=flat#5155629).

[Jonne]

so it must be true.
well, i wasn't planning to download any skins anyway, so it's no big problem...

[random nut]

Originally posted by jetje@Nov 29 2002, 07:26 PM
Eightball......? Must be Cornerpocket. :lol:
LOL, funny because it's true?

[KazaaSearch]

Hey, guys, I have nearly infected myself with that f*ck*ng eightball! When I saw this thread, i searched for that skin in Kazaa, found nothing, and relieved my mind. But now I figured out that this skin has been downloaded by myself many days ago, when I dlded dozen different skins and tried them, randomly choosing what to install. Luckily I did not install eightball, but I could! Here is some text extracted from eightball.exe:

Folder where that damn kid programmed the virus:

C : D o c u m e n t s a n d S e t t i n g s D a r k f i r e M y D o c u m e n t s V i s u a l B a s i c F i l e s v i r i i A b r a c a d a b r a . v b p

His username is Darkfire on that goddamn computer.

D o L i k e M a g i c ? ? ? Y e s y o u s a y . W e l l t h e n h e r e g o s e ! N I C a n M a k e t h i n g s M a g i c a l l y D i s a p e a r ! ! !  5  4  3  2  1

A b r a c a d a b r a , y o u c o m p u t e r f i l e s a r e m a g i c a l l y d i s s a p e a r i n g ! ! ! G o o d b y e ! $ c : a b r a c a d a b r a . b a t

[random nut]

Originally posted by KazaaSearch@Nov 30 2002, 06:34 AM
Folder where that damn kid programmed the virus:

C : D o c u m e n t s a n d S e t t i n g s D a r k f i r e M y D o c u m e n t s V i s u a l B a s i c F i l e s v i r i i A b r a c a d a b r a . v b p

Not a very smart kid.. but I guess that's why he can only code it in VB.

[Ardor]

Originally posted by random nut+Nov 30 2002, 11:05 AM--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (random nut @ Nov 30 2002, 11:05 AM)</td></tr><tr><td id='QUOTE'><!--QuoteBegin--KazaaSearch@Nov 30 2002, 06:34 AM
Folder where that damn kid programmed the virus:

C : &nbsp;D o c u m e n t s &nbsp; a n d &nbsp; S e t t i n g s &nbsp;D a r k f i r e &nbsp;M y &nbsp; D o c u m e n t s &nbsp;V i s u a l &nbsp; B a s i c &nbsp; F i l e s &nbsp;v i r i i &nbsp;A b r a c a d a b r a . v b p &nbsp;

Not a very smart kid.. but I guess that's why he can only code it in VB.[/b][/quote]
Damn I hate those script-kiddies :angry: Now if someone designed a virus that could make my computer melt, then I would be impressed :D (for a very short period of time <_< )

[shenlong_wc]

did he code so much that his space bar is totally fucked up ?

[Remi]

I also read about this virus in this thread on UTC. 8 Ball Virus (http://www.unitethecows.com/forums/showthread.php?threadid=3653) I've no doubt that it is real, just glad I have the information to avoid it. My music is too important for me to lose to some moron!

[jnl3]

It only execute's on nt/xp systems. And it is real. Win 98 missing the required dll.


mcafee virus definition (http://vil.mcafee.com/dispVirus.asp?virus_k=99823)

[Ðark Princ€]

damn KazaaSearch how did you extract that!!!! damn !!!! HOW DID YOU DO THAT?????????? damn ya good!!!!

[CornerPocket]

Originally posted by jetje@Nov 29 2002, 12:26 PM
Eightball......? Must be Cornerpocket. :lol:
:lol: LOL :lol:

[CornerPocket]

Originally posted by Jonne@Nov 29 2002, 01:15 PM
let's get him :P
You guys are so funny :P

[CornerPocket]

Originally posted by random nut+Nov 29 2002, 05:26 PM--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (random nut @ Nov 29 2002, 05:26 PM)</td></tr><tr><td id='QUOTE'><!--QuoteBegin--jetje@Nov 29 2002, 07:26 PM
Eightball......? Must be Cornerpocket. &nbsp;:lol:
LOL, funny because it's true?[/b][/quote]
Random Nut,
Let's not get too extreme on accusations now, not created by me :unsure:

[julls]

ok, all my 'cannot read russian' friends. this article which someone of you found through Google says exactly the same as the article on TechTV. just because it was taken from there. so dont worry.
hope it was usefull.

[Jonne]

thanks, i couldn't sleep anymore because i kept wondering what it meant ;-)

[TRAVELBUG]

i the only skins i use are made by RIZLA

[PersianBulldog]

Originally posted by KazaaSearch@Nov 30 2002, 06:34 AM
Folder
C:/Documents*and*Settings/Darkfire/My Documents/Visual Basic Files/virii/Abracadabra.vbp *

The guy is norwegian.. Virii means Virus.. <_<