Search
Forum Home | Login
Frogboy
Frogboy
Join Date 03/2001
+2419 sdemperor

Nasty Worm going around

August 11, 2003 5:56:18 PM from WinCustomize ForumsWinCustomize Forums

This hasn't shown up on any news sites yet that I know of but there is a really nasty worm going around the net that uses an exploit in RPC on XP. Make sure you have the latest updates to Windows XP installed or you will get zapped by this at some point.


It will cause a crash in RPC which will force your machine to reboot 60 seconds later (With a count down). It's a PITA to remove too once you get it.

Locked Post
Search this post
Advanced Search
Subscription Options
Reason for Karma (Optional)
Successfully updated karma reason!
3 Pages1 2 3 
Frogboy
crissy14
Join Date 06/2002
+2
Reply #1 August 11, 2003 6:02:30 PM
from WinCustomize ForumsWinCustomize Forums
At the risk of sounding stupid.......What does RCP stand for?
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
kthxbye
Join Date 08/2002
0
Reply #2 August 11, 2003 6:19:29 PM
from WinCustomize ForumsWinCustomize Forums
RPC: Remote Procedure Call.

In a nutshell, it (the RPC service,) is one of the critical services of Windows NT. ^.^
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
yrag2
Join Date 10/2002
0
Reply #3 August 11, 2003 6:25:09 PM
from WinCustomize ForumsWinCustomize Forums
https://grc.com/x/portprobe=135 is a direct link to test if your port 135 is open or closed. Open is bad....closed or stealth is good.
Reason for Karma (Optional)
Successfully updated karma reason!

Sign Up or Login and this ad disappears!
There are many great features available to you once you register. Sign Up for a free account and browse the forums without ads.

Frogboy
BasketWeaver
Join Date 04/2001
0
Reply #4 August 11, 2003 6:27:37 PM
from WinCustomize ForumsWinCustomize Forums
Thank you!
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
Pooya1770
Join Date 09/2002
0
Reply #5 August 11, 2003 6:37:41 PM
from WinCustomize ForumsWinCustomize Forums
ok even i have this bug now .. i wish i knew how 2 get rid of it .. its very very annoying .. i hope none of u get it ..
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
Nakor
Join Date 03/2001
+41 sdemployee
Reply #6 August 11, 2003 6:43:51 PM
from WinCustomize ForumsWinCustomize Forums

Use REGEDIT.EXE and wipe out the value referencing MSBLAST.EXE at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.


Reboot. \windows\system32\msblast.exe (location may vary slightly depending on OS) should now no longer be running. Get rid of it.


Use WindowsUpdate to make sure you're patched or grab it by following the links for your OS from here: http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp

Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
Xerraire
Join Date 12/2002
0
Reply #7 August 11, 2003 6:53:03 PM
from WinCustomize ForumsWinCustomize Forums
here is a direct link to the update
http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

Thanks so much for telling us about this!

Barb
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
Sugaree
Join Date 03/2001
+4
Reply #8 August 11, 2003 6:59:30 PM
from WinCustomize ForumsWinCustomize Forums
Grrrrrrrr I got it and I never get anything

O well all better now
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
RadialFX
Join Date 07/2001
+33
Reply #9 August 11, 2003 7:21:24 PM
from WinCustomize ForumsWinCustomize Forums
Seems no matter what I do, the link above still reports that port 135 is "Open". I've applied the patch, changed the registry entry for DCOM service, even used DCOM config to disable and it still says...."OPEN". Am I suffering from another bout of "headuperectus" or just is it just full-blown Dumass Inc.?
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
Millicona
Join Date 06/2002
0
Reply #10 August 11, 2003 7:24:11 PM
from WinCustomize ForumsWinCustomize Forums
i think it piggybacks on windows update
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
paulbrittgarcia
Join Date 04/2003
0
Reply #11 August 11, 2003 7:31:32 PM
from WinCustomize ForumsWinCustomize Forums
I got it too!

>
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
antu^jamban
Join Date 10/2002
0
Reply #12 August 11, 2003 7:40:19 PM
from WinCustomize ForumsWinCustomize Forums
thanx for the infos... nasty worms. checked my port. its stealth yay . ehmm i guess my system is protected. even tho my 135 port is stealth (according to the grc test),i would still like to know how to close it..
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
crissy14
Join Date 06/2002
+2
Reply #13 August 11, 2003 7:44:52 PM
from WinCustomize ForumsWinCustomize Forums
Cool! my port is closed! (gee, that sounds a little nasty) But, it doesnt surprise me. We have two puters networked here and we have them as tight as a drum
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
crissy14
Join Date 06/2002
+2
Reply #14 August 11, 2003 7:46:23 PM
from WinCustomize ForumsWinCustomize Forums
kthxbye
thx for the info on RPC
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
dan.wright
Join Date 04/2001
0
Reply #15 August 11, 2003 7:57:37 PM
from WinCustomize ForumsWinCustomize Forums
This thing pounded us today. We had 12 servers RPC service all die at the same time and subsequenly it started spreading around to the desktops. Unfortunately it's almost impossible to keep up with the Microsoft/Anti-Virus patching machine
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
BtEO
Join Date 06/2001
0
Reply #16 August 11, 2003 8:16:57 PM
from WinCustomize ForumsWinCustomize Forums
Just a heads up... despite my port being stealthed i still got hit somehow

Edit: got hit cause it's more than port 135 to worry about
http://isc.sans.org/diary.html?date=2003-08-11
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
Anthony R
Join Date 01/2003
+59
Reply #17 August 11, 2003 8:52:42 PM
from WinCustomize ForumsWinCustomize Forums
I got it everytime I tried to open my computer a countdown would start ...I went to get that patch from Microsoft and applied it and so far no countdown I hope it stays like
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
Anthony R
Join Date 01/2003
+59
Reply #18 August 11, 2003 8:53:51 PM
from WinCustomize ForumsWinCustomize Forums
Thanks for the info I thought I was flippin me lid
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
Larry Kuperman
Join Date 04/2001
+43
Reply #19 August 11, 2003 9:16:53 PM
from WinCustomize ForumsWinCustomize Forums
I recently switched to Trend Micro's Anti Virus software and have been very satisfied.

Like most of the major Anti-Virus companies, Trend Micro offers a free on-line scan. House Call is available from http://housecall.trendmicro.com/

Manual removal instructions are available from http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A

I hope that this helps.
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
ZiUL
Join Date 01/2002
0
Reply #20 August 11, 2003 9:17:20 PM
from WinCustomize ForumsWinCustomize Forums
Ok... I got this thing and I was able to stop the shutdown process:
start > run > shutdown -a

done...
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
primag3n
Join Date 06/2003
0
Reply #21 August 11, 2003 9:29:01 PM
from WinCustomize ForumsWinCustomize Forums
um.... before i read all this i just searched for msblast and deleted it... bad or good?
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
J0ely
Join Date 07/2003
0
Reply #22 August 11, 2003 9:42:13 PM
from WinCustomize ForumsWinCustomize Forums
thanks for the heads up, this thing was doing its dirty work every time i started msn messenger. now i can stop ripping my hair out
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
vulcan
Join Date 08/2001
0
Reply #23 August 11, 2003 9:50:22 PM
from WinCustomize ForumsWinCustomize Forums
OK...I admit I got it too.. ...

but with your info...everything is A-OK again!!!
Thank you very much for this one!!!!

Live long, and prosper...!!!
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
Netorius1
Join Date 06/2003
0
Reply #24 August 11, 2003 9:50:36 PM
from WinCustomize ForumsWinCustomize Forums
Ditto., I got it and have no idea how,,, i've been virus free for years..
disabled all startup proggies and no reboot since,, now i know what to look for and kill the Mo Fo.

Thanks folks
Reason for Karma (Optional)
Successfully updated karma reason!
Frogboy
WOM
Join Date 01/2002
+253 moderator
Reply #25 August 11, 2003 10:21:33 PM
from WinCustomize ForumsWinCustomize Forums
Hate to say this but Starone and I got that Worm. I don't cruise the net and rarely go to another site but to buy or pay bills other than camp out here. Starone goes everywhere. It came thru a firewall. Downloaded the patch on her DSL as my 56k couldn't stay connected long enough. All fixed now but was pissed for a while. That isn't an accusation against this site.So I hope no one thinks that. SkinStudio says that all you had to be is connected to the internet to get it.
Reason for Karma (Optional)
Successfully updated karma reason!
3 Pages1 2 3 
View all recent posts
Mark all posts as read Delete cookies created by the forum Return to Top
Stardock Forums v        Server Load Time:   Page Render Time: