Go Back   PCMech Forums > Help & Discussion > Internet, Web Applications, & The Cloud

Need Some Help? Type Your Keywords Here:

Reply
 
LinkBack Thread Tools Search this Thread Rate Thread Display Modes
Old 09-12-2000, 12:20 PM   #1
Member (3 bit)
 
Join Date: Sep 2000
Posts: 7
Exclamation

just yesterday I received 3 calls from 911 dispatch saying that my pc call 911. I had my pc up and running in the other room but was not in use by anyone! So after the 3rd call from the dispatch, I powered it down. What should I check for causes to why this possessed pc would call 911 by itself?
greyheart is offline   Reply With Quote
Old 09-12-2000, 12:29 PM   #2
Ride 'em Cowboy
 
EzyStvy's Avatar
 
Join Date: Dec 1999
Location: Dallas, Tx
Posts: 9,108
Your PC isn't possessed, its infected.

911 Virus
Name: 911 Virus
Generally Known As: Chode, Foreskin, BAT911

Date First Found: Date: 04-01-2000

Transmitted Through: It self progrates to shared drives

The virus appears as: ASHIELD.PIF, NETSTAT.PIF, WINSOCK.VBS

Characteristics: Worm

Details:
It's a worm that scans the computers from the internet and once it finds shared drives, it copies itself to the shared drives and it does the following:

create C:\Program Files\Chode directory
dial a modem to 911 at least two times out of five tries
put ashield.pif,winsock.vbs, and netstat.pif into the Program-StartUp
log the infection in C:\PROGRAM FILES\chode\chode.txt.
On the 19th of a month, the worm deletes the following directories:
C:\windows
C:\windows\system
C:\windows\command
C:\
Then, it displays two message boxes:

You Have Been Infected By Chode
You may now turn this piece of **** off!

If your computer is infected:
It's easy to remove the worm. Do the following:

Delete the C:\Program Files\Chode directory.
Delete C:\WINDOWS\START MENU\PROGRAMS\STARTUP\ASHIELD.PIF
Delete C:\WINDOWS\START MENU\PROGRAMS\STARTUP\NETSTAT.PIF
Delete C:\WINDOWS\START MENU\PROGRAMS\STARTUP\WINSOCK.VBS


http://www.911virusalert.com/viruses...00046000000000
EzyStvy is offline   Reply With Quote
Old 09-12-2000, 06:55 PM   #3
Member
 
archie's Avatar
 
Join Date: Mar 1999
Location: Ontario, Canada
Posts: 3,392
Hi Greyheart, you may be interested in reading the following thread in the Win9x forum ... AV programs that other members use. http://206.161.202.65/forum/showthre...?threadid=3520
__________________
/\rchie
archie is offline   Reply With Quote
Reply

Bookmarks

Still Need Help? Type Your Keywords Here:


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT -5. The time now is 06:23 AM.
Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2012, vBulletin Solutions, Inc.
SEO by vBSEO 3.6.0 PL2