As soon as I delete the contents of the temp directory, it starts filling up again! I did a virus scan, but it came up empty. I can't use my computer because the hard drive keeps thrashing (as it is copying files constantly).

Has anyone seen this before and what can be done?

Thanks.

It creates a folder in Windows/temp called 'sys32' and proceedes to fill it up with random junk it copies from other folders. It also wants to connect to the net, and when you do that it starts downloading random files and places these in there as well.

If you delete the sys32 folder, the process stops immediately...until you reboot, wherein the process starts all over again (and it wants to connect to the net, etc).

Everything seems to work fine - nothing is damaged.

No virus definitions I have found correspond to this.

I suspect I might be backing up my files and erasing my hard drive soon...
 

Jerry's suggestion was great - taskinfo found the culprit. There's a file called explorer.scr that starts running whenever I boot the machine. I imagine .scr is some kind of script?

What else would I have to delete so that it doesn't execute this script upon booting?

Thanks, Jerry!

EDIT: Ah, got it! Everything in the system folder starts upon booting (makes sense I guess). You also cannot delete stuff from the system folder once you have booted since that file is in use...so I booted from a floppy and...it worked!

Now, the only question that remains is this: who would write such a horrible program and to what avail?

To attempt to answer some of your questions; .SCR extensions are supposedly Windows screensavers, which by my crotchity definition are close to viruses even when properly made. Windows will execute a program labelled with an .SCR extension, as you found. This can fool some people into downloading a file that they think is innocent, whereas they might not download and .EXE or .COM extension.

What is it doing? My guess is that it is looking to send the information it finds to some remote computer, as a hack or for some nefarious purpose. The code is probably written by some script-kiddie and that is why it crashes your computer rather than sending the files.

Virus definition files are a weak point in anti-viruses, as you just found. You may find that some virus databases like NAV will find a virus when another like MaCaffe will totally miss it. New viruses can be totally missed.

Look for virus and trojan problems to get much much worse in the coming years. DOS was built simply and viruses had few places to hide. Multitasking operating systems provide many places and obscure names where a virus can hide without being detected.

Now that you've dispatched the main program, I would suggest using the My_Computer/File/Find dialog box to find any files that contain the word "explorer.scr" Most script kiddies don't know how to parse out a name, and you will most likely find a mother file or program ready to reinstall this POS. I would be curious to know the name of that program. If you have the file, you might send a copy to Symantec or the other anti-virus companies.

If this is "checked", you won't see the file extensions for known file types... so if I send you a file like "greatpic.jpg.exe" you will only see the "greatpic.jpg" filename, and we all know a .jpg file is relatively safe to open... except it's really a program (and undoubtedly evil: there is no reason to hide a friendly program). This camouflage is used by many "social engineering" virus distributions.
There are dozens of known file extensions that are "executable" and can carry a virus payload. Any file with a double extension (like *.jpg.vbs) or any unknown (to you) extension should NEVER be opened. Doing a google search for the extension will usually tell you the function or parent program involved if you're curious.

And keep up to date via Windows Update. It doesn't make you invincible but once a vulnerability gets a "Critical Update" fix posted there, the whole black hat world knows about it and suddenly exploits appear in the wild... they try and take advantage of everyone who hasn't bothered with the updates.
 

I searched my hard drive for other files containing explorer.scr and there were a few instances of it (in outlook express, no less!) but no executables as such. I removed them all.
 

If someone is specifically trying to hack your machine, the little zit-laden moron using his script kiddie programs will give up quickly if he finds you are using a firewall. This kind of reminds of that statistic in how most cars that get stolen were unlocked. Many computers that get hacked are hacked partly as a fault of the user not "locking the doors".

Canning Win9x and going with WinNT/2000/XP Pro would be another good move. But when using those operating systems, you do need to do your homework and go through the effort of setting your permissions (which can be done down to specific folders and files, which Win9.x/ME cannot do at all).
 

I get a list of all the potential threats it picks up, and it traces back to find out details of the source. It links to their website to explain what each type of attack is doing, and even tells you whether the OS (wink 2k in my case, also recomeded) or BlackIce blocked the attck. You can easily set up filters to block/allow certain types of connection. And it now prevents unauthorised software running and/or connecting to the network with minimal configuration required. It even noticed that I had upgraded windows explorer and asked me before letting it run again.

John
 

I agree that upgrading to XP would probably be the best move, along with using a firewall. Perhaps I could use my current machine as a hardware firewall when I get the new system. How would I get started in achieving this? Any recommendations for sites where I can learn more about this?
 

------------------
John P. Pytlak, Senior Technical Specialist
Worldwide Technical Services, Entertainment Imaging
Research Labs, Building 69, Room 7525A
Rochester, New York, 14650-1922 USA
Tel: +1 585 477 5325 Cell: +1 585 781 4036 Fax: +1 585 722 7243
e-mail: john.pytlak@kodak.com
Web site: http://www.kodak.com/go/motion
 

http://news.com.com/2100-1001-918132.html?legacy=cnet&tag=lthd

Here's removal instructions from McAfee:

http://vil.mcafee.com/dispVirus.asp?virus_k=99495

------------------
Colin Wiseley
Lyric Theatre
Blacksburg, VA
www.thelyric.com

Having said that, it's worth pointing out that firewalls are, by themselves, not a panacea for security threats. For most individual users, "get a firewall" is really lousy advice, since it tends to result in a false sense of security for novice users who have just managed to install the latest windows-based firewall software on their PC, without really understanding what it does.

A much better approach would be to configure the operating system properly in the first place, which makes firewalls unnecessary. Turn off all public services (mail and web servics, Windows file sharing, NFS/portmap, etc.) except those whose risk is determined to be justified.

Firewalls are useful in large organizations (companies, etc.) where there are large numbers of machines and the risk that one might be misconfigured is high. The concept of a firewall is not supposed to be a primary defense, but rather an added security measure to protect against accidental misconfiguration. For individual users with one or two computers, I'd strongly suggest spending the time to configure them properly in the first place instead of trying to protect a wide-open OS install with something that may or may not do any good.

They also can prevent an app from accessing TCP/IP (or any net protocol). This is very useful for tracking down trojans and/or spyware. Not all malware is obvious, like Kazaa. For instance, a friend of my wife put a free Barbie game she got from a box of cereal on her computer for her daughter. Turns out, it had spyware attached, and would regularly "phone home" with whatever info it had compiled. The firewall I installed on her machine when she got cable caught the executable in the act, and I was able to remove it.

With more and more average joes getting high speed, constant connections to their home computers, as well as setting up home LANs, it gets harder and harder to educate people. How many people who have setup (or had a friend or family member setup) a home LAN know it is a really bad idea to bind TCP/IP to windows services? Not many. In fact, this is one of the most common flaw in home LANs today.

Education is definately important, but it can't do the job alone.
 

www.boingboing.net has posted this info about the virus and its authors:

The Benjamin Worm, virus that's sweeping the Kazaa file-sharing network, is a supposed "white hat" worm that was developed to scare people away from making unauthorized copies of copyrighted works on P2P networks.

According to one of its developers, Paul Komoszki, Benjamin is a "controlled test" of a program designed to disrupt the illegal exchange of copyrighted data and child porn over peer-to-peer networks.
"We do not want to affect the exchange of legal programs and legal music files. Only users who are looking for and sharing copyrighted files could be infected," said Komoszki in an e-mail interview today.

Once it infects a Kazaa user's computer, Benjamin creates numerous copies of itself under file names that may be of interest to other Kazaa users, according to anti-virus firms. Examples include borlanddelphi-full-downloader.exe and Braveheart-Special Edition-divx.exe, according to Kaspersky Labs.

Pardon my French, but what a flaming self-rightous scumbag idiot! I hope someone sues the pants off him, and he is placed pantless in front of people his worm has infected. Does he think that because one user of a computer does something he doesn't like, ALL the users of that computer should be punished? This isn't a one person/one computer world. Besides, who the f... does he think he is making such decisions outside of the legal system? White hat worm, bullshit. I can see his little worm infecting unintended targets very easily and causing serious damage. This guys is a man with too many tools and too few brains. Even though I don't file share, and I never have, I have nothing but contempt for this loser.