jammin — Sun, 07 Sep 2003 05:32:35 +0000

yup its a virus, and norton had a field day when i opened this post.

Quote: HTML.Redlof.A is a polymorphic, encrypted, Visual Basic Script virus that infects .html, .htm, .asp, .php, .jsp, and .vbs files on all drives. Depending on the location of the Windows System folder, the virus copies itself to either %windir%\System\Kernel.dll or %windir%\System\Kernel32.dll. It changes the default association for .dll files.

go here for more info on it. seems annoying.

and if you dont have antivirus software then go to this site to scan for free. I have to warn you though, it may take a while on slower internet speeds.

good luck getting rid of the virus, and when you do get rid of the virus be sure to tell anyone you may have e-mailed that they too may be infected, since this virus is spread by e-mail.

Re: a worm?

Renegade — Sun, 07 Sep 2003 01:20:08 +0000

Quote: Originally posted by jowp
well, there's this very annoying virus that makes a hidden copies of desktop.ini and folder.htt in almost every folder of my drive.. do you think this would have caused the code??

Yes you do have a virus, its called MS Windows, it does that.

MS Word does that too with the default.dot file, check your hard drive for it.

necrotic — Sat, 06 Sep 2003 16:56:33 +0000

Because of the code above. Its most likely the virus that McAfee is finding.

m3rajk — Fri, 05 Sep 2003 16:45:57 +0000

i have a question, what is it about this particular thread that had my virus scanner catch a malicious script upon it's loading.
i've checked. it is JUST this thread (mcafee virus scan 7.0)

name: VBS/Redlof@M

Vincent Puglia — Thu, 04 Sep 2003 23:46:21 +0000

Hi,

On the non-paranoid level: Was the page originally on the net? Did you upload and then download it, not necessarily during the same session?
the reason I ask: once or twice when uploading pages to my site I identified them as the wrong type in the ftp agent. The result was half text, half code.

Vinny

tuffy — Wed, 03 Sep 2003 15:45:21 +0000

Hi,

If you have one virus, you may have others. Get rid of them. Try an online virus scanner if you don't have a virus protection program.

Make sure you are ftping in the correct format. If you open your file in any other editor, notepad, word, etc, this may also sometimes cause similar problems.

Hope this helps.

a worm?

jowp — Wed, 03 Sep 2003 06:54:12 +0000

as far as i know, i don't think my pc's been attacked by such things..
well, there's this very annoying virus that makes a hidden copies of desktop.ini and folder.htt in almost every folder of my drive.. do you think this would have caused the code??

druagord — Tue, 02 Sep 2003 21:30:11 +0000

I am no specialist but this look like some malicious code. I suggest you make sure a worm didn't get a old of your pc

Renegade — Sun, 31 Aug 2003 10:37:20 +0000

I don't think CJB.net put anything on your site for they only do redirecting but its quite possible that Geocities did.