Nasty Worm going around
Monday, August 11, 2003 by Frogboy | Discussion: WinCustomize News
This hasn't shown up on any news sites yet that I know of but there is a really nasty worm going around the net that uses an exploit in RPC on XP. Make sure you have the latest updates to Windows XP installed or you will get zapped by this at some point.
It will cause a crash in RPC which will force your machine to reboot 60 seconds later (With a count down). It's a PITA to remove too once you get it.
 |
|
Page 2 of 3 | |
|
|---|
J0ely
Reply #22 Monday, August 11, 2003 9:42 PM
Reply #22 Monday, August 11, 2003 9:42 PM
thanks for the heads up, this thing was doing its dirty work every time i started msn messenger. now i can stop ripping my hair out
vulcan
Reply #23 Monday, August 11, 2003 9:50 PM
Reply #23 Monday, August 11, 2003 9:50 PM
OK...I admit I got it too.. 
...
but with your info...everything is A-OK again!!!
Thank you very much for this one!!!!
Live long, and prosper...!!!
...but with your info...everything is A-OK again!!!
Thank you very much for this one!!!!
Live long, and prosper...!!!
Netorius1
Reply #24 Monday, August 11, 2003 9:50 PM
Reply #24 Monday, August 11, 2003 9:50 PM
Ditto., I got it and have no idea how,,, i've been virus free for years..
disabled all startup proggies and no reboot since,, now i know what to look for and kill the Mo Fo.
Thanks folks
disabled all startup proggies and no reboot since,, now i know what to look for and kill the Mo Fo.
Thanks folks
WOM
Reply #25 Monday, August 11, 2003 10:21 PM
Reply #25 Monday, August 11, 2003 10:21 PM
Hate to say this but Starone and I got that Worm. I don't cruise the net and rarely go to another site but to buy or pay bills other than camp out here. Starone goes everywhere. It came thru a firewall. Downloaded the patch on her DSL as my 56k couldn't stay connected long enough. All fixed now but was pissed for a while. 
That isn't an accusation against this site.So I hope no one thinks that. SkinStudio says that all you had to be is connected to the internet to get it.
That isn't an accusation against this site.So I hope no one thinks that. SkinStudio says that all you had to be is connected to the internet to get it.
Anthony R
Reply #26 Monday, August 11, 2003 10:55 PM
Reply #26 Monday, August 11, 2003 10:55 PM
I couldn’t stay connected long enough to get the patch either, the second the card was connected the countdown began I had to download the patch with another machine. The patch stopped the countdown but all the msblast stuff was still running and all still in the registry…I am angered that a puny insignificant subject would perpetrate such an unholy transgression upon my beloved computer. >
I am glad it is fixed now
I am glad it is fixed now
Koasati
Reply #27 Monday, August 11, 2003 11:48 PM
Reply #27 Monday, August 11, 2003 11:48 PM
I use Trend Micro too, Larry............. no problem here.
Dacemtl
Reply #28 Tuesday, August 12, 2003 1:10 AM
Reply #28 Tuesday, August 12, 2003 1:10 AM
My computer all of a sudden just shut off. When I turned it on, it would restart over and over again. I used XPs "load last good configuration" thing, the problem seemed to have been resolved...but when I reboot,same thing; it will restart over and over again. I can't find any MSBlast though, Norton anti-virus can't find it either.
yrag2
Reply #29 Tuesday, August 12, 2003 1:35 AM
Reply #29 Tuesday, August 12, 2003 1:35 AM
Removing autostart entries from the registry prevents the malware from executing during startup.
Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
”windows auto update" = MSBLAST.EXE
Close Registry Editor.
restart your system.
Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
”windows auto update" = MSBLAST.EXE
Close Registry Editor.
restart your system.
Jafo
Reply #30 Tuesday, August 12, 2003 2:06 AM
Reply #30 Tuesday, August 12, 2003 2:06 AM
Dacemtl....you'll need the latest Definitions to find it...dated 'today'...11 August 2003...
sig101
Reply #31 Tuesday, August 12, 2003 2:13 AM
Reply #31 Tuesday, August 12, 2003 2:13 AM
In addition to that, if you or anyone else is still having a problem with it, Symantec has a removal tool and instructions here: http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
Bliss980 old
Reply #32 Tuesday, August 12, 2003 2:19 AM
Reply #32 Tuesday, August 12, 2003 2:19 AM
hmmmmm. In Australia it is even on the radio! 
DavidK
Reply #33 Tuesday, August 12, 2003 3:16 AM
Reply #33 Tuesday, August 12, 2003 3:16 AM
I didn't get it but my cable provider did. I've had no internet service for the whole day. It went down around 1:00 pm and just came back a few minutes ago - 12:10 am. Comcast told me they were 'helping' microsoft because there were tens of thousands of customers having this problem. The key to getting the patch is to (within the sixty seconds) go to your internet connection config and activate the ms firewall (advanced tab). That will prevent the shutdown so you can get to the website and download the patch.
I recently rebuilt my system so I believe I had the patch already installed. My problem was the server for the Comcast node got the bug.
I recently rebuilt my system so I believe I had the patch already installed. My problem was the server for the Comcast node got the bug.
craeonics
Reply #34 Tuesday, August 12, 2003 3:26 AM
Reply #34 Tuesday, August 12, 2003 3:26 AM
A friend of mine just complained to me about RPC acting funny. Now I know why.
Anyhow, I've disabled it by default, so I can't be hit.
Anyhow, I've disabled it by default, so I can't be hit.
Pooya1770
Reply #35 Tuesday, August 12, 2003 3:54 AM
Reply #35 Tuesday, August 12, 2003 3:54 AM
ok i removed it from my start in regidit .. but somehow it comes back in .. damn that bug .... who started it by the way .. ill sue him 
Racer_CustomZ
Reply #36 Tuesday, August 12, 2003 3:55 AM
Reply #36 Tuesday, August 12, 2003 3:55 AM
The Windows update merely disables the virus.. and patches the hole in XP causing it, however it does NOT delete it. (no harm done with it there.. but deleting it is much safer than letting it hang around)
to DELETE the virus .exe file, download this program:
http://download.nai.com/products/mcafee-avert/stinger.exe
or, if you are paranoid (lol.. alot of forums im trying to give this to arent clicking the link)click the below link for more information about the Stinger virus removal tool (only kills this virus, and a few others...)
http://vil.nai.com/vil/stinger/
i had this virus also, but stupid me.. instead of waiting to hear news about it (which is near impossible.. its such a pain to be rebooted within 60 seconds of startup) i brought it to Bestbuy.. and paid 30 dollars for nothing, which ill be getting back tomorrow afternoon.. they charged me for a 'System Tune-Up' which was 30 dollars.. but for that much money i could buy something more useful, like the full windowblinds set for a little more.. but anyway, after i got it home, i tried it again, and it was still rebooting me.. then i discovered msblast.exe in my win32 folder, deleted it, deleted it from my bin, and viola..
if you dont have this virus, you WILL get it, nearly guarenteed.. so patch up, and save yourself the hassel of money-hungy tech support employees. >
im not sure if theres an image code on this site, but in case your unsure if this is your case, look at this screen shot:
http://www.mtmc4fun.com/temp/Image1.jpg
again.. download the patch, fix the restarting problem, then download the program to delete the virus completely, you shouldnt trust the shredding files from the recycling bin feature.
edit: sorry if there was already removal tool links in this topic, im just making sure.. all in one bundle, lol
to DELETE the virus .exe file, download this program:
http://download.nai.com/products/mcafee-avert/stinger.exe
or, if you are paranoid (lol.. alot of forums im trying to give this to arent clicking the link)click the below link for more information about the Stinger virus removal tool (only kills this virus, and a few others...)
http://vil.nai.com/vil/stinger/
i had this virus also, but stupid me.. instead of waiting to hear news about it (which is near impossible.. its such a pain to be rebooted within 60 seconds of startup) i brought it to Bestbuy.. and paid 30 dollars for nothing, which ill be getting back tomorrow afternoon.. they charged me for a 'System Tune-Up' which was 30 dollars.. but for that much money i could buy something more useful, like the full windowblinds set for a little more.. but anyway, after i got it home, i tried it again, and it was still rebooting me.. then i discovered msblast.exe in my win32 folder, deleted it, deleted it from my bin, and viola..
if you dont have this virus, you WILL get it, nearly guarenteed.. so patch up, and save yourself the hassel of money-hungy tech support employees. >
im not sure if theres an image code on this site, but in case your unsure if this is your case, look at this screen shot:
http://www.mtmc4fun.com/temp/Image1.jpg
again.. download the patch, fix the restarting problem, then download the program to delete the virus completely, you shouldnt trust the shredding files from the recycling bin feature.
edit: sorry if there was already removal tool links in this topic, im just making sure.. all in one bundle, lol
Pooya1770
Reply #37 Tuesday, August 12, 2003 4:01 AM
Reply #37 Tuesday, August 12, 2003 4:01 AM
Thankyou to who ever gave the link for the patch .. i downloaded it now .. and lets hope it gets rid of that annoying bug .. and ya iam just doin an online scan .. i think norton now really is sucky ...
Racer_CustomZ
Reply #38 Tuesday, August 12, 2003 4:03 AM
Reply #38 Tuesday, August 12, 2003 4:03 AM
Dont forget to delete the exe, either manually (use Start>search..mblast.exe) or using the program from the provided link in the post above yours
_02
Reply #39 Tuesday, August 12, 2003 5:12 AM
Reply #39 Tuesday, August 12, 2003 5:12 AM
If you are already infected, here is a step by step fix.
W32.Blaster.Worm fix
1.) Disconnect your Cable/DSL/Dial Up modem from your tower
2.) Press CTRL + ALT + DELETE and then click on the processes tab.
3.) Locate the MSBLAST.exe process
4.) Click Start | click Run | type in msconfig
5.) Click Services
6.) Locate the entry for msblast.exe
7.) Uncheck the box to the left of it
8.) Locate the entry for Messenger
9.) Click Apply | Close | Exit with out restarting Windows
10.) Click Start | Run
11.) Type in regedit and click Okay
12.) Hit the F3 key
13.) Type in mablast.exe and hit Enter
14.) When the registry editor finds an instance, it will show up in the right hand pane. Delete it
15.) Hit F3 again and delete the entries. Continue until the registry editor has finished searching the entire registry
16.) Click Start | Search | All Files and Folders
17.) Type in msblast.exe. you should find two instances of this file. Delete them both and empty the recycle bin
18.) Go into the control panel and open your Network Connections.
19.) Right click on the Local Area Connection and left click on Properties
20.) Click on the Advanced tab
21.) Check the box to enable the Internet Connection Firewall
22.) Click Okay, close all your windows and restart your system
23.) Reconnect your Internet connection
24.) Go to Microsoft Security Bulletin MS03-026 http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp and download the patch. Don’t forget to save it to removable media
25.) Get yourself up to date with the necessary Windows updates
26.) Get a decent firewall and anti virus program
W32.Blaster.Worm fix
1.) Disconnect your Cable/DSL/Dial Up modem from your tower
2.) Press CTRL + ALT + DELETE and then click on the processes tab.
3.) Locate the MSBLAST.exe process
4.) Click Start | click Run | type in msconfig
5.) Click Services
6.) Locate the entry for msblast.exe
7.) Uncheck the box to the left of it
8.) Locate the entry for Messenger
9.) Click Apply | Close | Exit with out restarting Windows
10.) Click Start | Run
11.) Type in regedit and click Okay
12.) Hit the F3 key
13.) Type in mablast.exe and hit Enter
14.) When the registry editor finds an instance, it will show up in the right hand pane. Delete it
15.) Hit F3 again and delete the entries. Continue until the registry editor has finished searching the entire registry
16.) Click Start | Search | All Files and Folders
17.) Type in msblast.exe. you should find two instances of this file. Delete them both and empty the recycle bin
18.) Go into the control panel and open your Network Connections.
19.) Right click on the Local Area Connection and left click on Properties
20.) Click on the Advanced tab
21.) Check the box to enable the Internet Connection Firewall
22.) Click Okay, close all your windows and restart your system
23.) Reconnect your Internet connection
24.) Go to Microsoft Security Bulletin MS03-026 http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp and download the patch. Don’t forget to save it to removable media
25.) Get yourself up to date with the necessary Windows updates
26.) Get a decent firewall and anti virus program
_02
Reply #40 Tuesday, August 12, 2003 5:55 AM
Reply #40 Tuesday, August 12, 2003 5:55 AM
sorry typo. all that read mablast should read msblast
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 2 of 3 | |
|
|---|
Reply #21 Monday, August 11, 2003 9:29 PM