Thursday, March 10, 2005

SpAcDaemon Virus

Today I was kind of doing some house keeping job on my computer.
To my supprise, when I went to My Computer -> System Properties,
I was looking at a picture of Bart Simpson and some weird info
like this:

Manufactured and supported by:
SPAC
thespacdude@yahoo.com

and when I clicked on Support Information, it shows:

SPAC
ERROR: Water detected in the BIOS.

Something wonderful has happened,
your computer is alive......

I googled it, I also tried McFee, Symantec, MS AntiSpyware, Adware, SpyBot, F-Secure, etc.
But none would detect any virus or trojans in my computer.
There're 2 strange behavior on my computer recently.
1. At Windows Startup, it plays some weird sound... you hear someone laughing.
2. It changed my OEM information, so I saw "Manufactured and supported by: SPAC"

After about 3 hours of digging thru my registry and system files, I found it.
The file is c:\windows\mssreprc.exe
also it creates a registry key

Name:SpAcDaemon Value: C:\WINDOWS\mssreprc.exe
under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
It changed my C:\WINDOWS\system32\OEMINFO.INI to the following:

[general]
Manufacturer=SPAC
Model=thespacdude@yahoo.com
[Support Information]
Line1= ERROR: Water detected in the BIOS.
Line2=
Line3= Something wonderful has happened,
Line4= your computer is alive......

and created a Bart Simpson Logo as a bmp file
C:\WINDOWS\system32\Oemlogo.bmp