unforum

Guest · Guest

MetaCortex screensaver

**Posted:** Sun Oct 05, 2003 11:03 am

BrianEnigma

Re: MetaCortex screensaver

**Posted:** Sun Oct 05, 2003 4:02 pm

Marl64

Don't know if anyone's got this already, but I've not seen it mentioned.

The Version page for MsMpegDll.dll (among the screensaver files) has;

File Version: 1.0.0.0
Description: Audio MPEG player DLL
Copyright: Copyright Bugsy Wabbit 1998

and under Company Information "Wabbits"

More Rabbits - Coincidence?

Probably, it is known (if a little old) software for playing MPeg files.

** EDIT **

Additional Note: If you Dl the release for this player, at the bottom of the readme it says;

Beware of ghosts! Bugsy Wabbit.
2:463/209.0@fidonet.org

**Posted:** Sun Oct 05, 2003 10:37 pm

joebrent

**Posted:** Mon Oct 06, 2003 2:18 am

_________________
http://www.josephbrent.com

Guest · Guest

the screensaver install file (which is a winRAR SFX installer, you can open it in winrar) lists MsMpegDll.dll as last modified in 1998, so unless they were planning this thing since then i dont know if it means anything or is just coincidence.

**Posted:** Mon Oct 06, 2003 6:31 am

Proteus · Guest

maybe the hole scam was originally planned to be realesed with M1 but the cancelled it until now

**Posted:** Mon Oct 06, 2003 7:38 am

Mod · Boot Joined: 05 Oct 2003 Posts: 63 Location: Brasil

I found this in the flash of the screen server (download swf Decompiler Demo, it is 1.5 archive):

In the text directory, screensaver.swf :

text8: [

text9: ]

from text11-text15, it is written: indentity

from text16-text23, it is written: connection estabilished

This is the only things unusual. The other texts are those repetitive: wired reality, serving you into the 21st century, etc...

**Posted:** Mon Oct 06, 2003 9:53 am

Guest · Guest

The file included in the screensaver named metacortex.scr is actually an .exe file, packed with aspack 2.11c...it can be unpacked using aspackdie (http://www.exetools.com/unpackers.htm...nothing interesting in there so far, except maybe the last string in the file, it says "123ZBSOFT321"

**Posted:** Mon Oct 06, 2003 12:04 pm

BoyC · Boot Joined: 05 Oct 2003 Posts: 36

That's definitely the id of the tool with which the screensaver was created.
Google comes up with http://www.zbsoft.net/

That's a dead end

**Posted:** Mon Oct 06, 2003 12:08 pm

Steele · Guest

I found this in the FlashSaver.dat file inside the mc_setup.exe

C:\Documents and Settings\Owner\Desktop\Project MU\MetaCortechs\dev\screensaver.swf=

Project MU sounds interesting!

**Posted:** Mon Oct 06, 2003 1:06 pm

AnthraX101 · Entrenched Joined: 18 Mar 2003 Posts: 797

Heh, no peeking behind the curtain now! Smile

AnthraX101

**Posted:** Mon Oct 06, 2003 1:35 pm

winjer509 · Boot Joined: 06 Oct 2003 Posts: 23

Oddly enough, this screensaver accesses the internet. It popped up my firewall asking for access... meaning that the text and messages could potentially change in the future.

Something to keep an eye on either way.

**Posted:** Tue Oct 07, 2003 1:39 am

Ehsan · Entrenched Joined: 09 May 2003 Posts: 992

Project MU sounds really interesting! I don't mind peaking behind the curtain to find out what it means.. I'm not very fond of calling it the Metacortechs, or Matrix ARG.. just doesn't seem right..

Matrix Unleashed? Matrix Unlimited? Meta Universe? hmm..

**Posted:** Tue Oct 07, 2003 2:16 am

Demonico · Boot Joined: 05 Oct 2003 Posts: 24

**Posted:** Tue Oct 07, 2003 5:02 am

CultureJammer · Boot Joined: 07 Oct 2003 Posts: 24

Uhhh, whats the deal with this?

http://mitglied.lycos.de/Gumpraider...ortex/index.htm

WARNING: - the Windows Screensaver on the Metacortex site
contains a real virus in the uninstall.exe file called W32/CTX. My
antivirus software caught it on installation of the screensaver. The
screensaver itself is not infected.

From Symantec

http://www.symantec.com/avcenter/ve...32.cholera.html

Last edited by CultureJammer on 10-07-2003 at 09:47 PM

**Posted:** Tue Oct 07, 2003 4:52 pm