Xp shutdown problem

[fugjostle]

It doesn't really help you now but I did warn ya all aboot this on the 1st August

http://64.5.56.215/forum/showthread....threadid=20443

[DeJaY2k3]

OMFG Seems half the world had this worm by midnight. It was on the News late last night.

I had the m0f0 for a few days but i would only see it maybe 3 times a day and to avoid the shutdown i just opened up dos prompt and typed shutdown -a. It didnt reboot but geeez it was so phucked up i had to anyway haha.

I installed the 32bit patch from microsoft and also deleted the dumb ass crap outta my registry that was making this m0f0 msblast.exe start when i turn on the pc. Also i set a few things up in the services part of admin tools. It was in the Remote Procedure Call (RPC). On the recovery tab i selected everything to Take No Action and this stops a pc reboot when you hit an error.

I have had no probs now since i did the regedit as the m0f0 worm doesnt start no more. Whether it is still there lying dormant for a while i dunno but everything seems ok now. It is not SP1 related however as i dont have it installed. Its a m0f0 worm and a good one at that.

A few people have mentioned getting a porn email on msn and everything going tits up after they read it. I did the same and also think it is to blame. System Admins must have been veeeeerrrryyy busy lat night HaHa

[johns_ar]

http://securityresponse.symantec.com...ster.worm.html

more responses there.....

So is this not something about dodgy XP serials at all then???


My mate couldnt get rid of the blast thing and couldnt uninstall service pack 1 so he has ended up formatting the pc and re-installing xp

Only problem being that when he got to near the end of the XP install he got the message about NT/Security thing, he clicked OK to skip it but it didnt install properly

Hes now sat with win98 on.....

Any help for him?

[The Frog Meister]

this is the company stance on it.. and the links to help you out

> We have been advised by our anti virus partner that there is a new
> computer virus or 'worm' called, "W32.Blaster" affecting PC's using
> Windows NT, 2000 and XP. This is a global phenomenon affecting computer
> users worldwide.
>
> The worm is not designed to affect customer machines, but is intended to
> perform a denial of service attack at a future date on a 3rd party
> website.
>
> The software partially installs itself automatically and then reboots the
> affected PC to finish downloading.
>
> If you have not been affected but want to protect your PC, download the
> patch software from the url below:
>
> http://www.microsoft.com/security/se...s/ms03-026.asp
>
> If your PC has unexpectedly rebooted and you think you have been affected,
> go to your anti virus supplier's website and download the relevant update.
> Alternatively you can download free removal software for this worm at the
> following url:
>
> http://securityresponse.symantec.com...blaster.worm.r
> emoval.tool.html
>
> In a few cases, we are aware that some PC's have not restored themselves
> after rebooting and need further attention. In this case we recommend you
> contact your PC vendor's helpdesk to ensure you can restore your settings
> without losing your data. Alternatively, refer to Microsoft support online
> at:
>
> http://support.microsoft.com/default...estion.asp&SD=
> GN&FR=0
>

[STUART]

i think it has something to do with the porn emails aswell i had a letter form BT broadband the other day saying i was sending out obscene material and abusive emails and they would terminate my connection if i didnt stop immediately but i havent been sending anyhting like it , i am still waiting for them to get back to me as they didnt accept calls just emails.

[RetroAndy]

If this is definitely to do with not having a firewall then how come when i enabled mine yesterday it did it again.

It seems loads of peeps have had this same problem. Our I.T company ave been unidated with this problem all day.

Andy

[DeJaY2k3]

Both me and my dad have had this twat. I dont run a firewall however my dad runs the one in windows.

Problem is easy solved but its a proper prat when ya aint a clue

[fugjostle]

Originally posted by retroandy
If this is definitely to do with not having a firewall then how come when i enabled mine yesterday it did it again.

It seems loads of peeps have had this same problem. Our I.T company ave been unidated with this problem all day.

Andy

Having a firewall doesn't protect you unless your firewall is configured to prevent port 135 communication. Firewalls are also not very good when you have peeps with no virus protection coming in via VPN or dial-up routes because once this bugger has got inside the network then it will look for more machines to infect unrestricted by any firewall rules.

From everything I've read, this worm only infects via 135, so your firewall is not stopping the initial RPC request.

Fire up a command prompt and do the following:

C\:> telnet localhost 4444

if you get a command prompt then you are infected.

[DeJaY2k3]

C:\>telnet localhost 4444
Connecting To localhost...Could not open connection to the host, on port 4444.
No connection could be made because the target machine actively refused it.


C:\>

Whats that all about then lol?

[Mike]

I think that mean's your firewall's blocking the connection. That's what I get as well...

[DeJaY2k3]

Originally posted by Mike
I think that mean's your firewall's blocking the connection. That's what I get as well...

I dont use one or AV

[The Frog Meister]

it menas that you are not infected....

I run a firewall and an antivirus... Everything on high settings.... The only reason I'm 11119977% sure that I'm not infected is because I was not connectd to the web last night and I updated the A-V this morning

Byt he looks of it, the firewall will protect you a little more if you have him, but not totaly. The only way to b totaly protected is to never connect to the web, use Floppy disks or any other form of transferable media.

The basic line of this thing is that it's a pain in the arse, and a couple of quick steps protects you it has not damaged your PC...

My office has not suffered from it. It's jsut an iritation!!!

/meaningless and stupid post over

[The Frog Meister]

Originally posted by DeJaY2k3
I dont use one or AV

Jammy hthen.....

[DeJaY2k3]

Nah im not lol i just got rid of the fekkin worm last night

[Myk]

LMFAO, I am on holiday this week, but my partner phoend me this morning from the shop telling me that our workshop was collapsed with peaple infected by this damn worm, lol. I've managed to clean them all this morning by adding the now infamous 823980 security patch and I've even sold a shizitload of McAfee ineternet security packages (AV7+Firewall), so this worm has been a right little earner for us




For more info (god like youd need it after such huge post) look here : http://support.microsoft.com/?kbid=823980