Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Just installed some RAM and this happens on boot.


  • Please log in to reply
30 replies to this topic

#1 Roblox

Roblox

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 30 October 2014 - 10:24 AM

I get a screen saying this:

W O R M S    A G A I N S T    N U C L E A R    K I L L E R S
    _______________________________________________________________
    \__  ____________  _____    ________    ____  ____   __  _____/
     \ \ \    /\    / /    / /\ \       | \ \  | |    | | / /    /
      \ \ \  /  \  / /    / /__\ \      | |\ \ | |    | |/ /    /
       \ \ \/ /\ \/ /    / ______ \     | | \ \| |    | |\ \   /
        \_\  /__\  /____/ /______\ \____| |__\ | |____| |_\ \_/
         \___________________________________________________/
          \                                                 /
           \    Your System Has Been Officically WANKed    /
            \_____________________________________________/
 
     You talk of times of peace for all, and then prepare for war.

It just won't go away! how can i fix this?



BC AdBot (Login to Remove)

 


#2 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,638 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:00 PM

Posted 30 October 2014 - 12:13 PM

Hello,

That is a very peculiar problem. :) If its not too much work, could you try to swap the sticks and reinstall the old RAM, just to see if the message disappears if you do?

 

Also, when in the boot process does this appear exactly?


regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft

 

animinionsmalltext.gif


#3 Roblox

Roblox
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 30 October 2014 - 01:04 PM

Put my old sticks in and it's still a issue.



#4 Roblox

Roblox
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 30 October 2014 - 01:06 PM

It appears after the menu with the options to launch BIOS.



#5 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,638 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:00 PM

Posted 30 October 2014 - 01:16 PM

In that case it is not related to the RAM replacement. Do you have more than one hard disk installed?


regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft

 

animinionsmalltext.gif


#6 zingo156

zingo156

  • BC Advisor
  • 3,345 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:00 AM

Posted 30 October 2014 - 01:32 PM

This is a worm: http://en.wikipedia.org/wiki/WANK_%28computer_worm%29


If I am helping you with a problem and I have not responded within 48 hours please send me a PM.

#7 Roblox

Roblox
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 30 October 2014 - 01:41 PM

I have 1 hard disk installed.



#8 zingo156

zingo156

  • BC Advisor
  • 3,345 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:00 AM

Posted 30 October 2014 - 01:42 PM

This might help out: http://www.securityfocus.com/advisories/693


If I am helping you with a problem and I have not responded within 48 hours please send me a PM.

#9 zingo156

zingo156

  • BC Advisor
  • 3,345 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:00 AM

Posted 30 October 2014 - 01:46 PM

Notice this is from 1989? Where and how on earth did you get this one, unless maybe someone brought it back.

5. WORM FILES

The WORM source files are W.COM or a single alphabetic character (C or
D) followed by 4 or 5 numeric characters. (Cnnnnn.COM), ("nnnn"
represents a random number).  The WORM will start a process or
processes running.  These processes are named in format NETW_nnnn, and
should be deleted.  PHONE_nnnn may also be running as the WORM utilizes
the PHONE object in an attempt to send a message to a user on another
randomly selected node.

6. ALARMS

Some alarms generated by the WORM are related to PHONE.EXE and
FAL.EXE.  The majority of the alarms are login failures as the WORM
attempts to log into specific accounts.


Edited by zingo156, 30 October 2014 - 01:46 PM.

If I am helping you with a problem and I have not responded within 48 hours please send me a PM.

#10 Roblox

Roblox
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 30 October 2014 - 02:03 PM

How do i get rid of it then?



#11 zingo156

zingo156

  • BC Advisor
  • 3,345 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:00 AM

Posted 30 October 2014 - 02:06 PM

At the moment I am still uncertain. Can you boot into safe mode by tapping F8 on boot?


If I am helping you with a problem and I have not responded within 48 hours please send me a PM.

#12 Roblox

Roblox
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 30 October 2014 - 02:09 PM

Just tried and the computer turned itself off.

Booted back up and still displays the worm.



#13 jonuk76

jonuk76

  • Members
  • 2,182 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Wales, UK
  • Local time:10:00 AM

Posted 30 October 2014 - 02:12 PM

 

Notice this is from 1989? Where and how on earth did you get this one, unless maybe someone brought it back.

5. WORM FILES

The WORM source files are W.COM or a single alphabetic character (C or
D) followed by 4 or 5 numeric characters. (Cnnnnn.COM), ("nnnn"
represents a random number).  The WORM will start a process or
processes running.  These processes are named in format NETW_nnnn, and
should be deleted.  PHONE_nnnn may also be running as the WORM utilizes
the PHONE object in an attempt to send a message to a user on another
randomly selected node.

6. ALARMS

Some alarms generated by the WORM are related to PHONE.EXE and
FAL.EXE.  The majority of the alarms are login failures as the WORM
attempts to log into specific accounts.

 

Also notice it affects DEC VMS systems.  Very strange.


7sbvuf-6.png


#14 Roblox

Roblox
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 30 October 2014 - 02:17 PM

@zingo that is strange. maybe someone re wrote it and infected it in to my win 7 computer i am working on. But it only happened after installing my new RAM sticks from CEX.


Edited by Roblox, 30 October 2014 - 02:18 PM.


#15 zingo156

zingo156

  • BC Advisor
  • 3,345 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:00 AM

Posted 30 October 2014 - 02:18 PM

This one has me quite confused. What is the OS of this computer?


If I am helping you with a problem and I have not responded within 48 hours please send me a PM.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users