# Virus troll.

**URL:** <https://discourse.rpgclassics.com/t/virus-troll/14194>\
**Category:** The Chat Room Forum\
**Created:** [July 10, 2005, 8:07pm UTC](https://discourse.rpgclassics.com/t/virus-troll/14194 "2005-07-10T20:07:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kaseli](https://discourse-cdn.rpgclassics.com/user_avatar/discourse.rpgclassics.com/kaseli/32/76_2.png) [@kaseli](https://discourse.rpgclassics.com/u/kaseli)\
**Post date:** [July 10, 2005, 8:07pm UTC](https://discourse.rpgclassics.com/t/virus-troll/14194/1 "2005-07-10T20:07:10Z")

</div>

When i joined the main room this evening, i was instantly message by “SF|Swen”. He was clearly a bot. He sent me a link to ([http://www.rpgclassics.com](http://www.rpgclassics.com)) in a private message.

The link sends you to a java application that is actually a flash document embedded with java. The flash document shows you battlefield 2 screenshots, then redirects to [about.com](http://about.com). He quit IRC as soon as i clicked the link.

The java enables an install into your flashplayer of “w32/Sdbot.worm.gen.g”. It is a just a generic worm, but he is still acting with malicious intent.

```php
<SF|Swen> Hi! AAA whats a cheater: http://www.rpgclassics.com
<devillion> Excuse me?

```

The only reason i clicked it was because it had AAA in it…i thought it was a ddr score screenshot D:

---

<div class="post-metadata">

**Author:** ![Demon](https://discourse-cdn.rpgclassics.com/letter_avatar_proxy/v4/letter/d/7ba0ec/32.png) [@Demon](https://discourse.rpgclassics.com/u/Demon)\
**Post date:** [July 27, 2005, 4:02pm UTC](https://discourse.rpgclassics.com/t/virus-troll/14194/2 "2005-07-27T16:02:11Z")

</div>

so what did it do to your computer?

---

<div class="post-metadata">

**Author:** ![Rhaka](https://discourse-cdn.rpgclassics.com/user_avatar/discourse.rpgclassics.com/rhaka/32/31_2.png) [@Rhaka](https://discourse.rpgclassics.com/u/Rhaka)\
**Post date:** [July 27, 2005, 4:21pm UTC](https://discourse.rpgclassics.com/t/virus-troll/14194/3 "2005-07-27T16:21:44Z")

</div>

This has already been resolved.

And I just realized that editing out the URL might be a smart thing.