Author Topic: Urgent News - Fake Crash Patch (Read 2535 times)

GhostShip · « **on:** November 12, 2005, 06:28:51 pm »

Folks some idiot has been going around the rooms warning folks to get a program from this site against a non-existant room crashing tool

h ttp://chatattackpatch.95mb. com

I looked at the download link on the site

h ttp://67.171.62.83/Chat-Attack-Patch-beta3. zip

(taken from the page source )

I checked this out myself as I havent seen any rooms crashed yet.

I downloaded a program that was in zip dated 11/11 so it was put together recently, and started looking at its construction.

It was wrapped in PeBUndle, a wrapper used for programs that helps other files to be hiddedn inside one single file.

Splitting this program down I extracted an active x component and a visual basic program that I then checked through with a hex editor.
This revealed this web link amongst others

h ttp://*****.com/flash/you. html

Doing a google search for this revealed this to be a javascript worm page

http://digg.com/security/Worm_infects_You,_And_calls_you_an_Idiot

Quote

The W32/Cisum.A worm displays the message "YOU ARE AN IDIOT" while repeating an MP3 with the same phrase every five seconds. Beyond audibly berating its victims, the Cisum worm also targets security programs, including firewalls and anti-virus programs, and shuts them down.

Looking through the code some more I saw this text string.

C:\DOCUME~1\Josh\LOCALS~1\Temp\Rar$EX10.843\MSWINSCK

Knowing that this IP belongs to Josh I am waiting to hear what this is all about but regardless.

Do NOT Download This Program

Fun Guest · « **Reply #1 on:** November 12, 2005, 07:00:58 pm »

If you take h ttp://67.171.62.83/Chat-Attack-Patch-beta3. zip and chop off the Chat-Attack-Patch-beta3.zip part it links to winmxunlimited .net. What was he thinking? By the way, Josh is an idiot! haa-haa-haa-haa, ha ha ha, ha ha ha ha ha.

Sean · « **Reply #2 on:** November 12, 2005, 10:38:24 pm »

I think that josh dude got hacked or somthing. When i go to any of his websites i get this...

Fuck you Josh! HAHAAHAAAHAHAH!
I hope the world likes me for making this program on your computer and releasing it

You shouldn't leave REALVNC on fag! hahaha

Everyone Go here and download the chat attack patch! It will protect your room! - Click Here

-Fast-007-

look - http://www.win mxunlimited.net

Smitty · « **Reply #3 on:** November 12, 2005, 11:29:58 pm »

http://www. winmn xunlimited.com & http://www.winm xpayback.com both belong to Josh......I'm supposing that he got hacked.

Smitty · « **Reply #4 on:** November 12, 2005, 11:30:55 pm »

I meant....https://www.winmxunlimited.net

Where is the freaging edit button?

p2p rules · « **Reply #5 on:** November 12, 2005, 11:49:16 pm »

I went & checked out h ttp://****. com/flash/you. html & got infected , AVG7 caught it right away.AVG said it was a trojan.

rec time="2005/11/12 18:38:31" user="stoner" source="Virus">
<value>@HL_ReportFindRS</value>
<attr name="filename">C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\FG8R1KL0\YOU[1].JS</attr>
<attr name="finding">@EID_Id_trj</attr>
<attr name="virusname">JS/NoClose</attr>
</rec>
- <rec time="2005/11/12 18:39:11" user="stoner" source="Virus">
<value>@HL_ActionTaken</value>
<attr name="filename">C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\FG8R1KL0\YOU[1].JS</attr>
<attr name="action">@HL_ActCleaned</attr>

Smitty · « **Reply #6 on:** November 13, 2005, 12:37:57 am »

Boy...that's nice....you got infected, but you incist on spreading that link? Somebody should seriously remove that link.

GhostShip · « **Reply #7 on:** November 13, 2005, 12:54:14 am »

I thought you knew better than to follow a nasty link P2P

Still I think that there is something not right here at all as the sites are tampered with and for the moment could anyone connected to Joshs machine please block msn and take no notice of any links he/his machine has already sent out .

I know Josh has had trouble with vnc before but if he is allowing his machine to get taken down this easily again I question the wisdom of him operating winmx help sites as he could be spreading all sorts of malicous stuff for weeks now without knowing it, very bad news for us all

p2p rules · « **Reply #8 on:** November 13, 2005, 01:36:45 am »

BTW, it was already linked on this site in the 1st place.WTG for editing out that link.

I know I should've known better d'uh.I've been to that site before to check out flash clips & play flash games and never got a virus from that site.I don't think i'll be visiting that site anymore.I guess I had to check it out to believe it.
Josh's site is back up.

GhostShip · « **Reply #9 on:** November 13, 2005, 01:42:19 am »

Cool, well its human nature to look I suppose

I just used Loogle for looking over the link and got hit with there cached version so I wasnt being very clever myself but I was at least ready to take any nastyware down :twisted:

I will be asking Josh to clean sweep all sites under his control as a "time bomb" may well be in place just hiding till next time.

Stevi · « **Reply #10 on:** November 13, 2005, 05:23:54 am »

I kinda feel bad for the poor man. He does so much for people but yet this is how they repay him. I dont hate you Josh. I am confident that he will get this all sorted out.

KM · « **Reply #11 on:** November 13, 2005, 06:30:04 am »

To be honest, I think he pretends half of the time,

ignoring the obvious fact that it is almost impossible to believe that anyone would keep repeatedly allowing anyone who wants it complete access to his computer as he claims he keeps doing, there is still the fact that he often does things like that himself and has been known to suddenly start denying his own words when he realises that people have found out about it

~~Josh~~ · « **Reply #12 on:** November 16, 2005, 01:32:16 am »

For everyone who thinks that the "a**holes" that go around saying that i spread virus's around to everyone and that i share kid porn they are wrong. Even though iam not liked by many people i would never put any of the people on my msn or the WPN network in danger. And thats just disgusting about that porn. However I do look at some girl on girl action Laughing but.. kid porn is just wrong. Maybe they were looking at their own files

. If you have any comments to post I would like to hear them because i bet most of it will be from the a**holes who just try to make me look bad.

Have a Good Time Smile

GhostShip · « **Reply #13 on:** November 16, 2005, 04:42:46 am »

Josh, I am personaly disappointed that you took so long to come and reply to this thread, I know you read it days ago.

I hope you have double checked the site and properly secured your machine, since the crash all winmx related sites should be on high alert to RIAA break-ins as they have admitted they attempt this in court cases so please do not make life easy for them and put users at risk.

Enough on this subject, we need your site working to reconnect folks as it has been doing for a while now, dont undo the good work you have been doing.

~~Josh~~ · « **Reply #14 on:** November 16, 2005, 09:01:50 pm »

well ive been sick all weak.

Author Topic: Urgent News - Fake Crash Patch (Read 2535 times)

Fun Guest

Sean

KM