[RESOLVED] Has anyone seen this virus??

[furlong47]

Woo-hoo!! First post in the new forum!!
Anyhow...got back from class today and surprise this girl down the hall has yet ANOTHER virus...this one takes any keyboard input and displays "I AM ****ING GAY" over and over, and seems to be caused by a program called loadwc which is loaded on startup. Pressing ctrl-alt-del and closing out this program returns keyboard function to normal, until restart. I can't find any reference to this anywhere, so I am wondering if anyone has heard of it. It seems like it shouldn't be too hard to get rid of but I'm worrying that it may have a secret payload.

[ibennetch]

loadwc seems to be an internet explorer thing (see MS knowledge base. runs from C:\windows\system I believe.
Perhaps the virus overwrote that file; it doesn't run constantly on my machine, but then again I don't know anything else about it. maybe reinstalling IE would do the trick if this is the case. anyone else have anything add to my lack-of-knowledge? {please say yes as I am curious about this virus attack myself now}

[This message has been edited by ibennetch (edited December 04, 2000).]

[furlong47]

Yes, soon after that post I looked up loadwc and found that it is part of IE.
Funny thing is, now the keyboard doesn't work even when I close out loadwc.
I can't find anything about a virus with this effect; is it possible this is a joke program, and if so how do I get rid of it??

[furlong47]

Well after all that we have discovered indeed this is a joke program...now only need to find out where it is loading from on startup and disable it...

[Damned Angel]

WOOHOO....got a new forum generated!!!

anyhoo...check the registry for the program, just do a search, it it has a run= in front of it...kill it.

besure to backup the registry first though.

[furlong47]

Problem solved!!
We found the computer on the network where she got this thing from in the first place, and were able to determine the software developer. At their website it said what registry key to delete. This program is an interesting little number called "Keystroke Panic" which can replace whatever is typed on the victim's keyboard with any text string you want

[Zleaper]

Ya We got it up here in Ny too I was tring to find solution came across your post

Tring to get though regedit but cant find a thing

[Zleaper]

You can't get to any serch keys due to the fact that this joke virus takes over all txt input

What registry key is it you did;t say frunlog

[furlong47]

You'll have to get to regedit through explorer, since obviously your keyboard won't work. If you HAVE to type something, you'll need to cut and paste the letters from other previously-created documents.

In regedit open this key: HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run, and then delete a string value named DATCHECK.
Restart your computer and your keyboard should work.

Information on this program can be found here: http://www.dewasoft.com/Software/KeyPanic/KeyPanic.html
It's a VERY nasty little joke especially to play on inexperienced users http://forums.windrivers.com/cgi-bin/forum/frown.gif

[Zleaper]

Thanks for the info we got the bug