MSBlast and probable solutions

[notAFanB]

I sure you guys here have already heard that the latest windows exploit is running rampant.

http://news.bbc.co.uk/1/hi/technology/3143625.stm

can anyone suggest a way to clean an already infected system?

or are we F.U.B.A.R.E.D?

thanks

 

[Paul]

Five of my friends yesterday were coming to me with a problem that their computer would give them a message and than shut down. I just KNEW this was something new, and sure enough there was news of a new worm based on that windows exploit.

ANYWAY, this is how you stop the shut down.

1. Run services.msc

2. Scroll down the list until you see Remote Procedure Call

3. Right click on it and select properties.

4. Click on the Recovery tab.

5. Change all 3 boxes from "Restart Computer" to take no action.

This will prevent your computer from restarting.

What you need to do next is apply the patch from microsoft, and than finally delete the virus from your computer.

Search your entire computer for Msblast and than delete the files, there is also a registry key to delete.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run


Find yourself to there in the registry, you will find a "windows auto update" and in the same row a "msblast.exe", select it and delete the value.



[/i]

 

[epicstruggle]

@paul: thanks for the great info.

later,

 

[notAFanB]

thank you Paul it's appreciate *Grovel..*

 

[Paul]

I had my friend try all types of shit and this finally worked.

My firewall(Hardware NAT) has been taking so many hits to port 135 it's not even funny, web browsing seems a little sluggish, comcast a major ISP was having trouble. All this because of this damn worm.

I feel bad for the computer illiterate that get this problem and won't know what to do..

 

[maskrider]

I had my friend try all types of shit and this finally worked.

My firewall(Hardware NAT) has been taking so many hits to port 135 it's not even funny, web browsing seems a little sluggish, comcast a major ISP was having trouble. All this because of this damn worm.

I feel bad for the computer illiterate that get this problem and won't know what to do..

Yes, I feel bad for them, my friend is also having similar problem. There should be a lot of traffic generated by the worm. Many people have to constantly reboot their PCs whenever they connect to the Internet.

My friend said whenever he plug the cable to the PC, it will start to count down and reboot, very annoying to the casual PC users.

Thank you very much for the info, Paul.

 

[DeathKnight]

The whole fix is here:

http://homepage.ntlworld.com/michaelgadge/shutdownproblem.htm

To cancel the shutdown goto run -> cmd -> type "shutdown -a" without the quotes. You can also delete the msblast.exe since it's part of the virus.

 

[micron]

All three systems in my house were hit by the worm. I actually reformatted my laptop before I discovered that all my pc's had the bug.
Today I went to the Inquirer and they had a blurp on it with great directions on the steps you must take to rid yourself of it. Microsoft has issued a patch, and you must install it or the worm keeps coming back within minutes.http://microsoft.com/downloads/deta...6C-C5B6-44AC-9532-3DE40F69C074&displaylang=en
This is the first time I have ever been a victim of a virus or worm, and found it very frustrating. It will take me a while to get my laptop operating again the way that I liked it...... Bummer.

 

[Tokelil]

Symantec also has a program that will fix it for you:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

 

[Joe DeFuria]

I had my friend try all types of shit and this finally worked.

My firewall(Hardware NAT) has been taking so many hits to port 135 it's not even funny...

Here's a snapshot of my current firewall log:

Firewall log:
Tue Aug 12 15:03:18 2003 1 Blocked by DoS protection 10.105.192.1 
Tue Aug 12 15:03:20 2003 1 Blocked by DoS protection 10.105.192.1 
Tue Aug 12 15:03:22 2003 1 Blocked by DoS protection 10.105.192.1 
Tue Aug 12 15:03:28 2003 1 Blocked by DoS protection 10.105.192.1 
Tue Aug 12 15:03:41 2003 1 Blocked by DoS protection 10.105.192.1 
....

Geezus...every few seconds or so....

 

[micron]

Symantec also has a program that will fix it for you:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

That download will remove msblast.exe from your system, but it will come back within minutes unless you get the MS patch I linked above.

 

[micron]

Joe, thanks for showing us your firewall log. This is one hell of a worm....

 

[zidane1strife]

yup, infected some of my systems, and even those at my local university

 

[notAFanB]

yup my friends offices got hit yesterday took down an entire dept worth of terminals......

 

[picosec]

Doesn't anybody ever install security patches?

 

[K.I.L.E.R]

YES! I immediately install them frequently. Always have. No wander so many of my friends got the worm but I didn't.

I told them it was a Windows vulnerability ( like every virus takes advantage of ) and that M$ frequently update their OS through patches.

Look who's laughing now.

 

[notAFanB]

Doesn't anybody ever install security patches?

some System Admins make it a policy not to install patches until they are sure that current setups are not affect to a large degree (admittedly this is more applicable for full on service packs).

so no apparently... :?