"NT AUTHORITY SYSTEM" is shutting down my computer when online - GoFuckYourself.com

BVF · 08-11-2003, 01:11 PM

Maybe someone on here can help me....My laptop automatically shuts down and restarts and says that a remote call procedure has failed and it has to shut down. It says the program that does it is NT AUTHORITY SYSTEM. When my laptop isn't online, it works fine and doesn't shut down..It only works when I am on the internet.

I'm using Windows XP..Has anybody had this problem and know how to fix it...If I didn't have another computer, I'd be fucked because I wouldn't even be able to ask for help online.

galleryseek · 08-11-2003, 01:13 PM

kiddie porn detection system.

darnit · 08-11-2003, 01:27 PM

its an exploit.....fucking flaw in windows that allows people to do that to you computer. Get the patch on microsofts site....same thing happened to me....

galleryseek · 08-11-2003, 01:29 PM

oh yeah... thats big right now... know a few people makin damn worms for it

m4tt · 08-11-2003, 01:31 PM

This exploit is more serious than just shutting down the PC..

Get the patch here:
http://microsoft.com/technet/treevie...n/MS03-026.asp

smack · 08-11-2003, 01:31 PM

damn do0d just had the same thing happen to me three times in the last 48 hours. i'm ging to get patched.

Mutt · 08-11-2003, 01:49 PM

me too - i'm actually relieved to know other people are having the same problem. FUCK - as i typed this it just happened again.

[Labret] · 08-11-2003, 01:53 PM

I JUST got done battling this shit. I didnt know what the hell was going on. I almost reinstalled the OS because everything I tried didnt work so I figured things were beyond fucked.

I noticed my other machines were having the same problem, so it was not isolated to my main machine and was not virus or worm related.

I noticed shit didnt happen when I would disconnect from cable modem.

Little more probing, its a god damn denial of service attack.

Im on Comcast. The only way I could get it to stop was to switch from my bridge to a router. The MS patch didnt work either.

Im guessing someone is having a good time today.

MattO · 08-11-2003, 01:58 PM

I got a box that's running beta .net and there's no patch for it but I found that setting the firewall takes care of the attacks

magicmike · 08-11-2003, 02:04 PM

Damn, you guys too.

I started getting that error about 3 hours ago, got shutdown twice, then I started updating from MS... then got shutdown during the update...

So I dl'ed the update unplugged my network cable and installed.

I think there was 3 critical updates I hadn't installed yet.

I guess it shows you that you should install those as soon as they come out.

Glad to see I'm not the only one though

Brian911 · 08-11-2003, 03:07 PM

if you receive "remote procedure call (rpc) service terminated unexpectedly" messages that keep rebooting your comp, try this:

1. install a firewall. dont bother blocking IPs. block ports being used by RPC - UDP and TCP (more below)
2. install MS bugfix. (hell yea I'd do that if it didnt say "service pack 2 required")
3. control panel -> administrative tools -> services -> remote procedure call (RPC). right click, choose properties. go to recovery tab. choose "no action" for all boxes.

full info here plus xp/2000/nt fix

http://www.securitytracker.com/alert...l/1007212.html

edit: this should read: 1 OR 2 OR 3. either will fix it.

loverboy · 08-11-2003, 03:13 PM

Quote:

Originally posted by m4tt
This exploit is more serious than just shutting down the PC..

Get the patch here:
http://microsoft.com/technet/treevie...n/MS03-026.asp

That's a Microsoft loophole

Mutt · 08-11-2003, 03:26 PM

the MS patch seems to be working for now but thanks for the info Brian.

Freestyleman · 08-11-2003, 03:57 PM

Quote:

Originally posted by Mutt
the MS patch seems to be working for now but thanks for the info Brian.

glad to see that i am not the only one that has been gettin this error.

yea thanks brian, i have installed the MS patch and for now it really seems to be working... but lets wait another 10-20 mins and see...

j3ff · 08-11-2003, 04:05 PM

here's the way to completely remove the worm:

Windows XP:

go to start -> run

copy paste this in run:

reg delete HKLM\Software\microsoft\windows\currentversion\run /v "windows auto update" /f

then reboot,

after that, do a search and locate the file msblast.exe and delete it..

that concludes the removal procedure (trust me, I had to do it on 10 computers.)

Windows 2000:

.. it might not crash the RPC like windows XP asking you to shut down, but it can give you problems with mmc.exe (microsoft management console) and also the hole which allows anyone to install any script to create users or do anything on your computer.

The reg deletion command mentionned above doesn't work with windows 2000, so you'll have to go manually with regedit to the key hkey_local_machine\software\microsoft\windows\curr entversion\run and then right click on the windows auto update key ... then delete it. Reboot, delete the msblast.exe file like said up there and you're done.

This exploit ain't no joke, it's dangerous

Theo · 08-11-2003, 04:24 PM

my system is fucked up

i want to fucking murder the punk that wrote this shit

the only thing left working now is the IE with gfy

Theo · 08-11-2003, 04:29 PM

here's the directly download for the ones that cannot access it,this shit even kills js capabilities and the microsoft site in many parts doesnt work with no js

http://microsoft.com/downloads/detai...displaylang=en

i hope it will work now

m4tt · 08-11-2003, 04:29 PM

Quote:

Originally posted by Soul_Rebel
my system is fucked up

i want to fucking murder the punk that wrote this shit

the only thing left working now is the IE with gfy

microsoft wrote it...

Theo · 08-11-2003, 04:32 PM

yes, the exploit

but the one that does the attacks is using a virus that infected many computers today

w32.blaster something

j3ff · 08-11-2003, 04:41 PM

Quote:

Originally posted by Soul_Rebel
yes, the exploit

but the one that does the attacks is using a virus that infected many computers today

w32.blaster something

which is what im saying, the registry key I mentionned restarts the virus' process each time you reboot, so you gotta delete the reg key AND the file msblast.exe

p00p · 08-11-2003, 04:43 PM

Quote:

Originally posted by j3ff

you'll have to go manually with regedit to the key hkey_local_machine\software\microsoft\windows\curr entversion\run and then right click on the windows auto update key ... then delete it. Reboot, delete the msblast.exe file like said up there and you're done.

This exploit ain't no joke, it's dangerous

Unreal! Earlier today I did a netstat -a and noticed a lot of connections to .mil computers. So I downloaded Active Ports and I'll be damned if a dozen or so msblast.exe were open.

Is msblast.exe a microsoft thing being exploited? Or is it a trojan/worm? I renamed it to .bak, and sure enough, it wasn't using up anymore ports.

Wonder how I caught this, I am pretty careful.....
Anymore info/links would be appreciated!

j3ff · 08-11-2003, 04:44 PM

Quote:

Originally posted by p00p

Unreal! Earlier today I did a netstat -a and noticed a lot of connections to .mil computers. So I downloaded Active Ports and I'll be damned if a dozen or so msblast.exe were open.

Is msblast.exe a microsoft thing being exploited? Or is it a trojan/worm? I renamed it to .bak, and sure enough, it wasn't using up anymore ports.

Wonder how I caught this, I am pretty careful.....
Anymore info/links would be appreciated!

kill it, this ain't a microsoft file, this is the actual worm.

p00p · 08-11-2003, 04:48 PM

Quote:

Originally posted by j3ff

kill it, this ain't a microsoft file, this is the actual worm.

It's gone.
Do you know how it is being installed on computers? I searched google but came up with nada. Must be pretty new.
I should have taken a screenshot of my netstat command. After seeing all the .mil computers I was hooked up to, I reckoned something was wrong.

j3ff · 08-11-2003, 04:51 PM

Quote:

Originally posted by p00p

It's gone.
Do you know how it is being installed on computers? I searched google but came up with nada. Must be pretty new.
I should have taken a screenshot of my netstat command. After seeing all the .mil computers I was hooked up to, I reckoned something was wrong.

heh, thats the thing, by opening port 135 UDP ... the attacker can send mostly anything he wants and can actually scripts some things ... most of the time it's the worm being uploaded... but it shouldn't do anything else.... well for me it just installed the worm... I removed it.. and said........ FUCK YOU HACKER!

p00p · 08-11-2003, 04:51 PM

Found more info...
http://www.crn.com/sections/Breaking...rticleID=43865

Theo · 08-11-2003, 04:55 PM

thanks jeff,i think i'm clean now

I got a call from a friend with the same problem, he has win XP and it's even worse situation. He wants me to go and fix his pc now. 3am...

BVF · 08-11-2003, 05:12 PM

I'll be damned, that was the problem....I thought I was gonna have to take it to the shop and let the tech see all this porn on my computer...Thanks jeff...And that msblast.exe shit was on my machine also..

j3ff · 08-11-2003, 06:29 PM

NP guys, i've been the techie guy for a couple of probs recently heh, if you got other problems with the comps, msg me thats my job

bigdog · 08-11-2003, 06:30 PM

thats why sometimes it's good to have a trusty old mac.Mac users rarely face these probelms

j3ff · 08-11-2003, 06:31 PM

mac -does not- have viruses.. alleluiah.. but I don't like mac

Theo · 08-11-2003, 06:32 PM

true
same goes to amiga operators

I was looking some logs yesterday and i noticed there are still amiga surfers. That was a big surprise

LadyMischief · 08-11-2003, 06:41 PM

Guys, that is the worm that fucked up my harddrive COMPLETELY. I had to actually piece it back together with software (and jact's loving patience). Trust me, get this shit patched up ASAP!!!!!!

j3ff · 08-11-2003, 06:47 PM

Quote:

Originally posted by LadyMischief
Guys, that is the worm that fucked up my harddrive COMPLETELY. I had to actually piece it back together with software (and jact's loving patience). Trust me, get this shit patched up ASAP!!!!!!

you sure? ... maybe someone actually made you execute a script with it ... but it doesn't seem developped too much actually it doesn't seem like much people know how to do it .

LadyMischief · 08-11-2003, 06:48 PM

Quote:

Originally posted by j3ff

you sure? ... maybe someone actually made you execute a script with it ... but it doesn't seem developped too much actually it doesn't seem like much people know how to do it .

Trust me on this one... That was it.

grand · 08-11-2003, 07:10 PM

anyone else get svchost.exe error? I'm running win 2000 pro

j3ff · 08-11-2003, 07:12 PM

look up.. the way to solve the problem is just above :P

49thParallel · 08-11-2003, 07:20 PM

12Clicks...why don't you add your 2 cents. Your company, Standard Internet makes a practice of adding this sort of exploit to unwary surfer's computers. Your site, stopannoyingpopups.com installs a trojan winpup32.exe, so you should be an expert at telling people how to avoid this sort of scumware.

http://forums.techguy.org/t140495/s3...06a116f53.html

P.S. Guaranteed response from 12Clicks ... He will try to defame my character, make a reference to my "day job" or otherwise put up a smoke screen to the real issue. Just for once 12Clicks, why don't you address the real issue at hand!

grand · 08-11-2003, 07:47 PM

j3ff, I followed your instuctions above, I found and deleted msblast.exe after the reboot...I just did another reboot and I get the same error....svchost.exe

any ideas?

Rochard · 08-11-2003, 10:01 PM

Yeah, a few people have mentioned this problem to me as well. This could be a big problem.

SilverTab · 08-11-2003, 10:20 PM

Damn...I saw that on 2 computers today only....the patch took care of it successfuly...

ayj · 08-12-2003, 05:06 AM

I've cleared the virus and rebooted, and checked again that it really is gone (yes no sign of it) - but I am still getting the W2000 error of svchost.exe getting errors and being closed down which causes all sorts of follow up problems.

I've just downloaded and installed the W2000 patch so maybe that will do the trick, but what I do not get is

1, how / where I got the virus in the first place (I am on a dial-up) - does it have to be email? and

2, why I am still getting the svchost errors (maybe the patch really will have fixed that though I suspect it doesn't work quite so nicely as that)

ayj

12clicks · 08-12-2003, 05:25 AM

Quote:

Originally posted by 49thParallel
12Clicks...why don't you add your 2 cents. Your company, Standard Internet makes a practice of adding this sort of exploit to unwary surfer's computers. Your site, stopannoyingpopups.com installs a trojan winpup32.exe, so you should be an expert at telling people how to avoid this sort of scumware.

http://forums.techguy.org/t140495/s3...06a116f53.html

P.S. Guaranteed response from 12Clicks ... He will try to defame my character, make a reference to my "day job" or otherwise put up a smoke screen to the real issue. Just for once 12Clicks, why don't you address the real issue at hand!

ahahahaha, still plugging away half wit? If you want to be more believable (so the FTC doesn't laugh in your face a second time) I suggest making up SEVERAL fake names on that board and have them all agree with each other.

The way you are going about it is amateurish at best.

at least your making posts at night to keep us all thinking you're here more than just the weekend.

chodadog · 08-12-2003, 06:18 AM

Quote:

Originally posted by 49thParallel
12Clicks...why don't you add your 2 cents. Your company, Standard Internet makes a practice of adding this sort of exploit to unwary surfer's computers. Your site, stopannoyingpopups.com installs a trojan winpup32.exe, so you should be an expert at telling people how to avoid this sort of scumware.

http://forums.techguy.org/t140495/s3...06a116f53.html

P.S. Guaranteed response from 12Clicks ... He will try to defame my character, make a reference to my "day job" or otherwise put up a smoke screen to the real issue. Just for once 12Clicks, why don't you address the real issue at hand!

How's that FTC investigation coming along? Will we be seeing the end of SI anytime soon?

Anyways, to the topic at hand. I got an email from my ISP about this exploit, and a warning from my brother. Stupidly, i gave it the "i'll sort it out tommorrow" attitude. So i try to use my computer this morning. Within a minute or two of connecting to the internet, my computer shuts down. So i restart, same thing. Again and again. Luckily, i back up all my shit just in case anything like this happens. Anyways. Got my brother over to fix it all up, which he did. But yeah, when you get these warnings, update that shit ASAP. Not pleasant what these things can do.

crockett · 08-12-2003, 06:57 AM

dude that shit is pretty fucked up... my aunt just bought a new HP pc from best buy and it came infected with that virus... I went over and set up her computer for her cable modem.. and as soon sa I put it online I stated getting that shut down message... Best Buy did the intial set up for her, and I assume they infected it when they set it up... but it's pretty bad when you buy a PC from a national chain store and it comes ifeced with a virus.

ack · 08-12-2003, 06:59 AM

Quote:

Originally posted by j3ff
mac -does not- have viruses.. alleluiah.. but I don't like mac

why don't you like the mac jeff?

eiht_98 · 08-12-2003, 08:16 AM

Quote:

Originally posted by j3ff
here's the way to completely remove the worm:

Windows XP:

go to start -> run

copy paste this in run:

reg delete HKLM\Software\microsoft\windows\currentversion\run /v "windows auto update" /f

then reboot,

after that, do a search and locate the file msblast.exe and delete it..

that concludes the removal procedure (trust me, I had to do it on 10 computers.)

Windows 2000:

.. it might not crash the RPC like windows XP asking you to shut down, but it can give you problems with mmc.exe (microsoft management console) and also the hole which allows anyone to install any script to create users or do anything on your computer.

The reg deletion command mentionned above doesn't work with windows 2000, so you'll have to go manually with regedit to the key hkey_local_machine\software\microsoft\windows\curr entversion\run and then right click on the windows auto update key ... then delete it. Reboot, delete the msblast.exe file like said up there and you're done.

This exploit ain't no joke, it's dangerous

thank you very much

Zorgman · 08-12-2003, 08:25 AM

I posted this on another forum but here is my message.

For windows XP

After being on the phone with MS techs for over an hour they finally found the solution.

After many reboots.

Enable your XP firewall, this will stop more attacks on your system.

Check your systems for "msblast.exe" -- if you have this file you going to know about it damn soon.

If you do, do this.

1. Get the MS update NOW - credical update 823980
Its about 1.3MB in size.

Go to regedit > HKEY_LOCAL_MACHINE > software > Microsoft > windows > currentversion > run >

If you see a entry called "msblash.exe" delete it.
EXIT

Press Crtl + Alt + Del -- windows task manager will popup, find msblast.exe and right click > "End Process".

Load Windows Explorer > Search C:\windows\ for "msblast.exe" -- there should be 2 files. Delete them both.

If you don't do the MS update of the patch then these files will come back.

If you have it you are given 60 seconds and it will shut down you machine.

This worm is new and it's launch date is the 12th, but it's out now at a computer near you.

Hope this helps someone. :D

GTS Mark · 08-12-2003, 08:33 AM

Thanks for the patch, I think it worked.

DH

mospeed · 08-12-2003, 09:37 AM

I hate to beat this with a dead horse, I did all of that last night, i did the patch, I deleted out the reg key and the msblast.exe file from windows/system32/ and any other file associated with it.

However, it takes awhile, but it spawns a new name, when it pops up the RPC crash box, i go to the processes tab and I see cmd.exe running.

Then norton finds the virus again, except this time its called like TFT53495 or something like that...

I'm at work right now, and i'm trying to get my girlfriend to run through some more steps, I used to connect to my computer at home from work....but that'll stop now since i configured the firewall at home (just now did that)

Any updates on this for permanent fixes?

My computer at home seems to be seriously fucked over now. Time for a new computer anyway..

Home is running XP Pro.

p00p · 08-12-2003, 09:41 AM

Quote:

Originally posted by mospeed
I hate to beat this with a dead horse, I did all of that last night, i did the patch, I deleted out the reg key and the msblast.exe file from windows/system32/ and any other file associated with it.

However, it takes awhile, but it spawns a new name, when it pops up the RPC crash box, i go to the processes tab and I see cmd.exe running.

Then norton finds the virus again, except this time its called like TFT53495 or something like that...

I'm at work right now, and i'm trying to get my girlfriend to run through some more steps, I used to connect to my computer at home from work....but that'll stop now since i configured the firewall at home (just now did that)

Any updates on this for permanent fixes?

My computer at home seems to be seriously fucked over now. Time for a new computer anyway..

Home is running XP Pro.

Download this utility. It tells you what programs are using ports
http://www.webattack.com/get/activeports.shtml

I used it to find that msblast.exe was connecting to a lot of UDP ports yesterday. So I deleted the file and did the registry fix.

Hope that helps!

08-11-2003, 01:11 PM	#1
BVF Black Vagina Finder Join Date: Jan 2002 Location: The Midwest Posts: 13,975	"NT AUTHORITY SYSTEM" is shutting down my computer when online Maybe someone on here can help me....My laptop automatically shuts down and restarts and says that a remote call procedure has failed and it has to shut down. It says the program that does it is NT AUTHORITY SYSTEM. When my laptop isn't online, it works fine and doesn't shut down..It only works when I am on the internet. I'm using Windows XP..Has anybody had this problem and know how to fix it...If I didn't have another computer, I'd be fucked because I wouldn't even be able to ask for help online. __________________ Black Pussy Click On Mr Cosby..CCbill, 60/40, 136 FHG's....The Cos Loves Black Ghetto Pussy!!

08-11-2003, 01:31 PM	#6
smack Push Porn Like Weight. Industry Role: Join Date: Mar 2002 Location: Inside .NET Posts: 10,652	damn do0d just had the same thing happen to me three times in the last 48 hours. i'm ging to get patched. __________________ Cry havoc and let slip the dogs of war.

08-11-2003, 01:49 PM	#7
Mutt Too lazy to set a custom title Industry Role: Join Date: Sep 2002 Posts: 34,431	me too - i'm actually relieved to know other people are having the same problem. FUCK - as i typed this it just happened again. __________________ I moved my sites to Vacares Hosting. I've saved money, my hair is thicker, lost some weight too! Thanks Sly!

08-11-2003, 02:04 PM	#10
magicmike Confirmed User Industry Role: Join Date: Feb 2003 Location: JustPorno Posts: 2,384	Damn, you guys too. I started getting that error about 3 hours ago, got shutdown twice, then I started updating from MS... then got shutdown during the update... So I dl'ed the update unplugged my network cable and installed. I think there was 3 critical updates I hadn't installed yet. I guess it shows you that you should install those as soon as they come out. Glad to see I'm not the only one though __________________ Just Porno with both classic and mobile porn versions. Gay Porn Our mega gay site tranny porn

08-11-2003, 03:07 PM	#11
Brian911 Confirmed User Join Date: Dec 2001 Posts: 654	if you receive "remote procedure call (rpc) service terminated unexpectedly" messages that keep rebooting your comp, try this: 1. install a firewall. dont bother blocking IPs. block ports being used by RPC - UDP and TCP (more below) 2. install MS bugfix. (hell yea I'd do that if it didnt say "service pack 2 required") 3. control panel -> administrative tools -> services -> remote procedure call (RPC). right click, choose properties. go to recovery tab. choose "no action" for all boxes. full info here plus xp/2000/nt fix http://www.securitytracker.com/alert...l/1007212.html edit: this should read: 1 OR 2 OR 3. either will fix it. __________________ - Brian [ a directive occured while processing this error ]

08-11-2003, 01:13 PM	#2
galleryseek Confirmed User Industry Role: Join Date: Mar 2002 Posts: 8,234	kiddie porn detection system.

08-11-2003, 01:27 PM	#3
darnit Confirmed User Join Date: Jul 2001 Location: Teh Interweb Posts: 2,439	its an exploit.....fucking flaw in windows that allows people to do that to you computer. Get the patch on microsofts site....same thing happened to me....

08-11-2003, 01:29 PM	#4
galleryseek Confirmed User Industry Role: Join Date: Mar 2002 Posts: 8,234	oh yeah... thats big right now... know a few people makin damn worms for it

08-11-2003, 01:31 PM	#5
m4tt So Fucking Banned Join Date: May 2003 Location: San Diaygo, CA Posts: 384	This exploit is more serious than just shutting down the PC.. Get the patch here: http://microsoft.com/technet/treevie...n/MS03-026.asp

08-11-2003, 01:53 PM	#8
[Labret] Registered User Industry Role: Join Date: May 2001 Location: Са́нкт-Петербу́рг Posts: 10,945	I JUST got done battling this shit. I didnt know what the hell was going on. I almost reinstalled the OS because everything I tried didnt work so I figured things were beyond fucked. I noticed my other machines were having the same problem, so it was not isolated to my main machine and was not virus or worm related. I noticed shit didnt happen when I would disconnect from cable modem. Little more probing, its a god damn denial of service attack. Im on Comcast. The only way I could get it to stop was to switch from my bridge to a router. The MS patch didnt work either. Im guessing someone is having a good time today.

08-11-2003, 01:58 PM	#9
MattO The O is for Oohhh Join Date: Feb 2003 Location: AUSTIN TEJAS Posts: 10,861	I got a box that's running beta .net and there's no patch for it but I found that setting the firewall takes care of the attacks

08-11-2003, 03:26 PM	#13
Mutt Too lazy to set a custom title Industry Role: Join Date: Sep 2002 Posts: 34,431	the MS patch seems to be working for now but thanks for the info Brian. __________________ I moved my sites to Vacares Hosting. I've saved money, my hair is thicker, lost some weight too! Thanks Sly!

08-11-2003, 04:05 PM	#15
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	here's the way to completely remove the worm: Windows XP: go to start -> run copy paste this in run: reg delete HKLM\Software\microsoft\windows\currentversion\run /v "windows auto update" /f then reboot, after that, do a search and locate the file msblast.exe and delete it.. that concludes the removal procedure (trust me, I had to do it on 10 computers.) Windows 2000: .. it might not crash the RPC like windows XP asking you to shut down, but it can give you problems with mmc.exe (microsoft management console) and also the hole which allows anyone to install any script to create users or do anything on your computer. The reg deletion command mentionned above doesn't work with windows 2000, so you'll have to go manually with regedit to the key hkey_local_machine\software\microsoft\windows\curr entversion\run and then right click on the windows auto update key ... then delete it. Reboot, delete the msblast.exe file like said up there and you're done. This exploit ain't no joke, it's dangerous __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com Last edited by j3ff; 08-11-2003 at 04:09 PM..

08-11-2003, 04:24 PM	#16
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	my system is fucked up i want to fucking murder the punk that wrote this shit the only thing left working now is the IE with gfy

08-11-2003, 04:29 PM	#17
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	here's the directly download for the ones that cannot access it,this shit even kills js capabilities and the microsoft site in many parts doesnt work with no js http://microsoft.com/downloads/detai...displaylang=en i hope it will work now

08-11-2003, 04:32 PM	#19
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	yes, the exploit but the one that does the attacks is using a virus that infected many computers today w32.blaster something

08-11-2003, 04:51 PM	#25
p00p Confirmed User Join Date: Dec 2002 Location: CanaDUH Posts: 5,125	Found more info... http://www.crn.com/sections/Breaking...rticleID=43865 __________________ ICQ: 316365783 <a href="http://www.hostultra.com/~p00p" target="_blank">TEST</a>

08-11-2003, 04:55 PM	#26
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	thanks jeff,i think i'm clean now I got a call from a friend with the same problem, he has win XP and it's even worse situation. He wants me to go and fix his pc now. 3am...

08-11-2003, 05:12 PM	#27
BVF Black Vagina Finder Join Date: Jan 2002 Location: The Midwest Posts: 13,975	I'll be damned, that was the problem....I thought I was gonna have to take it to the shop and let the tech see all this porn on my computer...Thanks jeff...And that msblast.exe shit was on my machine also.. __________________ Black Pussy Click On Mr Cosby..CCbill, 60/40, 136 FHG's....The Cos Loves Black Ghetto Pussy!!

08-11-2003, 06:29 PM	#28
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	NP guys, i've been the techie guy for a couple of probs recently heh, if you got other problems with the comps, msg me thats my job __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-11-2003, 06:30 PM	#29
bigdog Confirmed User Join Date: Jul 2001 Posts: 6,964	thats why sometimes it's good to have a trusty old mac.Mac users rarely face these probelms

08-11-2003, 06:31 PM	#30
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	mac -does not- have viruses.. alleluiah.. but I don't like mac __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-11-2003, 06:32 PM	#31
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	true same goes to amiga operators I was looking some logs yesterday and i noticed there are still amiga surfers. That was a big surprise

08-11-2003, 06:41 PM	#32
LadyMischief Orgasms N Such! Industry Role: Join Date: Sep 2002 Location: Oakville, Ontario Posts: 18,135	Guys, that is the worm that fucked up my harddrive COMPLETELY. I had to actually piece it back together with software (and jact's loving patience). Trust me, get this shit patched up ASAP!!!!!! __________________ ICQ 3522039 Content Manager - orgasm.com [email protected]

08-11-2003, 07:10 PM	#35
grand Confirmed User Join Date: Nov 2002 Posts: 310	anyone else get svchost.exe error? I'm running win 2000 pro __________________ NichedSites has exclusive sites in every niche TwistysCash Rocks!!! They're always giving away free cash

08-11-2003, 07:12 PM	#36
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	look up.. the way to solve the problem is just above :P __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-11-2003, 07:20 PM	#37
49thParallel So Fucking Banned Join Date: Jul 2002 Posts: 1,197	12Clicks...why don't you add your 2 cents. Your company, Standard Internet makes a practice of adding this sort of exploit to unwary surfer's computers. Your site, stopannoyingpopups.com installs a trojan winpup32.exe, so you should be an expert at telling people how to avoid this sort of scumware. http://forums.techguy.org/t140495/s3...06a116f53.html P.S. Guaranteed response from 12Clicks ... He will try to defame my character, make a reference to my "day job" or otherwise put up a smoke screen to the real issue. Just for once 12Clicks, why don't you address the real issue at hand!

08-11-2003, 07:47 PM	#38
grand Confirmed User Join Date: Nov 2002 Posts: 310	j3ff, I followed your instuctions above, I found and deleted msblast.exe after the reboot...I just did another reboot and I get the same error....svchost.exe any ideas? __________________ NichedSites has exclusive sites in every niche TwistysCash Rocks!!! They're always giving away free cash

08-11-2003, 10:01 PM	#39
Rochard Jägermeister Test Pilot Industry Role: Join Date: Dec 2001 Location: NORCAL Posts: 74,033	Yeah, a few people have mentioned this problem to me as well. This could be a big problem. __________________ “The choice is no longer between right or left. The choice is between normal and crazy.” - Sarah Huckabee Sanders YNOT MAIL \| THE BEST ADULT MAILING SOLUTION

08-11-2003, 10:20 PM	#40
SilverTab Confirmed User Join Date: Nov 2001 Location: MTL Posts: 5,060	Damn...I saw that on 2 computers today only....the patch took care of it successfuly... __________________ mmm my sig was too big... no more cool animation but hey still! need php? ICQ: 94586959

08-12-2003, 05:06 AM	#41
ayj Registered User Join Date: Jul 2003 Posts: 27	I've cleared the virus and rebooted, and checked again that it really is gone (yes no sign of it) - but I am still getting the W2000 error of svchost.exe getting errors and being closed down which causes all sorts of follow up problems. I've just downloaded and installed the W2000 patch so maybe that will do the trick, but what I do not get is 1, how / where I got the virus in the first place (I am on a dial-up) - does it have to be email? and 2, why I am still getting the svchost errors (maybe the patch really will have fixed that though I suspect it doesn't work quite so nicely as that) ayj

08-12-2003, 06:57 AM	#44
crockett in a van by the river Industry Role: Join Date: May 2003 Posts: 76,806	dude that shit is pretty fucked up... my aunt just bought a new HP pc from best buy and it came infected with that virus... I went over and set up her computer for her cable modem.. and as soon sa I put it online I stated getting that shut down message... Best Buy did the intial set up for her, and I assume they infected it when they set it up... but it's pretty bad when you buy a PC from a national chain store and it comes ifeced with a virus. __________________ In November, you can vote for America's next president or its first dictator.

08-12-2003, 08:25 AM	#47
Zorgman Confirmed User Join Date: Aug 2002 Location: Sydney, Australia Posts: 6,103	I posted this on another forum but here is my message. For windows XP After being on the phone with MS techs for over an hour they finally found the solution. After many reboots. Enable your XP firewall, this will stop more attacks on your system. Check your systems for "msblast.exe" -- if you have this file you going to know about it damn soon. If you do, do this. 1. Get the MS update NOW - credical update 823980 Its about 1.3MB in size. Go to regedit > HKEY_LOCAL_MACHINE > software > Microsoft > windows > currentversion > run > If you see a entry called "msblash.exe" delete it. EXIT Press Crtl + Alt + Del -- windows task manager will popup, find msblast.exe and right click > "End Process". Load Windows Explorer > Search C:\windows\ for "msblast.exe" -- there should be 2 files. Delete them both. If you don't do the MS update of the patch then these files will come back. If you have it you are given 60 seconds and it will shut down you machine. This worm is new and it's launch date is the 12th, but it's out now at a computer near you. Hope this helps someone. :D __________________ ---

08-12-2003, 08:33 AM	#48
GTS Mark Vrume Mark Industry Role: Join Date: Jan 2001 Location: Toronto, Canada Posts: 20,912	Thanks for the patch, I think it worked. DH

08-12-2003, 09:37 AM	#49
mospeed Registered User Join Date: Sep 2002 Location: Seattle Posts: 74	I hate to beat this with a dead horse, I did all of that last night, i did the patch, I deleted out the reg key and the msblast.exe file from windows/system32/ and any other file associated with it. However, it takes awhile, but it spawns a new name, when it pops up the RPC crash box, i go to the processes tab and I see cmd.exe running. Then norton finds the virus again, except this time its called like TFT53495 or something like that... I'm at work right now, and i'm trying to get my girlfriend to run through some more steps, I used to connect to my computer at home from work....but that'll stop now since i configured the firewall at home (just now did that) Any updates on this for permanent fixes? My computer at home seems to be seriously fucked over now. Time for a new computer anyway.. Home is running XP Pro. __________________ -Josh <a href="http://www.soulcash.com/referral_rs=mackey/index.html" target="_parent"><br /> <img border="0" src="http://www.soulcash.com/images/banners/soulcash-240x60-001.gif" width="240" height="60">