"NT AUTHORITY SYSTEM" is shutting down my computer when online - Page 2 - GoFuckYourself.com

p00p · 08-12-2003, 09:41 AM

50 fucking worms!

p00p · 08-12-2003, 09:53 AM

Quote:

Originally posted by LadyMischief
Guys, that is the worm that fucked up my harddrive COMPLETELY. I had to actually piece it back together with software (and jact's loving patience). Trust me, get this shit patched up ASAP!!!!!!

Me too! Well, it didn't fuck up my harddrive, but so many things stopped working that worked the day before.

-Media Player would open a file, and crash
-Some hyperlinks wouldn't open in some pages (none on GFY)
-My mouse software was buggering up (buttons wouldn't work)
-Windows update wouldn't launch
-fonts were screwed up in Hotmail etc.
-Add/remove programs wouldn't start
-control panel/administrative tools/services - I couldn't right click on anything to change settings, no menu would pop up
-computer would hang on start up
-computer would hang once I got past the password login page
-couldn't start up in safe mode...

And on, and on!

So, I reinstalled Windows 2k, put the machine behind a linksys, and everything works 1005 now!

LadyMischief · 08-12-2003, 10:07 AM

Quote:

Originally posted by p00p

Me too! Well, it didn't fuck up my harddrive, but so many things stopped working that worked the day before.

-Media Player would open a file, and crash
-Some hyperlinks wouldn't open in some pages (none on GFY)
-My mouse software was buggering up (buttons wouldn't work)
-Windows update wouldn't launch
-fonts were screwed up in Hotmail etc.
-Add/remove programs wouldn't start
-control panel/administrative tools/services - I couldn't right click on anything to change settings, no menu would pop up
-computer would hang on start up
-computer would hang once I got past the password login page
-couldn't start up in safe mode...

And on, and on!

So, I reinstalled Windows 2k, put the machine behind a linksys, and everything works 1005 now!

Ugh! Unfortunately we were among the very first people hit, and when I went looking to find out wtf was wrong with my computer, nobody even acknowledged that there was a problem yet. Everyone now knows what to do because there are sites on it etc, but if you let it go too long, it kills your harddrive. My system wouldn't even see that there was a drive c there. We had to take the hardrive out of the computer, put it into another system as a slave and run recovery software on it. It was a very tedious process

LadyMischief · 08-12-2003, 10:08 AM

Oh I should also mention that it has a keystroke logger, and if you have an ftp program installed it will log into a remote system for further instructions, as well as installing new and wonderful things on your system.

[Labret] · 08-12-2003, 10:10 AM

Quote:

Originally posted by p00p

-Some hyperlinks wouldn't open in some pages (none on GFY)

Thats the only thing I cant fix. Everything is gone, rebooted countless times, cleaned and recleaned. I am pretty damn sure there is nothing left.

Everything else is fine except I cant get links to open in explorer.

Right now am using Opera, I think I like it. Im gonne stick with it for awhile.

p00p · 08-12-2003, 10:15 AM

Quote:

Originally posted by [Labret]

Thats the only thing I cant fix. Everything is gone, rebooted countless times, cleaned and recleaned. I am pretty damn sure there is nothing left.

Everything else is fine except I cant get links to open in explorer.

Right now am using Opera, I think I like it. Im gonne stick with it for awhile.

I gave up trying to fix things last night, and just reinstalled Windows 2k. Everything works good now, although I am not patched. So I will sit behind a linksys instead. (the patches fucked up my computer even more)

p00p · 08-12-2003, 10:17 AM

Quote:

Originally posted by LadyMischief
Oh I should also mention that it has a keystroke logger, and if you have an ftp program installed it will log into a remote system for further instructions, as well as installing new and wonderful things on your system.

That one scares me. I am behing a Linksys now, so I am not worried about intrusions. But I am worried about things going out.
Do you know the name of the keystroke logger?
Nothing is unusual in Active Ports, maybe I caught msblast.exe in time.

LadyMischief · 08-12-2003, 10:22 AM

Quote:

Originally posted by [Labret]

Thats the only thing I cant fix. Everything is gone, rebooted countless times, cleaned and recleaned. I am pretty damn sure there is nothing left.

Everything else is fine except I cant get links to open in explorer.

Right now am using Opera, I think I like it. Im gonne stick with it for awhile.

Or Mozilla.. Mozilla is nice and fast.

LadyMischief · 08-12-2003, 10:24 AM

Quote:

Originally posted by p00p

That one scares me. I am behing a Linksys now, so I am not worried about intrusions. But I am worried about things going out.
Do you know the name of the keystroke logger?
Nothing is unusual in Active Ports, maybe I caught msblast.exe in time.

\

I'm behind a Linksys too.. fortunately I was lucky because I didn't have an FTP program installed, but I changed all my bank info just in case. I shouldn't even have gotten infected, but my router power cycled and reset to default and that is what allowed the worm to get in

It sucked!!

eiht_98 · 08-12-2003, 11:55 AM

I deleted the registry entry and the msblast file but still got the shutdown error. A few minutes ago I have installed the MS patch. Will see if it works.

grand · 08-12-2003, 10:53 PM

Quote:

Originally posted by LadyMischief
Oh I should also mention that it has a keystroke logger, and if you have an ftp program installed it will log into a remote system for further instructions, as well as installing new and wonderful things on your system.

LadyMischief..... I running ws_ftp, do u suggest I reinstall? i had the worm but was able to kill it yesterday and download the patch successfully.

do you know the names of the new files being installed?

thanks

08-12-2003, 11:17 PM

I just went through the joy of downloading all of Microsoft's patches after doing a fresh install of XP.

Over 100 MB's for service pack 1, and I'm on dialup. And then there's still another 30 MB or so of patches after that.

It'll be another day before I get all my programs installed again.

Fuck you Microsoft.

p00p · 08-12-2003, 11:33 PM

Quote:

Originally posted by grand

LadyMischief..... I running ws_ftp, do u suggest I reinstall? i had the worm but was able to kill it yesterday and download the patch successfully.

do you know the names of the new files being installed?

thanks

I think TFTP is what you have to worry about, not ws_ftp.
I am still trying to figure out how to disable TFTP. That is one of the culprits.....

SLY1 · 08-12-2003, 11:46 PM

My computer shuts down every 2min. This worm sucks!

Porn Mickey · 08-12-2003, 11:50 PM

PATCH FOR WINDOWS XP

CLICK HERE FOR MORE INFO

katman · 08-13-2003, 02:21 AM

Quote:

Originally posted by ayj
I've cleared the virus and rebooted, and checked again that it really is gone (yes no sign of it) - but I am still getting the W2000 error of svchost.exe getting errors and being closed down which causes all sorts of follow up problems.

I've just downloaded and installed the W2000 patch so maybe that will do the trick, but what I do not get is

1, how / where I got the virus in the first place (I am on a dial-up) - does it have to be email? and

2, why I am still getting the svchost errors (maybe the patch really will have fixed that though I suspect it doesn't work quite so nicely as that)

ayj

I haven't read all the responses, but I can tell you this...It is self replicating and requires no user interaction. You don't have to open an email. If you don't have the patch it will get you no matter what you do or don't do.

It's proven to me because the only thing I have done in the last 4 days is surf. No e-mail, no nothing. Still was infected.

j3ff · 08-13-2003, 02:24 AM

normal thing, it transfers itself by a corrupted udp packet on port 135 and directly affects the RPC, but hey, even if you have the patch, you're still infected, gotta remove it

I posted how to completely remove it on the first page of the thread

08-12-2003, 09:41 AM	#51
p00p Confirmed User Join Date: Dec 2002 Location: CanaDUH Posts: 5,125	50 fucking worms! __________________ ICQ: 316365783 <a href="http://www.hostultra.com/~p00p" target="_blank">TEST</a>

08-12-2003, 10:08 AM	#54
LadyMischief Orgasms N Such! Industry Role: Join Date: Sep 2002 Location: Oakville, Ontario Posts: 18,135	Oh I should also mention that it has a keystroke logger, and if you have an ftp program installed it will log into a remote system for further instructions, as well as installing new and wonderful things on your system. __________________ ICQ 3522039 Content Manager - orgasm.com [email protected]

08-12-2003, 11:50 PM	#65
Porn Mickey we all love porn Industry Role: Join Date: Nov 2001 Location: Nowhere Posts: 2,840	PATCH FOR WINDOWS XP CLICK HERE FOR MORE INFO __________________ $150 SignUp Bonus

08-13-2003, 02:24 AM	#67
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	normal thing, it transfers itself by a corrupted udp packet on port 135 and directly affects the RPC, but hey, even if you have the patch, you're still infected, gotta remove it I posted how to completely remove it on the first page of the thread __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-12-2003, 11:55 AM	#60
eiht_98 Confirmed User Join Date: Jan 2001 Location: EU Posts: 6,103	I deleted the registry entry and the msblast file but still got the shutdown error. A few minutes ago I have installed the MS patch. Will see if it works.

08-12-2003, 11:17 PM	#62
evildick Guest Posts: n/a	I just went through the joy of downloading all of Microsoft's patches after doing a fresh install of XP. Over 100 MB's for service pack 1, and I'm on dialup. And then there's still another 30 MB or so of patches after that. It'll be another day before I get all my programs installed again. Fuck you Microsoft.

08-12-2003, 11:46 PM	#64
SLY1 Confirmed User Join Date: Aug 2003 Location: L.A. Posts: 910	My computer shuts down every 2min. This worm sucks!