dcsimg
Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 23

Thread: System Shutdown (RPC)

  1. #11
    Senior Member
    Join Date
    May 2003
    Location
    Rochester, New York
    Posts
    128
    i cant run my virus scanner or windows updates
    -Simo

  2. #12
    Senior Member
    Join Date
    Aug 2002
    Posts
    651
    Hope you have a backup of important files. The best solution is to cut your losses and start over, if you can. That's the only way to know for sure that you have gotten rid of it. Sounds nasty. Someone here may have better advice, but I'm just telling you what I'd do. :
    Opinions are like holes - everybody\'s got\'em.

    Smile

  3. #13
    The Doctor Und3ertak3r's Avatar
    Join Date
    Apr 2002
    Posts
    2,743
    Blaster just upgraded to a Cat-4.. 08:50 UTC



    Only panic if you don't have access to a clean, patched, firewalled system..

    Follow removal instructions from Symantec
    This page includes links to download a removal tool, and the Patch..

    NOTE: Follow the Bloody Instructions especially the step about disabling the system Restore.. If you don't do this it will come back.. and follow the instructions

    Read instructions on how to remove the W32/Blaster-A worm and ensure your system is not vulnerable to reinfection.
    If you don't like Symantec (Norton) you could try Sophos for instructions ..
    Or try the info from McAfee (Lovesan=MSBlaster) ..Also info from F-Prot ..And Bitdefender ..And Authentium (aka Command.com AV) .. Oh and Panda .. Oh and TrendMicro .. And Leprechaun .. M$'s RAV .. I hope you don't need help from Kaspersky ..

    I think you get the hint.. Clean/Patched/Firewalled(port135, 4444 and all other un-need ports Blocked) Machine.. to get the info, tools and patches.. and follow the instructions..


    Cheers

    BTW: Dosen't anyone do some sort of a search b4 posting?.. the number of treads on different forums on this site, regarding this bug.. while some it is understandable they didnt know what was happening.. ..

    Opps i think I have given out my secret for all the Heads Up warnings.. This Listing is just those who listed the Lovesan/MSBlaster worm in their warnings.. Noobs.. bookmark them....


    BTW: Dosent anyone do some sort of a search b4 posting?.. the number of treads on different forums on this site, regarding this bug.. while some it is understandable they didnt know what was happening.. ..
    "Consumer technology now exceeds the average persons ability to comprehend how to use it..give up hope of them being able to understand how it works." - Me http://www.cybercrypt.co.nr

  4. #14
    I still think its unnecessary to do a complete reinstall of your system,
    which may be a very costly or difficult thing to do for the common lay
    person.

    I would follow the steps that Symantec gives from the following link:
    Symantec

    What they dont say on the manual removal is that the file has the attribute of read online. You need to right click on c:\windows\system32\msblast.exe or c:\winnt\system32\msblast.exe and uncheck the read only check mark. Then after the process is terminated you can delete the file.

    I do agree that if you had this security hole for as long as its out, there is a risk that there may be other hacks on your computer.

    I wrote a tutorial on how to determine if you have some of these hacks. It wont cover everything but does cover a great deal.

    The tutorial can be found at: Windows Forensics: Have I been hacked?

    Hope this helps.

  5. #15
    Senior Member
    Join Date
    May 2003
    Location
    Rochester, New York
    Posts
    128
    thanks guys
    i got rid of the worm around 3 am this morning. if i knew how give out anti points i would
    -Simo

  6. #16
    Senior Member
    Join Date
    Aug 2002
    Posts
    547
    http://securityresponse.symantec.com...oval.tool.html there you can download the removal tool and dont forget to update windows i read in a site that microsoft already has a Patch

    http://www.globetechnology.com/servl...ry/Technology/

  7. #17
    Senior Member
    Join Date
    Feb 2003
    Posts
    282
    >>i got rid of the worm around 3 am this morning.

    Im glad you got rid of the darn thing. Lucky im running Win 98 and does not seem to be afected.

    I would just like to say I was just down stairs fixing my friends XP computer, he had the blaster worm, and was getting the RPC shutdown. I fixed it by downloading a patch http://support.microsoft.com/?kbid=823980#WinXP

    But now as I read this I see I was suposed to also delete mblaster.exe, I will inform my friend.

  8. #18
    Senior Member
    Join Date
    May 2003
    Posts
    207
    Originally posted here by Simo
    thanks guys
    i got rid of the worm around 3 am this morning. if i knew how give out anti points i would
    good job all of those that helped

  9. #19
    Junior Member
    Join Date
    Aug 2003
    Posts
    8

    msblast???

    I have gotten that shut down message ONCE.... and that was a few weeks ago, while playing counter-strike. and never again *knock on wood*. But once a day I do get a pop up about updating my windows, but when i click "more" its just some advertisement....and its an update message from comcast *my internet provider* so was what I got an actual error my comp had...or you think its the virus. And I dont have msblast.exe anywhere in my comp.

  10. #20
    Senior Member
    Join Date
    Apr 2002
    Posts
    889
    One thing you have to keep in mind with Win XP is before you remove anything to turn off XP's system restore function. If you do not do that and are infected XP will put back the infection. LOL another customer want to have by M$ Dah guess they did not think that out fully like many things.
    Peace
    I believe that one of the characteristics of the human race - possibly the one that is primarily responsible for its course of evolution - is that it has grown by creatively responding to failure.- Glen Seaborg

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •