Computer guyz...WTF is THIS???

LORDBLiTZ · 08-02-2003, 04:05 PM

This thing pops up and shuts my puter off. I'm on a Toshiba Satellite laptop, celeron 1.8 with XP home.

**redrock** · 08-02-2003, 04:23 PM

That's bizarre, you running XP Pro or Home? I've never come across that ever. Has it happened since or was it a one time thing? Installed any new programs or hardware? Done anything different lately?

**bermich** · 08-02-2003, 04:41 PM

FIRST thing I would do is run your VIRUS detection. Norton or something.
Do you access your home computer from other computers over the internet?
Do you have that new remote control for your computer?
I would be safe and say it is a trojan virus.
It could be your chat program you have running. The ESO conversation.
Maybe someone is trying to hack in your comp and your computer is shutting it down.
I dont know. I just turn my computer on and kick it occassionally when it is slow.
Good luck Rich.

**RON** · 08-02-2003, 04:45 PM

I'd say a Virus is a good bet specially since I see Kazaa in the background

LORDBLiTZ · 08-02-2003, 05:24 PM

I ran norton 2003 and it didn't find anything. The remote assistance box is unchecked, so no one can connect to me through msn msg. I wasn't running anything, just talking on msn. Also, i'm behind a router. I know my way around a puter, but have never seen this before!

**TheMudMan** · 08-02-2003, 05:30 PM

It's a tool that's used to shutdown machines remotely. I use it all the time. Look for a file named shutdown.exe..... Are you in a school dorm or on a public network?

**TheMudMan** · 08-02-2003, 05:33 PM

Download and install this update from Microsoft:

Windows 2000
http://www.microsoft.com/downloads/d...displaylang=en

or if you have:

Windows XP
http://www.microsoft.com/downloads/d...DisplayLang=en

I was at work last night installing this on my servers..... It's A security issue that has been identified that could (in your case has) allow an attacker to remotely compromise a computer running Microsoft Windows and gain complete control over it.

LORDBLiTZ · 08-02-2003, 05:39 PM

I'm at my house bro. Is someone shutting my shit down on me?

**TheMudMan** · 08-02-2003, 05:47 PM

Originally Posted by LORDBLiTZ

I'm at my house bro. Is someone shutting my shit down on me?

It looks that way through the RPC service........ either install the update for your OS that I linked in the other post or run Windows Update.

LORDBLiTZ · 08-02-2003, 05:50 PM

Ok, Thx mudman! Damn Quake 3 kids hacking my shit

**TheMudMan** · 08-02-2003, 05:52 PM

If I was any of you guys and your using a cable modem or dsl then I would install this update. Either use Windows Update or install from the links I provided.

If your on a modem I wouldn't worry about it too (but do install it) much because a hacker will not waste his time scanning your slow ass ports

**TheMudMan** · 08-02-2003, 05:53 PM

Originally Posted by LORDBLiTZ

Ok, Thx mudman! Damn Quake 3 kids hacking my shit

No problem bro. I love this stuff.

**Red Ketchup** · 08-02-2003, 06:49 PM

Go to http://www.moosoft.com/ and get "The Cleaner"

Sounds like you got a trojan. Trojans and viruses are not the same thing and often the virus scanners will not catch a trojan

The Cleaner saved my ass once... big time! Got infected by a Sub7 trojan back when it came out (from a dirty crack...). MacAffee and Nortons didn't spot it, TheCleaner did.

Red

**punk_bbuilder** · 08-02-2003, 07:04 PM

Thats pretty fucked up dude

**bermich** · 08-02-2003, 07:05 PM

Funny thing. Before coming here I just got a virus from KAZAA. w32kbot. No big deal since I was gonna do a complete wipe out of my system. Now it is just gonna be upped on my schedule of shit I really dont have the time for but need to do.
Peace out.

**bluemofo4** · 08-02-2003, 07:11 PM

good advice mudman, that's exactly what i would have said...run the windows update (even if you don't have this prob)...the critical update released by microsoft will def fix your RPC errors

**abstrack** · 08-02-2003, 09:27 PM

you might also think about using a spy ware program like ad-ware to rid you computer of those ads

**depdaddy** · 08-02-2003, 10:47 PM

had almost the same thing happen to my computer..actally had 3 differnt trojan viruses..i have cable modem and forgot i turned my firewall off..what a fucking mess..some asshole kid was turning my computer on and off from Cali..im in Florida..when we finally got all 3 out he must have left some type of self destruct because my proccesser blew up..only 10 months old

**cfase** · 08-04-2003, 10:11 AM

If you know how to navigate around your computer somewhat, go to your control panel then to system settings and in the system settings window there should be a selector bar for advanced settings. Look for a checked box that says shut down computer on errors and unchech that box. Next if you want to for the time being,, in control panel go to services adn look for the rpc services and while your online take the rpc services off of auto and place into manual and this will stop your puter from shutting down for the time being.....I agree with all said so far, get adaware and run it,,,,I would also check your settings for your built in firewall that windows xp has and make sure that you dont have a "doorway"open on it.......

C

**Football_Bill** · 08-04-2003, 12:48 PM

The best advice on here is to do the windows update, then a virus scan. On the McFee website is a small utility called Stinger. It searches very deep for the top 17 virus. The other thing is spy/ad ware. Kazaa is full of it, and I have been told there is a Kazaa patch for XP as well, but haven't installed it.

**bermich** · 08-04-2003, 05:41 PM

Computers suck. Cant wait for PS2 to get their web based system up and running. Never heard of such a thing but I cant wait til they get it...

LORDBLiTZ · 08-04-2003, 07:46 PM

Well, after the windows updates i have no problems. Thanks guys. I should know better to hit windows update up! But for some reason my laptop will only D/L and install one update at a time. 2 hours later i have them all.

**symatech** · 08-11-2003, 01:27 PM

holy shit bro now I got that problem. I hope i can get the updates seing as how my os is pirated

**Carlos_E** · 08-11-2003, 02:06 PM

Originally Posted by TheMudMan

Download and install this update from Microsoft:

Windows 2000
http://www.microsoft.com/downloads/d...displaylang=en

or if you have:

Windows XP
http://www.microsoft.com/downloads/d...DisplayLang=en

I was at work last night installing this on my servers..... It's A security issue that has been identified that could (in your case has) allow an attacker to remotely compromise a computer running Microsoft Windows and gain complete control over it.

This is the exact reason I use OS X on a Mac.

**BigGreen** · 08-11-2003, 02:21 PM

HOLY SHIT!!! I'm getting the exact same thing at home right now (came into work to use the PC to see if I could find out anything about it). I can't believe it is happening to someone else right now. Same message, same countdown..EVERYTHING! I simply disconnected my internet connection and everything is working fine. I'm not sure what i'm going to do about hooking back up, but the pc works fine now that i'm not online. Before disconnecting, though, it would boot me off in that EXACT same manner every time I tried to log on.

**symatech** · 08-11-2003, 02:43 PM

hey green just install the update it worked for me...thankfully

**BigGreen** · 08-11-2003, 03:39 PM

Originally Posted by symatech

hey green just install the update it worked for me...thankfully

How did you eventually get back on to even install the update? Every damn time I even try to log on it gives me that sixty second warning immediately. The only way I can log on is to be disconnected from the internet.

**symatech** · 08-11-2003, 05:15 PM

shit bro, mine gave me about 2 minutes before it went. i finally got it downloaded, restarted, and then ran the program to fix this shit. this is at your house? can you get internet access at your work, or a friends house or something? if so just download it there, put the program on a disk, the run it at your computer.

**TheMudMan** · 08-11-2003, 05:19 PM

Go into the Services and disable the Remote Procedure Call. Reboot and then grab the update and install it. After the reboot then activate the service again.

**BigGreen** · 08-11-2003, 09:59 PM

Guys, this thing is wreaking havok on my PC...i've been on the phone with sony help for four hours. I've downloaded the necessary security patch but now it is saying that I don't have the necessary cryptographic setup running to download ANY microsoft windows updates. Is anyone else running in to this? I can stay online now, but a WHOLE lot is wrong with my computer...no task bar...slow as hell boot ups, random shit going wrong. FUCK

**BigGreen** · 08-11-2003, 10:11 PM

http://www.cnn.com/2003/TECH/interne....ap/index.html

Well, I know what it is now...but i still can't figure out for the life of me why my computer won't let me download a SINGLE microsoft update, even if it has nothing to do with this virus.

**trimunex** · 08-11-2003, 10:16 PM

Thanks for the links MudMan

9

**BigGreen** · 08-11-2003, 10:44 PM

Originally Posted by trimunex

Thanks for the links MudMan

9

So you were able to download the patch? I am able to get there, open it and all that good stuff, but every damn time it goes to download, it says that my computer does not have the cryptographic code running. My copy of XP is legit and I've succesfully d'loaded these things in the past, but now I can't download a SINGLE piece of microsoft software updates, whether it has anything to do with this virus or not.

**Vik** · 08-11-2003, 11:08 PM

hey mudman, thanks for the links bro, my computer started to have the exact same problem today.

**Needtobeswoledup** · 08-11-2003, 11:43 PM

I had the exact same problem the past few days.... makes you wonder if some1 is pulling ips off ar to fuck with.... the update seems to have fixed it though...

**BigGreen** · 08-11-2003, 11:54 PM

Well, for any PC guys or gals that may come in here overnight...here's what i've done:
From the task manager I was able to stop the MSblast from running (this has been identified as the virus). From there, I went into my windows folder, system 32 and deleted MSBlast.exe.

That was "supposed' to remedy most, if not all, of my problems. However, I STILL can not get my computer to accept any microsoft downloads (it continues to tell me that my cryptography does not recognize it) even with the MSBlast off my computer. Apparently, something has been left behind that still attempts to prevent me from patching.

**SonGoku** · 08-12-2003, 02:28 AM

Well most of you have probably solved this issue, but if you haven't here's a little more info on how to remove this virus from your system completely. Also remeber to run your windows update and anti virus update every now and then, most infected systems are systems that are not up to date.

I. Aliases

msblast.exe
tftp
Win32.Poza (CA)
WORM_MSBLAST.A (Trend)
W32/Lovsan.worm (McAfee)

II. Description

This threat tries to exploit the MS03-026 vulnerability.

This threat scans ** ranges to look for target systems on TCP port
135. The worm attempts to exploit the DCOM RPC vulnerability on
the target systems to download and execute the worm via tftp.

Once run, the worm creates the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ Run
"windows auto update" = msblast.exe I just want to say LOVE YOU
SAN!! bill

III. Details

This worm spreads by exploiting a recent vulnerability in
Microsoft Windows. The worm scans random ranges of ** addresses
on port 135. Discovered systems are targeted. Exploit code is
sent to those systems, instructing them to download and execute
the file MSBLAST.EXE from a remote system via TFTP.

IV. Removal

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan and delete all the files detected as this
worm.
4. Delete the value that was added to the registry.

**TheMudMan** · 08-12-2003, 05:04 AM

Originally Posted by BigGreen

Well, for any PC guys or gals that may come in here overnight...here's what i've done:
From the task manager I was able to stop the MSblast from running (this has been identified as the virus). From there, I went into my windows folder, system 32 and deleted MSBlast.exe.

That was "supposed' to remedy most, if not all, of my problems. However, I STILL can not get my computer to accept any microsoft downloads (it continues to tell me that my cryptography does not recognize it) even with the MSBlast off my computer. Apparently, something has been left behind that still attempts to prevent me from patching.

Hey BigGreen try this:

================================================== ====

http://support.microsoft.com/default...b;en-us;326815

*SYMPTOMS
When you install Windows XP Service Pack 1 (SP1), you may receive the following error message:

Service Pack 1 Setup could not verify the integrity of the file. Make sure the Cryptographic service is running on this computer

*CAUSE
This issue occurs because either Cryptographic Services is set to Disabled for Startup type or there is log file or database corruption in the %Systemroot%\System32\Catroot2 folder.

*RESOLUTION
To resolve this issue, set Cryptographic Services to Automatic for Startup type. If this does not resolve the issue, stop Cryptographic Services, and then rename the %Systemroot%\System32\Catroot2 folder. To do so, follow these steps:
Start the Administrative Tools utility in Control Panel.
Double-click Services.
Right-click Cryptographic Services, and then click Properties.
Click Automatic for Startup type, and then click Start.
Install Windows XP SP1 again. If the problem persists, go to Step 6.
Click Start, and then click Run.
In the Open box, type cmd, and then click OK.
At the command prompt, type the following commands, and then press ENTER after each line:
net stop cryptsvc

ren %systemroot%\system32\catroot2 oldcatroot2

Type exit to close the command prompt, and then install Windows XP SP1 again.

Thread: Computer guyz...WTF is THIS???

Thread Tools

Search Thread

Rate This Thread

Display

Computer guyz...WTF is THIS???

virus

hmmmm

Thread Information

Users Browsing this Thread

Posting Permissions