Laughing Virus?
DeadCat
My computer will randomly play a 'laugh track' while at the Windows 98
desktop; the recording lasts about seven seconds. I've heard it twice now
in the past week. Other than this 'laugh track' I've noticed no other ill
effects.
Scanning my system with McAfee Clinic and VirusScan 4.0 using heuristics and
the latest DAT files did not return any results.
The only suspicious program I've recently installed is 'FUCKUPC'. A program
which modifies your ARP table to remove a cable modem's upload cap.
However, I have friends who have also installed the same program, and have
not noticed any side-effects.
Does anyone know what this virus might be, or how to remove it?
dc
Please CC email in your reply.
mailto:deadcat_at_prontomail_dot_com
Bill
wrote:
>I'm relatively certain my system has been infected by some sort of virus.
And you're wrong.
Check your sounds properties.
Nick FitzGerald
> >I'm relatively certain my system has been infected by some sort of
virus.
>
> And you're wrong.
>
> Check your sounds properties.
Don't be so quick to judge, Bill.
I know that's probably wasted "advice" on you, but...
For details why, see my followup to the original poster.
--
Nick FitzGerald
DeadCat
I'm quite aware of how to check my sound properties. This is not a sound
caused by Windows, ICQ, or any other legitimate application. Nor does the
sound exist as a WAV, AU, or any other media file on any of my HDs.
dc
"Bill" <catb...@mindspring.com> wrote in message
news:dei5cscc7135jkrv6...@4ax.com...
> On Sun, 05 Mar 2000 20:17:12 GMT, "DeadCat" <dea...@prontomail.com>
Nick FitzGerald
> I'm relatively certain my system has been infected by some sort of virus.
More likely a RAT -- Remote Access Trojan (or Trapdoor).
> My computer will randomly play a 'laugh track' while at the Windows 98
> desktop; the recording lasts about seven seconds. I've heard it twice
now
> in the past week. Other than this 'laugh track' I've noticed no other
ill
> effects.
A couple of weeks back, several people reported a very similar,
if not the same symptom (without hearing it, it's difficult to
say for sure).
In three cases in which I was involved, this sound stopped
after we located and removed a then new version of the SubSeven
RAT (NAI/McAfee call it BackDoor-<variant>). It is possible
that someone is "playing with you" by having your PC play
sounds via a RAT.
Do you know how to search the usual registry and INI file keys
for things that are automatically started when Windows loads?
If so, report anything "odd" or suspicious to your AV tech
support. If you would like further assitance in checking these
startup settings, please Email me.
--
Nick FitzGerald
DeadCat
The only thing unusual present in my start-up (HKLM\...\Run,RunServices,etc)
is the FUCKUPC program I was talking about. As I said before, no one else I
know who runs this program has reported anything unusual. It is possible
they may have been using their soundcard at the time it would have occurred.
I run ConSeal PC Firewall, and haven't logged any strange incoming traffic
either.
I've removed FUCKUPC for the time being, but considering the random nature
of the problem, it is difficult to tell if it has anything to do with it.
dc
"Nick FitzGerald" <ni...@virus-l.demon.co.uk> wrote in message
news:01bf86eb$4a7e7020$0500000a@mobilenick...
Nick FitzGerald
> Thanks for your response Nick.
You're welcome.
> The only thing unusual present in my start-up
(HKLM\...\Run,RunServices,etc)
> is the FUCKUPC program I was talking about. As I said before, no one
else I
You checked run=, load= in WIN.INI, shell= in SYSTEM.INI?
(there are many others that can be used, but these are
most common). Are you sure you did not miss something
because it has a "familiar looking name", but which in
fact is out of place?
> I run ConSeal PC Firewall, and haven't logged any strange incoming
traffic
> either.
What does Conseal consider as strange local listening
ports? I have no idea what Conseal's default config is
like, but maybe it isn't much good on listening ports,
considering "normal" some things it should not?
> I've removed FUCKUPC for the time being, but considering the random
nature
> of the problem, it is difficult to tell if it has anything to do with it.
8-) Always a bit of a problem that...
--
Nick FitzGerald
DeadCat
the Windows defaults are present.
ConSeal is a fully configurable "true" firewall. I have my ruleset
configured to allow only ARP, Ping, DNS, Identification, and UDP/TCP in the
temp range (both of which are logged). All outgoing UPD/TCP is logged as
well.
I'm likely going to wipe and reinstall my OS... but it would be nice to know
what caused the problem first, so it doesn't happen again. :)
dc
"Nick FitzGerald" <ni...@virus-l.demon.co.uk> wrote in message
news:01bf86ef$b452e360$0500000a@mobilenick...
Kaiser-Sose
it a chance. Most things will be where Nick said they would be. They also
can be disabled and enabled through System Tools\System Information
[Tools][System Configuration] assuming your on Win98. If you give that a
try you might then see it. I would say that people should almost never have
to re-format.
-Kaiser
DeadCat <dea...@prontomail.com> wrote in message
news:2nBw4.42006$c7.10...@news1.rdc1.on.wave.home.com...
mark
windows option that can be changed easily through control panel
DeadCat <dea...@prontomail.com> wrote in message
news:chzw4.41686$c7.10...@news1.rdc1.on.wave.home.com...
> I'm relatively certain my system has been infected by some sort of virus.
>
> My computer will randomly play a 'laugh track' while at the Windows 98
> desktop; the recording lasts about seven seconds. I've heard it twice now
> in the past week. Other than this 'laugh track' I've noticed no other ill
> effects.
>
mark
if your have checked all this and still think that you are infected with a
virus/trogan/worm...from this file, send a sample of the file to the
research center of your antivirus company!