New worm (to me anyways).

[StevenT]

:|:|Just to let people know I recently found a new worm on the Dnet client. the config file is as follows;

//start file
[parameters]
id=bymer@ukrpost.net
[misc]
project-priority=OGR,RC5,CSC,DES
[rc5]
fetch-workunit-threshold=64
randomprefix=20
[ogr]
fetch-workunit-threshold=16
[triggers]
restart-on-config-file-change=yes
//end file

Type "msconfig" in the Run dialogue box and look in the "startup" tab to find the dnetc client (from C:\windows\system|dnetc -hide). remove the check mark, then go into your \windows\system directory and find the buffer files (OGR and RC5) as well as the 2 DNETC files and delete them.

I know that people probably found this one about 10 seconds after it was out, but I do not have time to come on this board very often and just wanted to raise awareness. I lost a couple of weeks of block to this guy, so I hope his account has been axed already.:|

 

[Moose]

It was axed along time ago (Sep 2000)

See http://www.distributed.net/trojans.html for all the info you ever wanted on this worm. See item 3 for this worm. Plese read the whole page to understand how this got on your computer and what steps you can take to not get the worm again.

Sorry you were a victum of this worm.
paul

 

[RaySun2Be]

StevenT,
Yep, the bymer worm :| has been around for awhile now, you might want to run dnets dewormer. The dwormer and info about the worm is here: Trojans & Worms

Check to make sure you don't have any shared folders open to the Internet, as that's how it infects the PC.

[edit]
DOH! Moose was quick!

 

[StevenT]

Hehe, thanks for the info guys! Sorry about being so behind the times, maybe I should keep up a little more

 

[ViRGE]

Ugg, things get worse. News.com just did a special report about worms today, and everyone's favorite worm was mentioned, Bymer.:|