PDA

View Full Version : Doom 3 Alpha Patch



racer II
02-26-2003, 07:02 PM
Never ever ever ever ever ever ever ever ever

Install doom3 alpha patch ( i don`t remember the exact filename)
It contains some kind of trojan or virus.
The trojan/virus starts up with windows as ws32kza.exe
And create a folder in the system32 directory called KLM
It infects some dll files in the win system32 directory, and it create`s 2 folders with blank mp3 files.
And it copies itself in the kazaa shared folder as some popular files, like adobe photoshop etc.

I had this trojan/virus a couple of weeks ago, my virus scanner did not see this file as a virus and i still can`t find it on any of the anti virus sites.
Spybot and ad-aware 6 also doesn`t see them.

So yesterday i opened the file with a hex editor and i saw that some .dll files in the win system directory where listed in the file, also i could see a couple off strings like: Create in
c:\program files\kazaa\My Shared Folder\*FILE NAME*.exe
c:\program files\kazaa lite\My Shared Folder\*FILE NAME*.exe

So i reinstalled my windows xp, since i can`t "clean" the affected files in my windows directory.

So please check if you have a \KLM folder in your windows system32 directory

lunatacs
02-26-2003, 07:49 PM
omg? you sure? i had doom 3 demo and i was sharing the doom path and my antivirus didn't pick anything up? and i scan everything i download?

racer II
02-26-2003, 07:57 PM
Yes i am sure, just check your win dir.
And if you search for doom 3 alpha patch in kazaa you will get multiple results, but i can`t remember what the file with the virus inside was.

so maybe your safe

lunatacs
02-26-2003, 08:07 PM
do you have more information about this virus or what does it do? because my computer didn't have virus for now over a year. I scan mostly every week or so..

I looked where you said though nothing. thank god. after you said that about doom 3 path, i got little jumpy because i share that. well i hope its clean nothing picks up

racer II
02-26-2003, 08:28 PM
When i discovered this file i posted something in the question section of this forum:
http://www.klboard.ath.cx/bb/index.php?act...3863&hl=ws32kza (http://www.klboard.ath.cx/bb/index.php?act=ST&f=2&t=13863&hl=ws32kza)

I just did a search in this forum about my old post, and i found another one with the same problem:
http://www.klboard.ath.cx/bb/index.php?act...3539&hl=ws32kza (http://www.klboard.ath.cx/bb/index.php?act=ST&f=8&t=13539&hl=ws32kza)