Printable View
This one's anew wrinkle. Got a laptop infected with twunk_32.exe and wscsvc32.exe,
both of which seem pretty new. Anyway, this laptop has two partitions, a 76gb fat32
c: drive and a 75gb fat32 d: drive (yes, fat32!).
Windows won't boot and bluescreens instead. Both partitions are mountable from a PE
disk, and the data is there. So I'm running a backup right now and look to convert the
c: drive back to ntfs.
Never seen this chit though. Anyone else?
I never seen it before. I haven't used a windows box for while. :)
I mostly use Linux. But it is kind of weird how you have two partitions which are the same.
My two cents, install Linux on your laptop. It's more secure. That way you won't get any viruses that threaten to destroy your computer. Even on Linux you have to be careful but it's not as easy as Windows to get viruses.
I bet Baby got spanked for that one. lol.
OK, now that I'm done with my dumb pun, I have seen something close once:
I was working on a machine for a customer where I used to work once, and the guy had an XP Laptop where the machine could barely load Windows. Basically I had no idea what I could do to start fixing it because I didn't have admin (I called the guy myself, asked him if he knew the admin password.... He didn't of course) so I had a task of getting admin on the machine so I could fix it.
After some Straight up Wizardy (Seriously it's not like I could use an exploit or something and tell it "Install this Spybot and AVG for me now" I had to do everything by hand) and finally got it to scan.
I think you may want to do the back ups you're doing, and then, SCAN THE BACK UPS! because if you accidentally back up that, you'll be in this again.
Anyway, once you're done, don't just format and call it a day if you can, have some fun. I like to run deltree C: *.* /y so I can watch a file system die sometimes (It's relaxing), or, del C: *.* /S /Q for NT based, again, very calming to let the machine know who's the boss ;)
Anyway, one thing I kept seeing from a similar scenario, was a very specific fake security center. I looked up the Security Centers crap online, and the ones I found weren't what this was. It was a different one.
AVG, with Heuristics enabled, finally found it, but then I couldn't get rid of it. Basically had to open DOS and do it from there, and then, run AVG, And Spybot again, and finally got it.
So the point is, the thing I found was actually some weird fake security scanner, but I couldn't find it on google at all. The ones you find on there are well known, and easy to find, but a pain. The one this thing had, was different and at one point Windows wouldn't even boot.
Anyway, again, check your back ups when you're done.
deltree *.* only deletes all files within that directory so everything up or down from the specified path would go uneffected. System files won't be touched and neither will global libraries since so many processes use them at once. You can't delete running applications either. You wouldn't be able to automaticly delete read only and hidden files... even as admin.
I've explained this to you on more than one occasion... we've both been using computers for how long?!
I left out, intentionally, the C:WINDOWS part of that command, and there is no admin on Windows versions that it works on. I know it works because I've done it like I said. I even made a batch file out of it to prevent having to type to much.Quote:
Originally Posted by The-Spec
The first time I did it, I had rebooted Windows 98 into MS-DOS mode, and once I had it typed out, I looked at the clock, hit enter, and watched a screen fill with deletes. It doesn't boot when it gets done, which is why I said I knew it worked.
I've done the same thing with rm -rf / as root. Jinx made it into a roulette game that would roll a number and if it was like 1 or something it ran that.
Gore, are you still pretending to be a technician? AVG? Worst heuristic capabilities on the market, application incompatabilities, and weak removal capabilities.
BrokenCrow, do a repair installation first. Don't **** with NTFS conversions until it's done by the live system. You risk ****ing up some of the metadata and file ownerships. Once the core files are replaced, boot the machine and run MalwareBytes to remove any critters. Fix the LSPs and any winsock issues, and then convert the drives to NTFS.
Do I seem like a techie to you? I'm not pretending to be a tech, I'm good at being a bastard :)
It's just hard to make fun of you now that you're not fat.Quote:
Originally Posted by gore
WTF happened to this place? It's a ghost town.
Yeah look at the other forum sites I-world operates. Admins ban people for stupid reasons. People who actually help people on this site do not get their green dots (I want my Jerry beeds!). Only people who post massive amount of crap get rewarded. As far as ghost town comment, this is why I post viral videos so google junkies will click on it. This board has history and the archives are golden like Phrack and 2600.Quote:
Originally Posted by D0pp139an93r
I know, I'm sorry, I should have warned you I was dropping weight fast. The funny part is that I didn't take anything to help and managed to piss off some of my bigger family members because they asked how I managed to lose literally 160 pounds without dieting or pills.... I said I ate Chocolate and drank Cherry Pepsi.Quote:
Originally Posted by D0pp139an93r
My guess is it was the energy drinks. I down more Caffeine than most people have in a week. Caffeine DOES help with that. And I do lift weights because of my spine because it's either that or be fat... And I LIKE looking down every day and going "Ah there you are!" ;)
The Ghost Town part is because everyone who's logging in, isn't posting. Same number of people are online.
And no one here has been banned for anything stupid since JP stopped being the admin. (The Founder, who banned a lot of people for very stupid reasons, Doppie probably knows about that).
Yeah. JP's a douche.Quote:
Originally Posted by gore
Brad's cool though. Odd pairing.
The only bans I remember were all well deserved. A large number were my own... I seem to remember being a sexy Mexican and offending some people. The|Specialist got banned each week for being himself... Then of course the AntiPoints wars, etc.
What I really miss are the in depth discussions we used to have, especially catch and chsh.
I know I got along with brad oddly enough.Quote:
Originally Posted by D0pp139an93r
One of the bans I was talking about was when JP banned Chsh. He also banned a good friend of mine I haven't seen on here in some time. He sent me a screen shot of the post that got him banned (He pointed out the AP system was open to abuse WAY back in the day) and then he sent me a screen shot of his AP area where JP negged him like twice on the same post, like in one minute, and then banned him.
Chsh was un-banned by Jupiter. A lot of people were if you were here for those threads. Spec got banned all the time, but I asked why because he didn't do anything half the other people here had done. Hell, rioter didn't get banned when he made his icon a shemale that was nude and animated... Couldn't understand why it was fine for someone to show everyone a bouncing wang + boobs but it wasn't to say "poop" or something.
Lol if you were smart you'd have played the race card when sexymexican got banned. Like "Oh so I'm banned cause I'm brown?" lol. I would have banned you for making 50 threads repeating "I'm a sexy Mexican" too because it was annoying to have to scroll down 50 pages to see post #2 but at least the banned for being brown would have been a knee slapper.
There are ways to have fun without being offensive. For example:
Last year some people were looking at the house next door. Well, one group seemed very interested, and they had 3 kids, very loud ones... I was worried about my sanity so I turned my amps and stuff up all the way, and made my lay list of anal**** and Cannibal Corpse, and let it go. They went in the house, looked around, came out, heard that, and ran for the van and never came back.
They couldn't be offended, you can't understand what they're saying with that many amps going off at once it's too garbled to an already growled song, but it's loud and Soccer Moms hate it.
Quote:
Originally Posted by gore
You slow.
OK, fine, I sent you a message asking why you have a problem with me in private and you blew me off, and I haven't said a word to you since then. I haven't ever done a thing to you, or against you, and I haven't ever said anything to you, so I'm done messing around:
You will either stop your bull and either tell me why you have such an issue with me, or, you can just shut your mouth and not completely disrespect me for no reason, or you're gone. Pick one.
o.OQuote:
Originally Posted by gore
Gore's getting medieval ITT.
Good riddance. :-P
Amen!
"And The Lord said to the good shepherd...............son, this is cattle country"
:lildevil:
It's a shame you can't send high voltage over TCP/IP sometimes. Ah well, FeA.
:zap:
Didn't Abby Hoffman have some trick back in the day (when phone calls were actually switched) to plug in the phone into the 110 and electrocute someone over the phone line?Quote:
Originally Posted by gore
I'm not sure man, I haven't heard that before. Sounds like a job for Superman! Or Google, you know ;)
This thread got a bit side tracked from the first post, right?
twunk_32.exe is from a worm called: W32.Blackmal.C@mm. The worm uses its own SMTP engine to email itself to all the email addresses listed in MSN Messenger, Yahoo Pager, as well as in all the files whose extensions are either .htm or .dbx. (I got this info from Symantec).
wscsvc32.exe is trojan/spyware. Try scanning these with an antivirus and antispyware programs.
If you are going to change the partitions' name from fat32 to ntfs you should use partition magic. It's safer to use and don't have to worry much about losing data. I have used it before and you can install up four operating systems with four different partitions on the same hdd.
Sorry about my earlier post; got side tracked myself. :/
Hope this helps. :D
Ive seen quite abit of twunk_32.exe in the past few days, I did some Googling and came up clean ... http://www.processlibrary.com/directory/files/twunk_32/
Hi Cider,
Please remember that the malware guys aren't that inventive these days.....it's all about money rather than reputation and pride?
They just re-hash and obfuscate existing stuff in many cases.
;)
Yes, I also got those results for twunk_32.exe but I just didn't know which to put up. I thought if I put this one up people would be more cautious with their system files and scan their computers in case of any threats.
Plumb forgot about this thread. I can't even remember what I did with this unit. Oh, yeah, think I backed up the data and formatted in NTFS then reinstalled.
I'm tired of lookin' at viruses. Especially PAV (personal anti-virus) variants. The money's decent though. :)
The chicks still ain't for free... :(
Money for nothin...
Chicks for free...