RPC WORM

[DKruskie]

If anyone has had the problem of their comp shutting off due to NT Authority System here is the link that will remove this problem called MSBlast.exe..it will also forward you to the patch after it is done removing it..http://securityresponse.symantec.co...aster.worm.html


David

[Baldrick]

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

[Faustus]

I cannot suggest updating against this thing enough.In one day its gone from a medium threat to wildly spreading. Its also the only virus I've gotten in almost 10 years of using computers, and when I got it I was online with my modem for less then 10 mins. It spreads via scanning ports so not opening attachments is no shield.

It mainly affect 2k and XP boxs, as well as some of the server OSs. Norton has a free removal tool on their site that very painless. And if you don't have a virus scanner grisoft.com offers a free one on their website. (Just click the link for the free on on the left hand side of the screen from their homepage.)

[DeleriumMDK]

I've got two PC's connected to a Router (D-Link DI-704, to be exact) sharing my cable connection, and the only ports I've got open are for AIM File Transfers. Is it still possible for this worm to attack the PC's connected to my router? Just curious, thanks.

[thayne]

I've got two PC's connected to a Router (D-Link DI-704, to be exact) sharing my cable connection, and the only ports I've got open are for AIM File Transfers. Is it still possible for this worm to attack the PC's connected to my router? Just curious, thanks.

No, but you should still install the patch.

[DeleriumMDK]

I have XP Home, Service Pack 1...looking at MS's site with the patches, it has a patch for both 32-Bit and 64-Bit. Would I need the 32-Bit patch for XP Home?

[thayne]

the 32 bit is what you want

[flaninacupboard]

that link is currently down it would seem....

[DeleriumMDK]

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp


I just got my patch from there, installed it no trouble...

[Northstar]

Block port 135 udp/tcp on your firewall if you havent already, i have had ports 135/137/139 blocked for months.

[Poppa_Meth]

The computer work was infected with this. I've fully patched it against it now and I'm just wondering is it necessary to run a virus scan to remove the worm itself?

[Gees]

You can get Fixblast.exe from Symantec's website. If finds the virus (or reports it's not present), cleans it and has a handy option to go right to the patch - for those who haven't yet.

This thing seems to have hit loads of people last night and this morning. First learned of it with a panic call from my Dad-In-Law and moments later saw the same description here.

Then my husbands entire (networked) workplace was hit this morning. We're clean. We keep Zone Alarm running 24/7.

edited typos - sleepy fingers :c)

[Gees]

The link is already posted above.

[Reaper88]

Last week i was removing a virus form my firends computer ( they are just avarge users and dont think much about security) and i noticed the regesistry entry which i am sure was for this virus. I didnt know what it was at the time so i left it alone. A few days ago thier computer crashed. I noticed that in the info for this virus it says it may cause your computer to crash. I wonder if it crashing and this virus are related. Wont know for sure untill i get over to there house but i do find it kinna interesting.

[leebo]

The worm supposedly wasn't released until yesterday. The symptom is your computer will keep re-booting and you will get some kind of error message.

Personally, I try to keep things updated.