» OLD MESSAGE ARCHIVES «
The Pop Culture Information Society...
Messageboard Archive Index, In The 00s - The Pop Culture Information Society

Welcome to the archived messages from In The 00s. This archive stretches back to 1998 in some instances, and contains a nearly complete record of all the messages posted to inthe00s.com. You will also find an archive of the messages from inthe70s.com, inthe80s.com, inthe90s.com and amiright.com before they were combined to form the inthe00s.com messageboard.

If you are looking for the active messages, please click here. Otherwise, use the links below or on the right hand side of the page to navigate the archives.

Custom Search



Subject: New Virus

Written By: boris66au on 08/12/03 at 05:32 p.m.

I know of three people who got this virus yesterday , myself included. You get a message saying:

NT AUTHORITY \SYSTEM- RPC service terminated. And then a 60 second clock counts down and reboots you. It happens more or less as soon as you get on the internet, happened to me about five times in as many minutes before I could stop it.

It's a pain to get rid off as you have to download a patch from windows, which if you're on dial up, is too big to do when you're getting rebooted all the time.

If you haven't already got the patch go to

http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

I've no idea how the virus is spread as I didn't open any dodgy emails or visit dodgy sites, and Norton didn't tell me i'd got it, nor does it find it when you scan your comp.

Subject: Re: New Virus

Written By: lebeiw15 on 08/12/03 at 05:34 p.m.

Correction:  You now know of FOUR people.  I have this too and had no idea this was a virus.  I guess my mom got rid of it, but just in case she didn't, I will pass along the info.  Thanks.

Subject: Re: New Virus

Written By: boris66au on 08/12/03 at 05:36 p.m.

lol I meant to post this in the 2000 forum not this one.

I'd advise everyone at least download the patch and save it even if they don't want to install it, just incase!


Virus might be the wrong word, but with the amount of people getting it it seems to be that.

Subject: Re: New Virus

Written By: boris66au on 08/12/03 at 05:49 p.m.

lebeiw do a search for MSBLAST.EXE, i've just found it twice on mine and Norton decided to pop up finally.

You can get a removal tool from here

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

it's at the bottom of the page

Subject: Re: New Virus

Written By: Bobby on 08/12/03 at 06:00 p.m.

Thanks very much for the info, Borris66au.  :)

Subject: Re: New Virus

Written By: Howard on 08/12/03 at 07:31 p.m.

I'm glad it didn't happen to my computer. :D

Howard

Subject: Re: New Virus

Written By: NbC on 08/13/03 at 07:20 a.m.

Thanks for the warning and the links boris66au.  I just got infected a few minutes ago while I was browsing the boards.  Where did it come from?  You are correct in advising everyone to download the patch ahead of time because once you are infected you will have a hell of a time staying online.  

Why do people create such things?   >:(

Subject: Re: New Virus

Written By: philbo_baggins on 08/13/03 at 07:48 a.m.

Quoting:
I've no idea how the virus is spread as I didn't open any dodgy emails or visit dodgy sites, and Norton didn't tell me i'd got it, nor does it find it when you scan your comp.
End Quote



From McAfee's website:
This worm spreads by exploiting a recent vulnerability in Microsoft Windows. The worm scans random ranges of IP addresses on port 135. Discovered systems are targeted. Exploit code is sent to those systems, instructing them to download and execute the file MSBLAST.EXE from a remote system via TFTP.

The worm contains a payload to initiate a Denial of Service attack against windowsupdate.com.

Computers that have up-to-date antivirus software will detect the worm executable upon download. However, unless the system has been (MS03-026) patched, it is susceptible to the buffer overflow attack. This means that the remote shell will still get created on TCP port 4444, and the system may unexpectedly crash due upon receiving malformed exploit code.


...a clever one, rather than the easy-to-write mail viruses.

Quoting:
Why do people create such things?   >:(
End Quote


Because they can?

Must admit I have more respect for people who can create these sorts of viruses, which exploit hard-to-find holes in Microsoft's crappy security, than the Outlook viruses which can be created in five minutes using the MAPI documentation....

This one definitely seems to me an anti-MS virus as it's aimed at using everybody's computers to hit the MS update server

Phil

Subject: Re: New Virus

Written By: Billy_Florio on 08/13/03 at 12:28 a.m.

well, boys, now you know 2000+ that also got hit with it....yesterday, I walked into work at 1, and found out that every computer (Every computer!) on the campus had been hit by this thing.....every computer was shutting down when we kept on trying to start it up.....so we were computerless, and let me tell you.....our job doesnt work well computer less...we had to use downtime books and all, and thats just a huge pain in the neck, especially when someone comes in wanting to take out 15+ books....they didnt get the systems up again till 5 minutes before I walked in today...so we were basicly computerless all day yesterday ..not jus tthe library...the whole campus!


I also heard it hit a DMV in Michagan

Subject: Re: New Virus

Written By: Meriadoc on 08/13/03 at 01:07 p.m.

I had it last week and it took my computer repair person 2 hours (and $100. of my money) to get rid of it. Norton did not catch it, and when I ran the online scan direct from Symantec that did not catch it either. A scan done in safe mode tuned up 12 infected files and it turned out to be Spybot32. I had downloaded the patch but did so too late. None of my system files could be viewed: Task Manager, Regedit, MSConfig - all would not come up at all or only come up for a split sec and then vanish. >:(

Subject: Re: New Virus

Written By: Junior on 08/13/03 at 02:27 p.m.

I seem to be one of the few who doesn't have it...I just installed the patch, still need to restart and then I'll be done.

Subject: Re: New Virus

Written By: boris66au on 08/13/03 at 04:35 p.m.

Nbc, and anyone else who got it, make sure you download and run the removal tool from symantic, because even with the patch, if you've already had it it's still on your computer. Not sure what it can do then but it's easy to get rid of.

Don't forget to turn off System Restore before running the tool...lol and don't forget to turn it back on again afterwards, I went to disable mine and found it had been off for months from the last time I did something!

Subject: Re: New Virus

Written By: NbC on 08/13/03 at 07:46 p.m.


Quoting:
Nbc, and anyone else who got it, make sure you download and run the removal tool from symantic, because even with the patch, if you've already had it it's still on your computer. Not sure what it can do then but it's easy to get rid of.

Don't forget to turn off System Restore before running the tool...lol and don't forget to turn it back on again afterwards, I went to disable mine and found it had been off for months from the last time I did something!
End Quote



I hope I am not still infected because I had to use System Restore (set it back to before I was infected) in order to get online to download the removal tool and later on the patch.  Otherwise the virus kept shutting me down.  I read that System Restore may store the virus in its folders and Norton can not access those files.  After downloading the patch I did run the removal utility twice (once in safe mode) but it didn't find anything and my computer hasn't given me any noticeable problems, yet.

Norton did notice the virus when I was first infected but for some reason the virus was still able to continue with its countdown (s).  I did find a file in the Quarantine Folder which I deleted.  I hope that was it and not something that I needed.  I guess I will just have to wait and see.  

What a headache this has been.   >:(

Subject: Re: New Virus

Written By: Gis on 08/14/03 at 01:54 a.m.

People at work have been getting this one we also got hit by that major one last week.Our email systemm was down for two days overloaded with over 30,000 emails half of which were that particular virus !!

Subject: Re: New Virus

Written By: BrianMannixGirl on 08/14/03 at 03:02 a.m.

yep I got this durn worm last night too.  Not impressed that it snuck thru BitDefender, Zone Alarm, Protector Plus and whatever other flamin virus checkers I have running !  >:(

Subject: Re: New Virus

Written By: Gis on 08/14/03 at 09:19 a.m.

On a happy note our systems department has stopped readers logging in to our online system as laptops with the worm have been causing havoc apparently so less work for me now !

Subject: Re: New Virus

Written By: Fred on 08/14/03 at 12:32 a.m.

I got the patch, and luckily I'm virus free.

Although a few computers at my dad's office got it.

Subject: Re: New Virus

Written By: Wicked on 08/14/03 at 09:07 p.m.

People are jerks, why do they want to kill everyones' computers?  Someone I know got one of those virus things too.  I don't think it would be such a bad thing if my computer got a virus, then maybe my mom would get a new one...