A Place of Safety
I expect simple behaviours here. Friendship, and love.
Any advice should be from the perspective of the person asking, not the person giving!
We have had to make new membership moderated to combat the huge number of spammers who register
















You are here: Home > Forum > A Place of Safety > General Talk > That internet worm .........Read if you have Windows..
icon13.gif That internet worm .........Read if you have Windows..  [message #13265] Tue, 12 August 2003 21:15 Go to next message
smith is currently offline  smith

On fire!

Registered: January 1970
Messages: 1095



I got home from work yesterday and logged on. I didn't open any e-mail. I just went to hotmail. A screen popped up that said: SYSTEM SHUTDOWN..RPC (remote procedure call) is terminating your computer. No matter what I did, it kept coming on. I would log off and it would pop right back up. I was losing icons and my programs wouldn't come up. I couldn't even stay on long enough to tell anyone.

I think I have it under control for the moment. It's a worm called Blaster that attacks mostly home computers and you don't have to open anything to have it. It just gets you when you come on-line. If you have Windows 2001, XP, NT or server 2003, that's what it's going after. I have uptodate Norton Antivirus and it crashed right through it. There is a patch you can download and install. That's what seems to have saved mine. I had no idea I had to have it Sad Here's the site:
http://support.microsoft.com/?kbid=823980

Here's an article on MSN news if you want to read it:
http://msnbc.com/m/pt/printthis_main.asp?storyID=951393

smith
icon8.gif It's a real b****...  [message #13266 is a reply to message #13265] Tue, 12 August 2003 21:30 Go to previous messageGo to next message
setras is currently offline  setras

Likes it here
Location: Finland
Registered: August 2003
Messages: 172



A friend of mine had it on her parents computer and me and another friend ended up trying to get rid of it, and it was surprisingly persistant... First the antivirus software didn't find it, then we managed to remove the virus by booting the computer to safe mode / command prompt and running a dos version of the virus scanner. After that when rebooting it made a come-back, but this time the virus scanner found it and after removing it again, the computer seems to be clean...

I hope none of you catch it!
Setras



That which is dreamed can never be lost, can never be undreamed.
-Master Li in Neil Gaiman's Sandman
Windows Update includes the patch  [message #13267 is a reply to message #13265] Wed, 13 August 2003 01:40 Go to previous messageGo to next message
trevor is currently offline  trevor

Really getting into it

Registered: November 2002
Messages: 732



they say, so if you do that regularly you should be good. If you have a firewall, that would be prevent this and similar (yet undiscovered) vulnerabilties. XP comes with one built in, although I prefer a firewall router which I need to share the cable modem with the whole family and VPN to work anyway.

I'll bet money that this will wake me up at about 4 tomorrow morning - my users are 3 hours earlier and all the patching/downloading will kill their internet connections and break my internet-provided applications!
icon5.gif Re: Windows Update includes the patch  [message #13269 is a reply to message #13267] Wed, 13 August 2003 02:03 Go to previous messageGo to next message
Guest is currently offline  Guest

On fire!

Registered: March 2012
Messages: 2344



So correct me if I'm wrong...my new Windows XP has the good things already to prevent this? And Man's Windows 98 won't be attacked anyhow, right?

Sheesh...
Re: Windows Update includes the patch  [message #13270 is a reply to message #13269] Wed, 13 August 2003 05:29 Go to previous messageGo to next message
trevor is currently offline  trevor

Really getting into it

Registered: November 2002
Messages: 732



Right. In XP, it has to be turned on and I don't know the settings (may be turned on by default in a normal install?), but it's in Settings - Control Panel - Network Connections - Network Setup Wizard, I think. One of the things I absolutely hate about XP - "The Wizard" - which you can't avoid using so you can't manually tweek settings if you do understand them - ARG!

On Windows 98, disable all printer/folder sharing, remove NetBEUI and NetBios unless you really need it, and turn off the Windows Messaging service to secure it a bit better. We've seen "popup" messages - usually "spam" that use the Windows Messaging service which just displays a dialog box, usually to say your print job is done in a network environment, for example. This is different than Instant Messenger services, although some of those can allow others more access than you'd like, too.

XP Home edition may be different - they maimed a bunch of network functionality, so I dunno.

Sorry for lameness - others surely know more - this is one of those things that is significantly different between a corporate and home environment and I really only know the corporate side.

There are also some free downloadable firewalls, some discussed on Ashley's board awhile back in this thread: http://paulhaskew.hypermart.net/cgi-bin/ikonboard.cgi?s=3f39c8bc556dffff;act=ST;f=18;t=17

(The newer versions of windows and this vunerability invalidates some of my comments there.)
Re: Windows Update includes the patch  [message #13273 is a reply to message #13270] Wed, 13 August 2003 11:07 Go to previous messageGo to next message
smith is currently offline  smith

On fire!

Registered: January 1970
Messages: 1095



At the bottom of your screen, in the taskbar, a little icon will appear frequently when you open your computer with the message "You have Microsoft updates to download". Always do that when it pops up...that's where the patches are. I guess there was glitch in mine.
JJ
That danged worm  [message #13276 is a reply to message #13273] Wed, 13 August 2003 15:56 Go to previous messageGo to next message
Guest is currently offline  Guest

On fire!

Registered: March 2012
Messages: 2344



Took me a lot of the afternoon to fix. I found that I had the thing because I kept getting shut down. Dumb me, I hadn't gotten anti-virus updates in the one day I was on-line last week on this new computer. So I downloaded the patch (several attempts where I learned that Win 32 and 64 aren't the same, and which I have...)Ugh!

BIG thanks to smith for pointing it out to Ron, who coached me thru it and sent me the right patch.

Then I downloaded Norton and had to uninstall McAffee...and then I got rid of the worm.

Sheesh, all that amidst more deliveries and a friend visiting from New York City.

What a day. Why do people get off on destroying other people's computers, anyhow???
Do you need it for Win 98?  [message #13279 is a reply to message #13270] Wed, 13 August 2003 19:37 Go to previous messageGo to next message
e is currently offline  e

On fire!
Location: currently So Cal
Registered: May 2002
Messages: 1179



Unless I missed something, it looked like there weren't any versions of the patch for Windows 98. Also I haven't seen 98 mentioned as a target.

I guess I'm just confused.

Think good thoughts,
e
icon7.gif Nope, it seems those of us with 98 need not worry!  [message #13283 is a reply to message #13279] Wed, 13 August 2003 21:21 Go to previous messageGo to next message
arich is currently offline  arich

Really getting into it
Location: Seaofstars
Registered: August 2003
Messages: 563



No Message Body



People will tell you where they've gone
They'll tell you where to go
But till you get there yourself you never really know
Where some have found their paradise
Other's just come to harm
icon8.gif I got it too  [message #13285 is a reply to message #13265] Wed, 13 August 2003 22:52 Go to previous messageGo to next message
nick is currently offline  nick

Likes it here
Location: London
Registered: July 2003
Messages: 351



The very first time I went on line with my brand new computer.

The ironic thing was I only went on line to install the latest Windows updates.

Thanks smith - but for your timely warning I wouldn't have had a clue what was happening.

Downloaded the patch now and seems to be OK.
icon4.gif This has been bizarre  [message #13289 is a reply to message #13265] Wed, 13 August 2003 23:18 Go to previous messageGo to next message
smith is currently offline  smith

On fire!

Registered: January 1970
Messages: 1095



I asked all around today and I was the only person around here that got "Blasted". It seems that a remote computer attacked me and then when I kept restarting, I began to attack someone else somewhere in the world (sorry Nick or David). It didn't go through address books or anything. There were encoded messages in the worm aimed at Bill Gates. It didn't destroy anything, just played havoc with companies and personal computers.
We've all learned now to keep the updates um....updated :)Smile

{{{hugs}}} smith
icon4.gif Blaster Update  [message #13374 is a reply to message #13265] Fri, 15 August 2003 21:09 Go to previous messageGo to next message
smith is currently offline  smith

On fire!

Registered: January 1970
Messages: 1095



This only affected Windows NT 4.0, Windows 2000, Windows XP and Windows Server 2003.

4 Steps for Home Users:
to help protect and recover if your computer has been infected.

http://www.msn.com/Blaster/msblaster.htm
icon4.gif Windows XP users  [message #13375 is a reply to message #13374] Fri, 15 August 2003 21:29 Go to previous message
setras is currently offline  setras

Likes it here
Location: Finland
Registered: August 2003
Messages: 172



Something the link smith posted above doesn't mention is that according to http://support.microsoft.com/?kbid=823980#WinXP you need to have Service Pack 1 or Service Pack 1a installed prior to installing the security update to block the worm.

Taken from: http://support.microsoft.com/default.aspx?scid=kb;EN-US;813926

"To determine if you are running Windows XP SP1, right-click My Computer, and then click Properties. If "Service Pack 1" appears under System, you are already running Windows XP SP1. There is no benefit to installing SP1a if you are already running Windows XP SP1. Microsoft does not recommend that you install SP1a if you are already running SP1."

And the Windows XP Service Pack 1(a) can be obtained through here: http://www.microsoft.com/windowsxp/pro/downloads/servicepacks/sp1/default.asp



That which is dreamed can never be lost, can never be undreamed.
-Master Li in Neil Gaiman's Sandman
Previous Topic: Timmy i have a question
Next Topic: The Grand Final is here
Goto Forum: