This thread's last reply is from June 29, 2005, 3:36 AM UTC. Software, malware, and removal-tool
advice below may be out of date — treat specific steps and download links with caution.
wng_z3r0
I KNOW what ICQ is, but malware loves to hide as legitimate names.
I see no reason for icq.exe to have all these ports open:
1069, 3670, 1069 205.188.5.228:5190 ESTABLISHED, UDP MAIN:1039 *:* 1216
and 205.188.5.228
is whois'd to an AOL account, but why should that be happening?
ANYWAYS: please search and tell me the info of icq.exe
Thanks.
wng
stranger666
OK, here it is (I hope that is what you meant)
Location: C:\Programs\Inet\ICQ\icq.exe
File Version: 5.5.6.3916
Company: ICQ Inc
Created: Wednesday, May 25, 2005, 6:12:25 PM
Modified: Tuesday, October 14, 2003, 1:03:50 PM
Accessed: Today, June 26, 2005, 6:47:53 PM
That should be it.... What's next?
stranger666
Yep, the location is quite normal. I install all my programs in the Programs folder, which then gets divided into Inet, Utilities, Image etc.. So the location is fine.
The date is OK as well - I recently reinstalled the whole system, including ICQ.
So I don't think my poor internet pager was hacked by the wicked virus.
stranger666
Doubtful. I've been using Kazaa for a long time, never had a problem. And all this stuff started happenning right after I visited some sites looking for cracks - so it is a virus (or spyware), not a program, that causing all this to happen.