Nsc32.exe - IRC/WMP Virus

punky · 04-04-2004, 01:31

On IRC, some people that I trust posted me a URL to a flash movie. Now, when I went there, ZoneAlarm caught a program, (Nsc32.exe) trying to access the net. I denied it while I tried to find out more about it. I checked Pview32, and found the program, and I suspected more of a rat, when it had no version details - which official software normally has. I thought I had better check the registry, and sure enough, it had added itself in the bootup section. Now, ZoneAlarm stopped it connecting to the net, i've terminated the process and stopped it booting up, so no harm, no fowl.

I've just asked the guy, and he said it is a virus that affects Windows Media Player, and it seems to advertise itself through IRC. I've checked all the big search engines and nothing substantial seems to come up. I've also checked Symantec, and nothing there either. I know it is not just a conincidence, because after I removed the registry setting, I went back, and sure enough ZoneAlarm stopped it and the registry setting reappeared.

It must be some up and coming virus, so be wary of it. I never actually got to see the flash movie, but as it was loading it said something about "Daisy", like "Loading my daisy" or something. The infected URL has the domain volja.net and ends in /f-tri/

HTH

Chris W · 04-04-2004, 01:40

was the process Nsc32.exe? or cncs32.exe?? I found this programme when i was looking at a flash game, and it tried to install itself to the c:\windows\system folder... sounds like either the same/ similar thing.

punky · 04-04-2004, 02:05

Could well be a variant. The one that kept installing itself for me was Nsc32.exe, and the system folder was where it put it as well.

Edit: Oh yeah, it is definitely nsc, not ncs.

Edit: It must of "patched" WMP because everytime I tried to start it, Nsc32.exe kept respawning. In the end I copped out and upgraded to WMP9, which seems to have stopped it.