Have I just been hacked?

[Mr. Goodbytes]

Sheez, i used to be king of locking down my computer when I had cable modem, but now with dialup I have been lazy, and I think I just got pinched. I thought possibly that downloading and installing yahoo messenger may have been causing the problems because it's made my comp flakey in the past, but i get the feeling that's not it. (uninstalled it to be sure though).

So what's happened has happened twice now... damn, happening again i think. Ok, this his on a win2k SP3 setup. What happens is that svchost.exe keeps getting errors and shuts down. But one time it didn't and doing things such as copying and pasting ceased functioning. IE started acting up, wouldn't let me open pages in a new window, and sometimes clicking at all did nothing. It did once say i didn't have permission. I noticed this process called msblast.exe running and I locked it down because it didn't seem right. There was no microsoft identification to go with it, but in that startup option in control panel (acts like msconfig), it said it was Microsoft Auto Update. But that's not what microsoft calls the feature, it's windows updated. And i do have that the automatic update feature downloaded (yes it was accidental), but i disabled it long time ago in the services editor in my administrative tools. (Noticed that ran through svchost.exe anyway.) So what gives? Did I get nailed?

I used to run blackice, but my license expired. I'm downloading zonealarm right now to see if i can register any hits.

[Siliconjunkie]

Hmmm, not sure that I would jump to you getting hacked. Could just be something got borked. Not sure tho.

A quick google on msblast.exe turned up no hits. So, whatever it is, it isnt very common.

[BabyGirl2013]

Yeah, mblast.exe, is apparently this LOVELY worm virus. I had it myself and have helped 4 other people now rid their machines of it.

Here is a post to help you rid yourself of these nasty lil errors and BS ya keep getting. HTH!!!

http://www.techimo.com/forum/t75890.html

Welcome to the ever increasing group, don't feel alone.

News Post:

http://www.techimo.com/newsapp/index.pl?photo=6764

Technical Info:

http://isc.sans.org/diary.html?date=2003-08-11

[Siliconjunkie]

Hmm, no google hits on msblast.exe, mblast.exe or blast.exe . The symptoms he describes don't agree with the other thread either. If the RPC service dies it will try to restart the computer. svchost.exe is a pretty generic process.

Are you running an anti-virus? Is it up to date? Any unusual processes in task manager?

I'm still leaning towards something corrupt in Windows.

edit: Good find Rob! Odd that Google wouldnt hit on it at all. May be too new. But, it was only a matter of time before someone hit the RPC vulnerability.


http://www.techimo.com/forum/t75868.html

[Mr. Goodbytes]

No, my norton isn't up to date. My friend has the my CD and i have to reinstall it so I don't have to purchase a new 1 year license. She gets back in a week or so. I can only think that yahoo did it. God I hate that program. From now on, anyone who says that they only use yahoo messenger can go talk to a wall for all I care.

[meese]

Not to make any freak out more than they need to, but it appears the worm still stops the RPC Service EVEN if you have uptodate antivirus and the patch from MS. But it does not get into the registry keys. So if your pc starts shuting down and you are patched, now you know why.

[BabyGirl2013]

Ok, I am still getting a virus message also, and I did EVERYTHING the post told me to do, updated, and everything. My Virus scanning software didnt detect it in a run but does pop up a message telling me I do have a virus. How do I get rid of this???? This is the message:

You have a virus - Worm/Lovsan
C:\System Volume Information \restore{09CCCFB9-A31A-9497-9677-8D4C7AC8D48D}RP40\A0023302.exe

[sharder8]

Originally posted by BabyGirl2013
Ok, I am still getting a virus message also, and I did EVERYTHING the post told me to do, updated, and everything. My Virus scanning software didnt detect it in a run but does pop up a message telling me I do have a virus. How do I get rid of this???? This is the message:

You have a virus - Worm/Lovsan
C:\System Volume Information \restore{09CCCFB9-A31A-9497-9677-8D4C7AC8D48D}RP40\A0023302.exe

Okay BabyGirl2013, that means you still have remnants of Blaster in your system. Try running the System Cleaner under "Automatic Removal Instructions", and following the instructions.

Harder

[sharder8]

On second thought, that may mean that you have the "worm" in your archives. Are you running "Go Back" or something similar?

You may have to delete this archive in order to entirely remove the "worm", but without further info, I'm not sure how smart that would be.

Harder