TROJAN HORSE

[Goauld]

It would have been nice to hear this earlier Shawn. If you're IRC has been targetted by them before then it would seem that there is a good chance this is what has happened here.

As for how I came up with the link, well you're signature does seem to indicate some association with them, whether that is rightly or wrongly so, it's at least an incovenient coincidence.

And it would seem they (sic: Forever Hacking) are a bunch o kiddies. Hopefully some day they'll grow up.

[tcsmyworld]

BTW Goauld , what you are refering to as "link" in Shawns signature is , in fact , not a link at all just information about his status on that server.
If you run your mouse over it you'll see that there is no link attached to it.
Just an FYI.

[Goauld]

Hehehe, I didn't mean a web link - I implied a social link, it would seem wrongly so, but it's easy to see how that mistake coudl be made, I would hope...

[Merth]

Originally Posted by Goauld

How do you arrive at this conclusion? The delivery method doesn''t seem to be referred to at the Symantec Security Response centre...

You have never once stated that you made a visit to our IRC server - given the 'matter of fact' tone of your posts, it's obvious you would have stated as such.

HOW DO YOU BELIEVE THIS TROJAN MADE ITS WAY ONTO YOUR COMPUTER? Please, you've got me really curious now. Just answer this one question, don't skip it again. If you only have theories, then please state those. I believe your answer will demonstrate a misunderstanding that can easily be rectified.

I'm still waiting for an answer on how you know it made a connection to a specific IRC channel, as well. Heck, I'd like to know how you know it made a connection to anything at all.

[Shawn319]

There is no "social link". the "foreverhacking" i am ascociated with is NOT the same "Forever-Hacking" that seems to be hacking YOU.

[Goauld]

I have since removed the IRC client I was using, but from my recollection on the 28/07, I had connected to the EQEmu IRC, whereupon I found myself in an apparently empty channel (EQEMU) and was unable to chat.

Perhaps this is where you can help me to better understand the possible delivery method here. Is it possible for someone to setup a redirect from your channel, or is this merely likely to be due to the use of a bot?

I did post elsewhere on this forum, regarding an apparent problem I encountered on IRC - this being that I appeared to be in the EQEMU channel on my own as an Op. What made this stick in my mind was the fact that it was a connection to an existing channel, but I was the only member present...

[Shawn319]

The EQEmu channel is never empty. and even if it was, it's registered so that you would not become an OP if you were the only person in the room. Usually when channels are not registered the first person to visit the room gets OP'd.

What made this stick in my mind was the fact that it was a connection to an existing channel, but I was the only member present...

The fact that the room OP'd you makes me believe the channel was not there until you joined it. so you could have joined a non-eqemu IRC server (note the term "server") and joined a channel that was not there to begin with. This could mean anything.

If what you speak is true then you were not connected to the official EQEmu server (irc.eqemu.net).

Beyond that, speculation is up to you. this topic need not go any further..

I'll let you reply again since this is your thread, then i'm going to lock it.

[Goauld]

I hear what you're saying but I definitley connected to irc.eqemu.net

<shrugs>

[Shawn319]

maybe that was part of the virus... making you think you were connected to an irc server that you were not? *shrug*.. all i know is #eqemu is never empty.