New Worm

[personman]

Originally posted by Vash02
Just found out my uncle got it. Problem is he cant stay connected to the internet long enough to download the patch. Hopefully somehow he can get it fixed.

Tell him to try getright.. if he can keep reconnecting it will work. You can pause and resume downloads with the greatest of ease. He probally would want to try the Setup Loader to download getright itself, which is located at:

http://www.getright.com/setuploader.html

[Vash02]

So does that link that miscue posted fix the problems or does that only protect you from it? I dont think my uncle has any virus protection software so im not sure what to tell him to use to fix it.

[Jet-Xino]

If he can get on long enough, here is a link to the removel, after he gets it removed he can apply the patch.

http://www.aeroinc.net/launchpage.cfm?destination=http%3A//securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

[SpongeBobSquarePants]

I dont have XP is there a fix for it or am I not in danger?

[Jet-Xino]

If you don't have XP I wouldn't worry about it 99% of the people who have had problems have XP. You might want to look around if you 2000 but even then I wouldn't worry about it. If you have 98 or lower dont even worry about it. Keep your anti virus updated and you should be fine.

[Jimmi9999]

i knew there was a reason why i didn't update to windows xp.

[RamboPreacher]

The patch prevents it - it does not fix it. The RPC vulnerability affects WinNT and above OS's, not just XP. (ther eis evidence that it may affect other "leser" OS's too, but since Win95, for example isn't suported by MS anymore, they aren't checking it at all, nor remediating any patches anymore)

There are so many variants in teh wild right now of the worm/virus that there is no way to know if you are "clenaed if you get infected. most of them leave a back door and or time-bomb (many to go off this friday). the worst thing you can do is get patched after you have been infected becaus you may think you are safe, when you are not.

The only safe solution if you have been infected is to repartition, reformat and reinstall (reimage) the system. fortunately, the is no evidence (so far) that points to any data files being infected and so you should be able to back up your data and restore it to your newly reimaged system.

Microsoft is even ramping up its windowsupdate.microsoft.com web sites in anticipation of at least one of the timebombs that will go off this friday.

I also found out that there are many network devices that uses integrated WinNT or Win2K (and WinXP) such as some shared printers, SAN/NAS devices and other "smart" network devices. Thee are also potentially vulnerable and should be remediated ASAP.

As a network engineer, and a personal computer user, My advice is to back up your date, ALWAYS use and have updated anti-virus signatures, and stay current on security patches. For home users - windowsupdate.microsoft.com is there for a reason! Corporate users - you may need to consult your administrators/support personnel for instructions on how to get/keep updated. (There are many AV solutions, consult the manufactures instructions on how to stay current - and remember: "If you can afford a computer, you can afford to have an AV solution that is up to date AND you can afford to have a backup solution!"

[Jon/xpm]

Man that thing is a pain*!
i had to scan da computer,,, then fix all the files...
it was on like 1000 exe files
and got the patch....
it's gone now!

[Jon/xpm]

ttoad4000t-wuz up bro
where is my money!
(lafff)
i think this is wat was causing me to lag...
i was jumping from a steady 25ping to 1000!
(searched around and saw some one say the worm
could do it,, not totally 100% sure thou)

[Barsoom]

ok EVERYBODY LISTEN...if you CAN NOT download the patch or DO NOT have enough time to then here are directions on how to MANUALLY remove this worm from your computer you must do this exactly as stated (THIS IS ONLY FOR WINDOWS XP)


New virus spreading over internet. Its called msblast.exe and it attacks the RPC service causing system reboots.

Clean up and prevent reinfection by the following. (I think! This worked for me anyways)

1. Disconnect from internet.

2. CTRL-ALT-DEL to task manager, find msblast.exe process and kill it.

3. Run Regedit.exe. Navigate to HKLM/Software/Microsoft/Windows/Current Version/Run.

4. Delete the key Windows Updates : "msblast.exe"

5. erase c:\windows\system32\msblast.exe

6. erase contents of c:\windows\prefetch

7. REBOOT. IMPORTANT - ensure no network connection on reboot by not dialing up/remove modem etc.

8. Right click my computer/select properties. Goto Automatic updates. Disable it.

9. Goto control panel/Network connections (only on XP) right click your dialup/Broadband connection.

10. Select properties/advance. Enable XP firewall.

11. REBOOT. IMPORTANT


Good luck.

[RamboPreacher]

be forwared that though this seems to aleviate a symptom, there is possibly still malicious code lurking that has yet to be detected. that is the nature of this kind of infection, and as I said earlier - the only way to know for sure that you are clean is repartition, reformat and reinstall (reimage).

[RamboPreacher]

hope everyone is ready for today.

[Barsoom]

why whats today?

[e mag]

Originally posted by Barsoom
why whats today?

all the infected computers are supposed to ddos the windows update servers.

[MantisMag]

actually i'm pretty sure that's tomorrow the 16th...