RPC Exploit Warning - GoFuckYourself.com

m4tt · 08-11-2003, 06:27 PM

Yes, I know we don't need another thread about this but I wanted to point something out. This exploit does give users the ability to install programs on your system (as well as many, many other abilities).

While at work, my home PC reboot itself over 50 times. I get home to find that over 7 different spyware programs, some bizarre internet explorer plugins, several worms, and some weird looking programs have been installed on my system.

So, I recommend everyone run windows update as soon as possible : )

I may have to format c: just to get rid of all the stuff that was installed.

[Labret] · 08-11-2003, 06:29 PM

Yup. I cleaned that bitch, fired up my Symantec warez, 3 trojans and 15 worms later I think all is well.

j3ff · 08-11-2003, 06:31 PM

ROFL

m4tt, seems like norton server is gonna have shitload of work during the night lol.

Mutt · 08-11-2003, 06:33 PM

the RPC shutdown thing was on my puter for two days - but I can't find any worms or trojans - i ran my virus scan and nothing showed up.

j3ff · 08-11-2003, 06:34 PM

well, as long as you got your windows patched up, the registry key and the msblast.exe removed.. you wont get any NEW shit... just gotta find what happened when you were actually infected... wait for some updates of your AV software

j3ff · 08-11-2003, 06:35 PM

piece of shit. now im gonna have to spend all my day tomorrow again checking computers for spyware bullshit

Belinea · 08-11-2003, 06:36 PM

If you don't want to run wimdows update... for whatever reason

heres the patch

http://www.eu.microsoft.com/technet/...n/MS03-026.asp

j3ff · 08-11-2003, 06:37 PM

lol, windows update doesn't even work with windows 2000 when you got that exploit running on your computer

m4tt · 08-11-2003, 06:38 PM

Here are some of the files I found in msconfig (startup).. not sure what they do but I have never seen them before and shutting them down only helped (a lot)

mscache.exe, "C:\mscache.exe"
msbb.exe, "C:\WINDOWS\msbb.exe"
win32us.exe, "C:\windows\system32\win32us.exe /noconnect"
bargains.exe, "C:\Program Files\Bargain Buddy\bin\bargains.exe"
winnet.exe, "C:\Program Files\CommonName\Toolbar\winnet.exe"
FMSZGMTZ.exe, "C:\WINDOWS\FMSZGMTZ.exe"
winservn.exe, "C:\WINDOWS\system32\winservn.exe"
msblast.exe

Hooper · 08-11-2003, 06:41 PM

wow. i cant believe i'm the first person to post this.

http://www.apple.com/switch/

you mac addicts are getting slow :D

j3ff · 08-11-2003, 06:41 PM

mscache.exe, "C:\mscache.exe" .. not any .exe in root of c drive

msbb.exe, "C:\WINDOWS\msbb.exe" ?

win32us.exe, "C:\windows\system32\win32us.exe /noconnect"

bargains.exe, "C:\Program Files\Bargain Buddy\bin\bargains.exe"
prolly that GAIN shit or some third party shit installed by KaZaA or something else freeware o_O

winnet.exe, "C:\Program Files\CommonName\Toolbar\winnet.exe"
alexa or something like that?

FMSZGMTZ.exe, "C:\WINDOWS\FMSZGMTZ.exe" ?

winservn.exe, "C:\WINDOWS\system32\winservn.exe" sounds like a server, do some searches on it

Martin · 08-11-2003, 06:46 PM

j3ff · 08-11-2003, 06:46 PM

Quote:

Originally posted by Martin

http://www.gofuckyourself.com/showth...hreadid=162653

this thing's covered buddy heh

Martin · 08-11-2003, 07:10 PM

I can't get rid of that fucking box..

j3ff · 08-11-2003, 07:12 PM

Quote:

Originally posted by j3ff

http://www.gofuckyourself.com/showth...hreadid=162653

this thing's covered buddy heh

i put a very comprehensive walk thru there... you might wanna take a look at it :P

bigdog · 08-11-2003, 07:13 PM

Quote:

Originally posted by Hooper
wow. i cant believe i'm the first person to post this.

http://www.apple.com/switch/

you mac addicts are getting slow :D

damn right no worries about exploits for mac users

nosey · 08-11-2003, 07:13 PM

Quote:

Originally posted by Martin

shit

Martin · 08-11-2003, 07:14 PM

Quote:

Originally posted by nosey

shit

Yeah pretty funny eh asshole..

j3ff · 08-11-2003, 07:14 PM

you can't repair since this file IS the worm.. there's no use to that file, so it can't be repaired, it has to be deleted. (read plz thx)

Martin · 08-11-2003, 07:18 PM

Tried your walk thru already.. Isn't working..

This fucking bites..

j3ff · 08-11-2003, 07:20 PM

you have win2000? did you follow the 2000 part of tried the XP part ?....

nosey · 08-11-2003, 07:21 PM

Quote:

Originally posted by Martin

Yeah pretty funny eh asshole..

yeah

Martin · 08-11-2003, 07:22 PM

xp bro.

Martin · 08-11-2003, 07:23 PM

Quote:

Originally posted by nosey

yeah

eat a dick.

j3ff · 08-11-2003, 07:24 PM

I have norton too, I did it on 10 computers this morning, helped like 20 friends getting rid of it... and it worked perfectly, what part doesnt work?

nosey · 08-11-2003, 07:26 PM

Quote:

Originally posted by Martin
eat a dick.

you'd like th@ wouldn't you fatty
why don't you chill
i got infected also, jesus, who didn't

Vox · 08-11-2003, 07:34 PM

Quote:

Originally posted by nosey

you'd like th@ wouldn't you fatty
why don't you chill
i got infected also, jesus, who didn't

I didn't get infected (knock on wood)
Got the patch the second day it came out.
What I would like to know is how you guys got infected? E-mail or did it come from some malicious site.

j3ff · 08-11-2003, 07:36 PM

actually the guy can just send packets to your ip on port 135 and its done, can get a script in there or something, do not know exactly how he send it.

Martin · 08-11-2003, 07:37 PM

Quote:

Originally posted by nosey

you'd like th@ wouldn't you fatty
why don't you chill
i got infected also, jesus, who didn't

Fatty?!? haha.. What a dork.. Go away..

Anyway, j3ff I think I got it here dude. Just took a couple of times.. Thanks for your help.

Peace.

m4tt · 08-11-2003, 07:58 PM

Quote:

Originally posted by Vox
What I would like to know is how you guys got infected? E-mail or did it come from some malicious site.

Microsoft infected me with their shitty programming

m4tt · 08-11-2003, 09:07 PM

just found out that when i got to 'Empty Recycle Bin' it asks if I want to delete 'WINDOWS'.. the bin is empty!

btw.. I clicked yes and it says "Cannot read from the source file or disk"

m4tt · 08-12-2003, 09:59 AM

hump chump clump pump rump dump bump

08-11-2003, 06:27 PM	#1
m4tt So Fucking Banned Join Date: May 2003 Location: San Diaygo, CA Posts: 384	RPC Exploit Warning Yes, I know we don't need another thread about this but I wanted to point something out. This exploit does give users the ability to install programs on your system (as well as many, many other abilities). While at work, my home PC reboot itself over 50 times. I get home to find that over 7 different spyware programs, some bizarre internet explorer plugins, several worms, and some weird looking programs have been installed on my system. So, I recommend everyone run windows update as soon as possible : ) I may have to format c: just to get rid of all the stuff that was installed.

08-11-2003, 06:31 PM	#3
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	ROFL m4tt, seems like norton server is gonna have shitload of work during the night lol. __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-11-2003, 06:33 PM	#4
Mutt Too lazy to set a custom title Industry Role: Join Date: Sep 2002 Posts: 34,431	the RPC shutdown thing was on my puter for two days - but I can't find any worms or trojans - i ran my virus scan and nothing showed up. __________________ I moved my sites to Vacares Hosting. I've saved money, my hair is thicker, lost some weight too! Thanks Sly!

08-11-2003, 06:34 PM	#5
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	well, as long as you got your windows patched up, the registry key and the msblast.exe removed.. you wont get any NEW shit... just gotta find what happened when you were actually infected... wait for some updates of your AV software __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-11-2003, 06:35 PM	#6
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	piece of shit. now im gonna have to spend all my day tomorrow again checking computers for spyware bullshit __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-11-2003, 06:29 PM	#2
[Labret] Registered User Industry Role: Join Date: May 2001 Location: Са́нкт-Петербу́рг Posts: 10,945	Yup. I cleaned that bitch, fired up my Symantec warez, 3 trojans and 15 worms later I think all is well.

08-11-2003, 06:36 PM	#7
Belinea Registered User Join Date: May 2003 Location: Manchester UK Posts: 55	If you don't want to run wimdows update... for whatever reason heres the patch http://www.eu.microsoft.com/technet/...n/MS03-026.asp __________________ Naughty Allie converts like fuck and rebills forever.

08-11-2003, 06:37 PM	#8
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	lol, windows update doesn't even work with windows 2000 when you got that exploit running on your computer __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-11-2003, 06:38 PM	#9
m4tt So Fucking Banned Join Date: May 2003 Location: San Diaygo, CA Posts: 384	Here are some of the files I found in msconfig (startup).. not sure what they do but I have never seen them before and shutting them down only helped (a lot) mscache.exe, "C:\mscache.exe" msbb.exe, "C:\WINDOWS\msbb.exe" win32us.exe, "C:\windows\system32\win32us.exe /noconnect" bargains.exe, "C:\Program Files\Bargain Buddy\bin\bargains.exe" winnet.exe, "C:\Program Files\CommonName\Toolbar\winnet.exe" FMSZGMTZ.exe, "C:\WINDOWS\FMSZGMTZ.exe" winservn.exe, "C:\WINDOWS\system32\winservn.exe" msblast.exe

08-11-2003, 06:41 PM	#10
Hooper Confirmed User Join Date: Jul 2001 Location: A Free America Posts: 2,210	wow. i cant believe i'm the first person to post this. http://www.apple.com/switch/ you mac addicts are getting slow :D __________________ <a href="http://www.adultplatinum.com/"><img src="http://www.adult.com/wmbanners/10dcash-468x60.gif"></a>

08-11-2003, 06:46 PM	#12
Martin "Assassins" Industry Role: Join Date: Dec 2001 Location: At home Posts: 17,277	__________________

08-11-2003, 07:10 PM	#14
Martin "Assassins" Industry Role: Join Date: Dec 2001 Location: At home Posts: 17,277	I can't get rid of that fucking box.. __________________

08-11-2003, 07:14 PM	#19
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	you can't repair since this file IS the worm.. there's no use to that file, so it can't be repaired, it has to be deleted. (read plz thx) __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-11-2003, 07:18 PM	#20
Martin "Assassins" Industry Role: Join Date: Dec 2001 Location: At home Posts: 17,277	Tried your walk thru already.. Isn't working.. This fucking bites.. __________________

08-11-2003, 07:20 PM	#21
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	you have win2000? did you follow the 2000 part of tried the XP part ?.... __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-11-2003, 07:22 PM	#23
Martin "Assassins" Industry Role: Join Date: Dec 2001 Location: At home Posts: 17,277	xp bro. __________________

08-11-2003, 07:24 PM	#25
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	I have norton too, I did it on 10 computers this morning, helped like 20 friends getting rid of it... and it worked perfectly, what part doesnt work? __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-11-2003, 07:36 PM	#28
j3ff Confirmed User Join Date: Jun 2003 Location: Quebec city Posts: 690	actually the guy can just send packets to your ip on port 135 and its done, can get a script in there or something, do not know exactly how he send it. __________________ Can A Paysite Pluggin NOT Be A Simple Pluggin? Downloadable MPEG, WMV and DiVX -- UPDATED DAILY! www.itsyourporn.com

08-11-2003, 09:07 PM	#31
m4tt So Fucking Banned Join Date: May 2003 Location: San Diaygo, CA Posts: 384	just found out that when i got to 'Empty Recycle Bin' it asks if I want to delete 'WINDOWS'.. the bin is empty! btw.. I clicked yes and it says "Cannot read from the source file or disk"

08-12-2003, 09:59 AM	#32
m4tt So Fucking Banned Join Date: May 2003 Location: San Diaygo, CA Posts: 384	hump chump clump pump rump dump bump