Patch your system NOW - Windows exploit running RAMPANT!

Reply Subscribe

Thread Tools

Search this Thread

08-12-2003 | 08:19 PM

#16

IS2Scooby

Thread Starter

Pr0n King

iTrader: (3)

Joined: Nov 2002

Posts: 26,618

From: The Land of Rocks

Car Info: Turncoat Turbo

*BAN-PU* - got 2 more calls on this one today. UGLY!
__________________
Best Car Insurance | Auto Protection Today | FREE Trade-In Quote

08-12-2003 | 08:53 PM

#17

BoOm

Registered User

iTrader: (4)

Joined: Nov 2002

Posts: 3,462

From: Honolulu, HI

Car Info: 2008 MB C350S Chip/Exhaust 268whp

Beating you to it Richard, 7 calls just today.

08-13-2003 | 02:37 PM

#18

gpatmac

VIP Member

iTrader: (3)

Joined: Nov 2002

Posts: 10,133

From: Lastweek Lane - Watertown, NY

Car Info: 02WRXpseudoSTiWannabeWagon

Quote:

From Symantec's Webpage: Important Note: This policy will only work properly on ESM agents running SU12 and later. It will not work properly on agents using older ESM SU versions. An agent's SU version can be determined from the ESM Console using the Agent properties feature.

It says it can't find my host, like I can't log on.

It's from this link:

Quote:

Go here for more info:http://securityresponse.symantec.co...ntent/8205.html

08-13-2003 | 03:17 PM

#19

gpatmac

VIP Member

iTrader: (3)

Joined: Nov 2002

Posts: 10,133

From: Lastweek Lane - Watertown, NY

Car Info: 02WRXpseudoSTiWannabeWagon

Quote:

This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT Authority/system.

Shutting down in xx sec.

Message Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly.

08-13-2003 | 03:26 PM

#20

IS2Scooby

Thread Starter

Pr0n King

iTrader: (3)

Joined: Nov 2002

Posts: 26,618

From: The Land of Rocks

Car Info: Turncoat Turbo

Is this happening to your computer Pat?
__________________
Best Car Insurance | Auto Protection Today | FREE Trade-In Quote

08-13-2003 | 03:30 PM

#21

IS2Scooby

Thread Starter

Pr0n King

iTrader: (3)

Joined: Nov 2002

Posts: 26,618

From: The Land of Rocks

Car Info: Turncoat Turbo

If it is, go to a command prompt [windows key+R | cmd] to get a command prompt. Once you're at the command prompt type "shutdown -a" (no quotes). This will abort the impending system shutdown.

This will give you time to go download the RPC fix: http://microsoft.com/downloads/detai...displaylang=en

And then depending on the payload that was delivered to your system remove the virus: http://securityresponse.symantec.com...r/FixBlast.exe

Note there are now a total of 3 iterations of the MS Blaster worm. The tool SHOULD work on all 3, but some have reported the best luck with the "b" version of the worm. Sigh.

LESSON HERE PEOPLE! Be safe!

Pat, hope it's not happening to your new rig. It's going to be a mess to clean up if it is...
__________________
Best Car Insurance | Auto Protection Today | FREE Trade-In Quote

08-13-2003 | 04:12 PM

#22

gpatmac

VIP Member

iTrader: (3)

Joined: Nov 2002

Posts: 10,133

From: Lastweek Lane - Watertown, NY

Car Info: 02WRXpseudoSTiWannabeWagon

It is. And to be honest, I believe that it happened before I ever hooked a LAN cable up to it.

08-13-2003 | 04:33 PM

#23

gpatmac

VIP Member

iTrader: (3)

Joined: Nov 2002

Posts: 10,133

From: Lastweek Lane - Watertown, NY

Car Info: 02WRXpseudoSTiWannabeWagon

Mission success.

Do I have to go through the process again for Kathy's profile, and/or shut down the 'system restore'?

08-13-2003 | 08:11 PM

#24

IS2Scooby

Thread Starter

Pr0n King

iTrader: (3)

Joined: Nov 2002

Posts: 26,618

From: The Land of Rocks

Car Info: Turncoat Turbo

It depends on which iteration of any number of viruses you contracted... Probably not, but make sure you install anti-virus updates and security patches RELIGIOUSLY and watch for suspicious activity.

If anything, I would erase your system restore files (shut down system restore, reboot, re-activate system restore, reboot) and deep scan the hard drive (all profiles) for malicious code/files.
__________________
Best Car Insurance | Auto Protection Today | FREE Trade-In Quote

08-13-2003 | 08:14 PM

#25

IS2Scooby

Thread Starter

Pr0n King

iTrader: (3)

Joined: Nov 2002

Posts: 26,618

From: The Land of Rocks

Car Info: Turncoat Turbo

Blaster has infected 120,000 computers in 24 hours.

DON'T LET THIS HAPPEN TO YOU.

I LITERALLY have 10 machines in my office that I'm going to be tending to over the span of the next few days (and over the weekend) trying to dis-infect.
__________________
Best Car Insurance | Auto Protection Today | FREE Trade-In Quote