Nasty Worm going around
Monday, August 11, 2003 by Frogboy | Discussion: WinCustomize News
This hasn't shown up on any news sites yet that I know of but there is a really nasty worm going around the net that uses an exploit in RPC on XP. Make sure you have the latest updates to Windows XP installed or you will get zapped by this at some point.
It will cause a crash in RPC which will force your machine to reboot 60 seconds later (With a count down). It's a PITA to remove too once you get it.
 |
|
Page 1 of 3 | |
|
|---|
Reply #2 Monday, August 11, 2003 6:19 PM
In a nutshell, it (the RPC service,) is one of the critical services of Windows NT. ^.^
Reply #3 Monday, August 11, 2003 6:25 PM
Reply #5 Monday, August 11, 2003 6:37 PM
Reply #6 Monday, August 11, 2003 6:43 PM
Use REGEDIT.EXE and wipe out the value referencing MSBLAST.EXE at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
Reboot. \windows\system32\msblast.exe (location may vary slightly depending on OS) should now no longer be running. Get rid of it.
Use WindowsUpdate to make sure you're patched or grab it by following the links for your OS from here: http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp
Reply #7 Monday, August 11, 2003 6:53 PM
http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en
Thanks so much for telling us about this!
Barb
Reply #8 Monday, August 11, 2003 6:59 PM
O well all better now
Reply #9 Monday, August 11, 2003 7:21 PM
Reply #12 Monday, August 11, 2003 7:40 PM
. ehmm i guess my system is protected. even tho my 135 port is stealth (according to the grc test),i would still like to know how to close it.. 
Reply #13 Monday, August 11, 2003 7:44 PM
Reply #15 Monday, August 11, 2003 7:57 PM
Reply #16 Monday, August 11, 2003 8:16 PM
Edit: got hit cause it's more than port 135 to worry about
http://isc.sans.org/diary.html?date=2003-08-11
Reply #17 Monday, August 11, 2003 8:52 PM
everytime I tried to open my computer a countdown would start ...I went to get that patch from Microsoft and applied it and so far no countdown I hope it stays like Reply #18 Monday, August 11, 2003 8:53 PM
Reply #19 Monday, August 11, 2003 9:16 PM
Like most of the major Anti-Virus companies, Trend Micro offers a free on-line scan. House Call is available from http://housecall.trendmicro.com/
Manual removal instructions are available from http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A
I hope that this helps.
Reply #20 Monday, August 11, 2003 9:17 PM
start > run > shutdown -a
done...
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 1 of 3 | |
|
|---|
Reply #1 Monday, August 11, 2003 6:02 PM