I presume it is some sort of virus, and apparently, it is in my startup. I unchecked it in MSCONFIG, but I have no idea where it is located. Help please?

Edit: Also, what the fuck is Ptsnoop?

[This message has been edited by MagKnightX (edited 07-25-2002).]

http://www.f-secure.com/v-descs/ptsnoop.shtml
NAME: Ptsnoop
ALIAS: Backdoor.Ptsnoop

Ptsnoop is a simple backdoor program written in Visual Basic. Being activated it first looks for active RAS connections and exits immediately if none is found.

If a connection is present, the backdoor installs itself to system by copying itself as PTSNOOP.EXE file to \Windows\System\ directory and modifying WIN.INI file.



http://www.europe.f-secure.com/v-descs/kitro.shtml

VARIANT: I-Worm.Kitro.d


This version of the worm is similar to I-Worm.Kitro.b. It is a Control Panel applet, its size is 169984 bytes.

The worm copies itself to the Windows directory with following names:


PostalDeAmistad.pif
Cristo_Nos_Ense�a.Doc.pif
Listado.txt.by.Microsoft.com
List.txt.by.Microsoft.com
PostalDeAmistad.pif
Facturas556.XLS.pif
EnLosAndes.pif
YaNoPuedoSerYoMismo.DOC.pif
ReparacionDeMessenger.DOC.pif
TestDeAmoryAmistad.DOC.pif

Then the worm executes one of its copies in the Windows directory. It also randomly selects several its copies, and sets them up to be executed when Windows starts by writing the following autorun keys:


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
BNexe = (one of the file names above)
Zonavirus = (path to the worm's copy)

Depending upon internal conditions, the "Zonavirus" value may be overwritten with the current time value.

It also copies itself to the following locations:

c:\zonavirus.Dll
C:\Bn.exe

While installing in the system, the worm shows a fake error message:

This might sound silly but why would someone write a trojan or virus and name it snoop or virus in the name itself. LOL

FUCK! Well, I had YaNoPuedoSerYoMismo.DOC.pif, and I deleted it, as well as something called BanderaNegra in my C drive, and a shitload of other fake EXEs that I didn't want. I deleted it from my registry, and the PTSNOOP registry key. Thanks. I'm gonna have to look through my comp for that shit. Maybe my computer will improve. Jeebis Fucking Hobbling Crisp.

Edit: I had all of that CRAP on my computer. Fucking A. Shit. This is why I want a Mac. Pretty much no viruses/spyware.

[This message has been edited by MagKnightX (edited 07-25-2002).]

quote:

---

Originally posted by tr0g:
This might sound silly but why would someone write a trojan or virus and name it snoop or virus in the name itself. LOL

---

because if you see it running, it�s already to late ...

Virus's are really really crap.

Have you ever seen weird science ? The computer on that is amazing it even creates a women called Lisa. Its all so fake but i love it.

Peace Renegade,

AIN.....

I checked out that link you posted, and it said that the virus is sent via e-mail, and the title, message, etc would be in Spanish.

I have had 3 e-mails in spanish, from ppl on my contact list who have not mailed me for ages... What do I do?

How do I find out if I have a worm in my system, and how do I get rid of it?

Cheerz

------
Aloha.
------

http://housecall.antivirus.com/housecall/start_pcc.asp

good place to start.. free online virus scan.

Cheerz, Mute.

------
Aloha.
------

[This message has been edited by MoRt (edited 07-26-2002).]