-
Never ever ever ever ever ever ever ever ever
Install doom3 alpha patch ( i don`t remember the exact filename)
It contains some kind of trojan or virus.
The trojan/virus starts up with windows as ws32kza.exe
And create a folder in the system32 directory called KLM
It infects some dll files in the win system32 directory, and it create`s 2 folders with blank mp3 files.
And it copies itself in the kazaa shared folder as some popular files, like adobe photoshop etc.
I had this trojan/virus a couple of weeks ago, my virus scanner did not see this file as a virus and i still can`t find it on any of the anti virus sites.
Spybot and ad-aware 6 also doesn`t see them.
So yesterday i opened the file with a hex editor and i saw that some .dll files in the win system directory where listed in the file, also i could see a couple off strings like: Create in
c:\program files\kazaa\My Shared Folder\*FILE NAME*.exe
c:\program files\kazaa lite\My Shared Folder\*FILE NAME*.exe
So i reinstalled my windows xp, since i can`t "clean" the affected files in my windows directory.
So please check if you have a \KLM folder in your windows system32 directory
-
omg? you sure? i had doom 3 demo and i was sharing the doom path and my antivirus didn't pick anything up? and i scan everything i download?
-
Yes i am sure, just check your win dir.
And if you search for doom 3 alpha patch in kazaa you will get multiple results, but i can`t remember what the file with the virus inside was.
so maybe your safe
-
do you have more information about this virus or what does it do? because my computer didn't have virus for now over a year. I scan mostly every week or so..
I looked where you said though nothing. thank god. after you said that about doom 3 path, i got little jumpy because i share that. well i hope its clean nothing picks up
-
When i discovered this file i posted something in the question section of this forum:
http://www.klboard.ath.cx/bb/index.php?act...3863&hl=ws32kza
I just did a search in this forum about my old post, and i found another one with the same problem:
http://www.klboard.ath.cx/bb/index.php?act...3539&hl=ws32kza
