Author Topic: RPC worm (Read 1030 times)

jasonlane · « **on:** 12 August 2003, 15:52 »

web page

Seems to have bitten M$ up the ar$e as well. I'll check on netcraft latter but Vole central was down today at 12:00 GMT

Stryker · « **Reply #1 on:** 12 August 2003, 16:30 »

my xp machine got that today too. i only noticed because the rpc service kept shutting down, and it wanted to reboot. shutdown -a every time i boot is very annoying.

oh well, i never use that machine anyways.

M51DPS · « **Reply #2 on:** 12 August 2003, 19:29 »

quote:
Originally posted by Stryker:
my xp machine got that today too. i only noticed because the rpc service kept shutting down, and it wanted to reboot. shutdown -a every time i boot is very annoying.

oh well, i never use that machine anyways.

Just make sure it's on during the 16th of August.

Kupotek · « **Reply #3 on:** 12 August 2003, 23:00 »

Turn on your firewall, also look up the tool removal for msblast.exe on symantec.com, and run that. Getting online without a firewall is stupid anyways.

jasonlane · « **Reply #4 on:** 12 August 2003, 23:11 »

Don't remove MSBLAST.EXE until after the 16th, surely???

Infact I have an XPee laptop here, rarely running, that I just may well connect to the internet....It's sure to catch some sort of virus.

[ August 12, 2003: Message edited by: Zardoz ]

M51DPS · « **Reply #5 on:** 13 August 2003, 05:51 »

According to this article the worm contains the message, "Billy Gates why do you make this possible? Stop making money and fix your software!!". Think they got it yet?

Faust · « **Reply #6 on:** 13 August 2003, 06:00 »

quote:

Said Hyponnen: "On the 16th of August, the worm will start a distributed denial of service attack against the windowsupdate.com server".

Good thing: Microsoft gets hit badly.
Bad thing: Due to worm traffic on my local network I'm getting bad ping times in games.

[sob]

And yeah, if you leave samba open to the www you deserve to get hit but this isn't the underlying problem - the problem is that Microsoft security is crap. By *default* a fresh install of XP will leave "shared folders" network writable which leaves you open as all hell to nimda etcetera. Not to mention the speed with which other worms can crack samba passwords.

Oh and by the way for those of us on permanent LANs (me) and running Windows (not me

) using a firewall when connecting to the internet wont help. Because samba will be open to the local network (this is after all what it's intended purpose is) all it takes is for *one* person on a Windows users subnet (could even be on the same subnet your ISP just gave you) and you can quite easily be infected. A firewall is useless, the only "safety" available is to turn off samba or password it. Which off course makes samba completely useless for anonymous file sharing as well.

(Even then most samba passwords can be cracked quickly. Especially if you have XP home and havent booted up in safe mode to give the "administrator" account a password.)

Unpassworded admin accounts by default. Good work Bill you dumb fuck.

Faust · « **Reply #7 on:** 13 August 2003, 06:05 »

TCP 135 is an RPC port ???
Isn't that samba?

Faust · « **Reply #8 on:** 13 August 2003, 06:06 »

quote:

If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

ROFLMAO

suselinux · « **Reply #9 on:** 13 August 2003, 13:05 »

Debit was down in some of the vancouver area

I think it might have been this bug, cause I was told that the actual banks were down not just the debit system

bigsleep · « **Reply #10 on:** 13 August 2003, 14:27 »

I think that any machine that sends a virus out to other computers should get it's IP blacklisted, that should effectively shut down most MS servers eventually.
My server still gets RedCode type hits.

Jeeze, I'd go on... but I got things to do (like block spam).

Pissed_Macman · « **Reply #11 on:** 13 August 2003, 14:43 »

THIS IS FUCKING PRICELESS!!!!! AHAHAHHAHAHAHHA!!!!!!! Seriously, are any of you behind this?

Hey we should all go out and install illegal versions of Xpee on our PCs to add to Microsoft's problems.

Wow this is really great. Maybe this will get the message across that M$ products SUCK ASS!!!!

jasonlane · « **Reply #12 on:** 13 August 2003, 15:42 »

quote:
Despite being described by Symantec and other anti-virus firms as being "badly written", he told us today: "Whoever made this thing deserves a pat on the back. It completely goes around most forms of existing Windows security".

Heh he

Samba is shit. Samba is 137 to 139. 135/tcp is DCE endpoint resolution and 135/udp is RPC. NT also had some DNS & DHCP management stuff there as well.

Also it's nice to see 135 traffic rising, it's like a symphony to my ears.

However 135 seems to have given Bill and his minions trouble in the past as well.

135

Will we look back on this in years to come and say:

quote:
Remember the 135!

Die Micro$hite, die!

[ August 13, 2003: Message edited by: Zardoz ]

wargames_guru · « **Reply #13 on:** 13 August 2003, 16:05 »

ROTF: my firewall log is 5 pages and counting...he he damn worm has been scanning all night. but lo and behold 135 is stealthed on my box/boxes. urp........IF you read this....Hi bill, hope you idiots in Redmond have plenty of Egg on your faces......ha he he ha ha

jasonlane · « **Reply #14 on:** 13 August 2003, 21:05 »

So already there's a new version of blaster out there!!!! Also IBM & Mototrola have been infected, because of the fucking excuse of a company called Micro$hite. I hope they get taken to the cleaners, they do not deserve their position.

I only hope this causes IBM to drop M$ altogether.

They must go!

[ August 13, 2003: Message edited by: Zardoz ]

« previous next » Print Pages: [1] 2 3 4 Go Down Author Topic: RPC worm (Read 1030 times) jasonlane Member Posts: 743 Kudos: 0 RPC worm « on: 12 August 2003, 15:52 » web page Seems to have bitten M$ up the ar$e as well. I'll check on netcraft latter but Vole central was down today at 12:00 GMT Logged The MES Anti-Prude Force ***** "I don Stryker VIP Posts: 1,258 Kudos: 41 RPC worm « Reply #1 on: 12 August 2003, 16:30 » my xp machine got that today too. i only noticed because the rpc service kept shutting down, and it wanted to reboot. shutdown -a every time i boot is very annoying. oh well, i never use that machine anyways. Logged M51DPS VIP Posts: 608 Kudos: 30 RPC worm « Reply #2 on: 12 August 2003, 19:29 » quote: Originally posted by Stryker: my xp machine got that today too. i only noticed because the rpc service kept shutting down, and it wanted to reboot. shutdown -a every time i boot is very annoying. oh well, i never use that machine anyways. Just make sure it's on during the 16th of August. Logged Kupotek Member Posts: 74 Kudos: 0 RPC worm « Reply #3 on: 12 August 2003, 23:00 » Turn on your firewall, also look up the tool removal for msblast.exe on symantec.com, and run that. Getting online without a firewall is stupid anyways. Logged "The only thing that is impossible is the possibility of impossibility" KittySafe Ntwrk. jasonlane Member Posts: 743 Kudos: 0 RPC worm « Reply #4 on: 12 August 2003, 23:11 » Don't remove MSBLAST.EXE until after the 16th, surely??? Infact I have an XPee laptop here, rarely running, that I just may well connect to the internet....It's sure to catch some sort of virus. [ August 12, 2003: Message edited by: Zardoz ] Logged The MES Anti-Prude Force *** "I don M51DPS VIP Posts: 608 Kudos: 30 RPC worm « Reply #5 on: 13 August 2003, 05:51 » According to this article the worm contains the message, "Billy Gates why do you make this possible? Stop making money and fix your software!!". Think they got it yet? Logged Faust Member Posts: 1,223 Kudos: 0 RPC worm « Reply #6 on:** 13 August 2003, 06:00 » quote: Said Hyponnen: "On the 16th of August, the worm will start a distributed denial of service attack against the windowsupdate.com server". Good thing: Microsoft gets hit badly. Bad thing: Due to worm traffic on my local network I'm getting bad ping times in games. [sob] And yeah, if you leave samba open to the www you deserve to get hit but this isn't the underlying problem - the problem is that Microsoft security is crap. By default a fresh install of XP will leave "shared folders" network writable which leaves you open as all hell to nimda etcetera. Not to mention the speed with which other worms can crack samba passwords. Oh and by the way for those of us on permanent LANs (me) and running Windows (not me ) using a firewall when connecting to the internet wont help. Because samba will be open to the local network (this is after all what it's intended purpose is) all it takes is for one person on a Windows users subnet (could even be on the same subnet your ISP just gave you) and you can quite easily be infected. A firewall is useless, the only "safety" available is to turn off samba or password it. Which off course makes samba completely useless for anonymous file sharing as well. (Even then most samba passwords can be cracked quickly. Especially if you have XP home and havent booted up in safe mode to give the "administrator" account a password.) Unpassworded admin accounts by default. Good work Bill you dumb fuck. Logged Yesterday it worked Today it is not working Windows is like that -- http://www.gnu.org/fun/jokes/error-haiku.html Faust Member Posts: 1,223 Kudos: 0 RPC worm « Reply #7 on: 13 August 2003, 06:05 » TCP 135 is an RPC port ??? Isn't that samba? Logged Yesterday it worked Today it is not working Windows is like that -- http://www.gnu.org/fun/jokes/error-haiku.html Faust Member Posts: 1,223 Kudos: 0 RPC worm « Reply #8 on: 13 August 2003, 06:06 » quote: If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer. Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations. ROFLMAO Logged Yesterday it worked Today it is not working Windows is like that -- http://www.gnu.org/fun/jokes/error-haiku.html suselinux Member Posts: 711 Kudos: 30 RPC worm « Reply #9 on: 13 August 2003, 13:05 » Debit was down in some of the vancouver area I think it might have been this bug, cause I was told that the actual banks were down not just the debit system Logged bigsleep Member Posts: 105 Kudos: 0 RPC worm « Reply #10 on: 13 August 2003, 14:27 » I think that any machine that sends a virus out to other computers should get it's IP blacklisted, that should effectively shut down most MS servers eventually. My server still gets RedCode type hits. Jeeze, I'd go on... but I got things to do (like block spam). Logged Pissed_Macman VIP Posts: 2,499 Kudos: 0 RPC worm « Reply #11 on: 13 August 2003, 14:43 » THIS IS FUCKING PRICELESS!!!!! AHAHAHHAHAHAHHA!!!!!!! Seriously, are any of you behind this? Hey we should all go out and install illegal versions of Xpee on our PCs to add to Microsoft's problems. Wow this is really great. Maybe this will get the message across that M$ products SUCK ASS!!!! Logged jasonlane Member Posts: 743 Kudos: 0 RPC worm « Reply #12 on: 13 August 2003, 15:42 » quote: Despite being described by Symantec and other anti-virus firms as being "badly written", he told us today: "Whoever made this thing deserves a pat on the back. It completely goes around most forms of existing Windows security". Heh he Samba is shit. Samba is 137 to 139. 135/tcp is DCE endpoint resolution and 135/udp is RPC. NT also had some DNS & DHCP management stuff there as well. Also it's nice to see 135 traffic rising, it's like a symphony to my ears. However 135 seems to have given Bill and his minions trouble in the past as well. 135 Will we look back on this in years to come and say: quote: Remember the 135! Die Micro$hite, die! [ August 13, 2003: Message edited by: Zardoz ] Logged The MES Anti-Prude Force ***** "I don wargames_guru Member Posts: 24 Kudos: 0 RPC worm « Reply #13 on: 13 August 2003, 16:05 » ROTF: my firewall log is 5 pages and counting...he he damn worm has been scanning all night. but lo and behold 135 is stealthed on my box/boxes. urp........IF you read this....Hi bill, hope you idiots in Redmond have plenty of Egg on your faces......ha he he ha ha Logged Adore is useless......long live FreakyG. jasonlane Member Posts: 743 Kudos: 0 RPC worm « Reply #14 on: 13 August 2003, 21:05 » So already there's a new version of blaster out there!!!! Also IBM & Mototrola have been infected, because of the fucking excuse of a company called Micro$hite. I hope they get taken to the cleaners, they do not deserve their position. I only hope this causes IBM to drop M$ altogether. They must go! [ August 13, 2003: Message edited by: Zardoz ] Logged The MES Anti-Prude Force *** "I don Print Pages: [1] 2 3 4 Go Up** « previous next » Stop Microsoft » Forum » All Things Microsoft » Microsoft as a Company » RPC worm
Share or donate

Author Topic: RPC worm (Read 1030 times)

Share or donate