msblast.exe ---> worm/virus?
Tuesday, August 12, 2003 by Cross1492 | Discussion: WinCustomize Talk
I have noticed that the application, msblast.exe has been clogging my internet connection and causing a fatal exception/reboot of my system.
According to my ISP the problem is a vulnerability in Windows OS/possible worm. Microsoft is supposed to be working on a fix.
So BEWARE! The Trivial Transfer Protocol is being used to send this file/worm. To check if this file is on your system restart in safe mode, delete the file msblast.exe (Windows/system32), and open msconfig to uncheck the startup of this file. Block Trivial Transfer (tftp.exe) in your firewall as well.
I hope this helps anyone who is having this problem. If anyone else has a better fix please post it here!
According to my ISP the problem is a vulnerability in Windows OS/possible worm. Microsoft is supposed to be working on a fix.
So BEWARE! The Trivial Transfer Protocol is being used to send this file/worm. To check if this file is on your system restart in safe mode, delete the file msblast.exe (Windows/system32), and open msconfig to uncheck the startup of this file. Block Trivial Transfer (tftp.exe) in your firewall as well.
I hope this helps anyone who is having this problem. If anyone else has a better fix please post it here!
 |
|
Page 1 of 2 | |
|
|---|
RotAtoR
Reply #2 Tuesday, August 12, 2003 9:54 AM
Reply #2 Tuesday, August 12, 2003 9:54 AM
Also, this utility can scan and remove most recent big viruses including this one:
http://vil.nai.com/vil/stinger/
http://vil.nai.com/vil/stinger/
Cross1492
Reply #3 Tuesday, August 12, 2003 10:17 AM
Reply #3 Tuesday, August 12, 2003 10:17 AM
Thanks a lot, RotAtor! I didn't realize there was a post for this already. Thanks again!
RotAtoR
Reply #4 Tuesday, August 12, 2003 11:05 AM
Reply #4 Tuesday, August 12, 2003 11:05 AM
No problem, been having fun here this morning with this one trying to keep it off our systems and make sure they're all patched. 
macrobaye
Reply #5 Tuesday, August 12, 2003 11:33 AM
Reply #5 Tuesday, August 12, 2003 11:33 AM
I wish everyone here would stop complaining about viruses. By now, after having windows for such a long time, all you Windows users should have learned to cope with the extreme amount of flaws and security "imperfections". Windows motto should be "Learn to deal". What you get is what you pay for. You want a $500 PC with a craptastic OS? Go ahead and take it, but quit complaining.
If you're sick of windows, get a mac, or at least get linux. ANYTHING is better than an OS ripped from an OS which was ripped from Xerox, of all people.
If you're sick of windows, get a mac, or at least get linux. ANYTHING is better than an OS ripped from an OS which was ripped from Xerox, of all people.
KarmaGirl
Reply #6 Tuesday, August 12, 2003 11:49 AM
Reply #6 Tuesday, August 12, 2003 11:49 AM
macrobaye, please keep your comments constructive and on topic. Please also remember that this site is populated by Windows users who are discussing windows issues and are trying to help each other.
There is also another reason why you don't see viruses for other OSs: the people who program viruses/worms/etc. like to hit a large market. The 5% market share that Mac has and the 1% that Linux has just isn't worth the effort 
This worm is a real pain. Not hard to get rid of, so I hope everyone is zapping it!
White_Moth
Reply #7 Tuesday, August 12, 2003 12:11 PM
Reply #7 Tuesday, August 12, 2003 12:11 PM
For the past few days, I suddenly began receiving a large number of port scan hits, so today I checked some out and discovered this:
ZoneAlarm blocked traffic to port 135 on your machine from port 3441 on a remote computer. This communication attempt may have been a port scan, or simply one of the millions of unsolicited commercial or network control messages that are routinely sent out over the Internet. Such unsolicited messages are often called Internet background noise.
The above is only one of many targeting port 135, I had 138 yesterday and today in a 2 hour period 76 hits.
>
ZoneAlarm blocked traffic to port 135 on your machine from port 3441 on a remote computer. This communication attempt may have been a port scan, or simply one of the millions of unsolicited commercial or network control messages that are routinely sent out over the Internet. Such unsolicited messages are often called Internet background noise.
The above is only one of many targeting port 135, I had 138 yesterday and today in a 2 hour period 76 hits.
>
macrobaye
Reply #8 Tuesday, August 12, 2003 12:12 PM
Reply #8 Tuesday, August 12, 2003 12:12 PM
KarmaGirl, I was not trying to start an arguement. I was simply stating that I'm sick of all the complaining, but what I really sick of is Microsoft's constant OS problems. This isn't some small hole that some hacker found on a chance in hell. It's a HUGE hole that should have been fixed back when XP was being stol..err uhh, I mean "developed".
Apple and Linux have never had problems, because those OS's don't have the bugs that Windows does. Microsoft only released XP when they did because they were threatened by Mac OSX and it's obvious advantages of 2000 (and now still over XP). Microsoft needs to stop releasing BETA software and calling it a fully developed version.
GOD! I hope they don't mess up with Longhorn. But knowing Microsoft's history of moronic security holes and bugs, they will.
Anyone remember the Passport bug? Oh yeah, that one. The one where a hacker could steal a Windows (AND mac, linux) user's personal and sensitive information, effectively stealing their identity? Bill Gates needs to wake up from his dream.
As MSBLASTER.exe says: Billy Gates, why do you make this possible? Stop making money and fix your software!!!
It is now believed (and factually backed up) that a Mac user created the bug!
Apple and Linux have never had problems, because those OS's don't have the bugs that Windows does. Microsoft only released XP when they did because they were threatened by Mac OSX and it's obvious advantages of 2000 (and now still over XP). Microsoft needs to stop releasing BETA software and calling it a fully developed version.
GOD! I hope they don't mess up with Longhorn. But knowing Microsoft's history of moronic security holes and bugs, they will.
Anyone remember the Passport bug? Oh yeah, that one. The one where a hacker could steal a Windows (AND mac, linux) user's personal and sensitive information, effectively stealing their identity? Bill Gates needs to wake up from his dream.
As MSBLASTER.exe says: Billy Gates, why do you make this possible? Stop making money and fix your software!!!
It is now believed (and factually backed up) that a Mac user created the bug!
wombat_1
Reply #9 Tuesday, August 12, 2003 1:20 PM
Reply #9 Tuesday, August 12, 2003 1:20 PM
This particular little nasty has already been dealt with by Nortons update, 12.08.2003. 
sig101
Reply #10 Tuesday, August 12, 2003 1:28 PM
Reply #10 Tuesday, August 12, 2003 1:28 PM
macro: This thread doesn't appear to have been started to complain or generate complaints about viruses or any OS. It appears the intent was to profide info to people.
White Moth: yes, there had been an increase in Port 135 scans for weeks and speculation was that some of the stuff that was seen may have been reconnoitering or a testing phase for a release of an exploit. Reportedly there was an IRC bot release at least similar to (if not the same as) msblaster before msblaster started propagating through the net via ports. At least 3 variants of msblaster were identified yesterday by people running honeypots.
Symantec has a free removal tool here and there are also inro for those who may wish to see what the worm does and instructionf for those who may wish to remove it manually: http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
White Moth: yes, there had been an increase in Port 135 scans for weeks and speculation was that some of the stuff that was seen may have been reconnoitering or a testing phase for a release of an exploit. Reportedly there was an IRC bot release at least similar to (if not the same as) msblaster before msblaster started propagating through the net via ports. At least 3 variants of msblaster were identified yesterday by people running honeypots.
Symantec has a free removal tool here and there are also inro for those who may wish to see what the worm does and instructionf for those who may wish to remove it manually: http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
Anthony R
Reply #11 Tuesday, August 12, 2003 2:34 PM
They were late with this one because I run Norton, it failed to stop the worm ... the update was late and I had to get rid of it manually.
Norton allowed my port to be probed.
Reply #11 Tuesday, August 12, 2003 2:34 PM
| #9 by Developer wombat_1 - 8/12/2003 1:20:31 PM This particular little nasty has already been dealt with by Nortons update, 12.08.2003. |
They were late with this one because I run Norton, it failed to stop the worm ... the update was late and I had to get rid of it manually.
Norton allowed my port to be probed.
sig101
Reply #12 Tuesday, August 12, 2003 3:13 PM
Reply #12 Tuesday, August 12, 2003 3:13 PM
Norton AV wouldn't block your ports; Norton's firewall should (if properly configured). Were you running a firewall or NIS?
Chef Garry
Reply #13 Tuesday, August 12, 2003 3:31 PM
Reply #13 Tuesday, August 12, 2003 3:31 PM
I think there's probably a lot of people (me for one) who are really glad this information is posted.
kona0197
Reply #14 Tuesday, August 12, 2003 3:39 PM
Reply #14 Tuesday, August 12, 2003 3:39 PM
I am glad it was posted. To all those who keep bashing microsoft: get real, grow up, get a life!
Apocalypse_67
Reply #15 Tuesday, August 12, 2003 3:51 PM
Reply #15 Tuesday, August 12, 2003 3:51 PM
Im with you Garry. The worm didnt get to my main PC but it got to my other desktop. The info here and other sites helped a lot.
The Security Update (823980) solved the problem.
macro, instead of 'complaining' about what you hate about MS OS in this site, shouldnt you be writing to Bill Gates about this issues?
And always remember, no matter how hack-proff they make a system, there is always someone out there that eventually is gonna find a way to hack it.
The Security Update (823980) solved the problem.
macro, instead of 'complaining' about what you hate about MS OS in this site, shouldnt you be writing to Bill Gates about this issues?
And always remember, no matter how hack-proff they make a system, there is always someone out there that eventually is gonna find a way to hack it.
macrobaye
Reply #16 Tuesday, August 12, 2003 4:20 PM
Reply #16 Tuesday, August 12, 2003 4:20 PM
A_67, believe me I have written to MS and Bill Gates about this, but I'm sure my emails are among countless others from people who are just as annoyed with MS as I am. And also, this isn't a tiny hole that someone had to look for with a fine tooth comb. All of the security bugs/holes in Windows are tremendous. The problem isn't the hackers. It's the software makers.
Kona: Please no personal attacks. If you can sit there and say that you're not annoyed by all the BS you've had to put up with as a Windows user, you will now become the most tolerant person I know. So please, I wasn't attacking any of you, nor did I make any distasteful or improper comments. So please mind your manners. There's no reason to get mad at me over a few comments made on a public message boad.
Kona: Please no personal attacks. If you can sit there and say that you're not annoyed by all the BS you've had to put up with as a Windows user, you will now become the most tolerant person I know. So please, I wasn't attacking any of you, nor did I make any distasteful or improper comments. So please mind your manners. There's no reason to get mad at me over a few comments made on a public message boad.
macrobaye
Reply #17 Tuesday, August 12, 2003 4:21 PM
Reply #17 Tuesday, August 12, 2003 4:21 PM
And as a Windows (and mac) user myself, I am allowed to bash Microsoft as much as I want.
Chef Garry
Reply #18 Tuesday, August 12, 2003 4:23 PM
Reply #18 Tuesday, August 12, 2003 4:23 PM
but macrobaye, that isn't particularly productive is it? Sharing information about problems is. At least in my opinion.
Fuzzy Logic
Reply #19 Tuesday, August 12, 2003 4:33 PM
Reply #19 Tuesday, August 12, 2003 4:33 PM
Sigh, why do we have to put up with these trolls...
Jafo
Reply #20 Tuesday, August 12, 2003 4:35 PM
Reply #20 Tuesday, August 12, 2003 4:35 PM
macrobaye...this is not a 'bash Microsoft' thread....it is a virus notification thread.
If you wish to bash anything, start a thread as its topic and allow this one to serve its purpose.
Thankyou.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 1 of 2 | |
|
|---|
Reply #1 Tuesday, August 12, 2003 9:52 AM
https://www.wincustomize.com/msgboard.asp?BID=WC&id=176083
It started really spreading around this morning/last night.
You can protect yourself against it by getting the windows update critical update Q331953 or by blocking port 135 on your computer.