Virus

Nelson Binch <[email hidden]> spoke thusly...

Quoted message said:

I suspect somebody on this group has been infected with a virus. I received an email containing a
worm with the subject speaking of Disk Brakes, which was caught and killed by my antivirus. It
came via my [email hidden] address, which is only used for newsgroups.

Time to update and scan, folks, especially with this Lovesan bug going around.

And let us not forget the worm that exploits an RPC leak.

anybody happen to have a process running called msblast? how about unexplained restarts?

bigblackglasses.comArticle.aspxOpen ↗

i just got over a hit from it last night on two of my workstations. cleaver little worm. without
network/internet isolation, it is nearly impossible to stop it long enough to patch the system.

I actually found the challenge quite entertaining. while doing research online about it, it
restarted my internet gateway system 50something times. at least it was nice enough to give me a
minute to bookmark the pages i was reading.

and BTW, i was running the XP Internet Connection Firewall at the time. guess it doesn't work as
good as MS thinks it does. i lost my copy of ZoneAlarm Pro so the ICF will have to suffice for now
(with the addition of the patch).
--
~Travis

megalink.net~farmersOpen ↗

"Merlin" <[email hidden]> wrote in message "]news:[email hidden]...

Quoted message said:

And let us not forget the worm that exploits an RPC leak.

anybody happen to have a process running called msblast? how about unexplained restarts?

bigblackglasses.comArticle.aspxOpen ↗

i just got over a hit from it last night on two of my workstations. cleaver little worm. without
network/internet isolation, it is nearly impossible to stop it long enough to patch the system.

I actually found the challenge quite entertaining. while doing research online about it, it
restarted my internet gateway system 50something times. at least it was nice enough to give me a
minute to bookmark the pages i was reading.

and BTW, i was running the XP Internet Connection Firewall at the time. guess it doesn't work as
good as MS thinks it does. i lost my copy of ZoneAlarm Pro so the ICF will have to suffice for now
(with the addition of the patch).
--
~Travis

megalink.net~farmersOpen ↗

I had the same restart problem when connecting, called the ISP and was told it was a Windows
problem...so, in the forty-odd seconds I had before a restart initiated, I saw MS recommended the
firewall. I enabled it, and well, it works so far.

I can't find msblast.exe on my box anywhere...is there a patch/fix somewhere that you know of?

Chris

"Chris" <[email hidden]> wrote in message
"]news:[email hidden]...

Quoted message said:

I had the same restart problem when connecting, called the ISP and was

told

Quoted message said:

it was a Windows problem...so, in the forty-odd seconds I had before a restart initiated, I saw MS
recommended the firewall. I enabled it, and well, it works so far.

I can't find msblast.exe on my box anywhere...is there a patch/fix

somewhere

Quoted message said:

that you know of?

Chris

Nevermind...I looked at your link, as I should have done in the first place, at all is well.

Chris

Chris <[email hidden]> spoke thusly...

Quoted message said:

"Chris" <[email hidden]> wrote in message
"]news:[email hidden]...

Quoted message said:

I had the same restart problem when connecting, called the ISP and was

told

Quoted message said:

it was a Windows problem...so, in the forty-odd seconds I had before a restart initiated, I saw
MS recommended the firewall. I enabled it, and well, it works so far.

I can't find msblast.exe on my box anywhere...is there a patch/fix

somewhere

Quoted message said:

that you know of?

Chris

Nevermind...I looked at your link, as I should have done in the first place, at all is well.

Chris

the file would be located in your c:\windows\system32 folder (maybe it is hidden. i always have my
files set to show all). a simple file search will find it if it is there. if it is not there,
could be another variation of the worm (or another one completely). the patch and firewall should
fix it anyway.
--
~Travis

megalink.net~farmersOpen ↗

Quoted post said:

Originally posted by Merlin
Chris <[email hidden]> spoke thusly...

Quoted message said:

"Chris" <[email hidden]> wrote in message
"]news:[email hidden]...

Quoted message said:

I had the same restart problem when connecting, called the ISP and was

told

Quoted message said:

it was a Windows problem...so, in the forty-odd seconds I had before a restart initiated, I saw
MS recommended the firewall. I enabled it, and well, it works so far.

I can't find msblast.exe on my box anywhere...is there a patch/fix

somewhere

Quoted message said:

that you know of?

Chris

Nevermind...I looked at your link, as I should have done in the first place, at all is well.

Chris

the file would be located in your c:\windows\system32 folder (maybe it is hidden. i always have my
files set to show all). a simple file search will find it if it is there. if it is not there,
could be another variation of the worm (or another one completely). the patch and firewall should
fix it anyway.
--
~Travis

I went into Admin Tools, services and changed the RPC's recovery to Restart Protocol on first failure and no action in any either instance... worked for me to keep the connection alive until I could go to Microsoft and DL the patch.



Jimbo(san)

megalink.net~farmersOpen ↗

"Nelson Binch" <[email hidden]> wrote in message
"]news:[email hidden]...

Quoted message said:

I suspect somebody on this group has been infected with a virus. I

received

Quoted message said:

an email containing a worm with the subject speaking of Disk Brakes, which was caught and killed
by my antivirus. It came via my [email hidden] address, which is only used for newsgroups.

Time to update and scan, folks, especially with this Lovesan bug going around.

---
__o _`\(,_ Cycling is life, (_)/ (_) all the rest, just details. Nelson Binch =^o.o^=
intergalax.comintergalax.comOpen ↗

Checked by AVG anti-virus system (grisoft.comgrisoft.comOpen ↗). Version: 6.0.509 / Virus Database: 306
- Release Date: 8/12/2003

I started to get frequent messages today "svchost.exe has generated errors ...", after that copy,
paste, some GUI actions where disabled etc. I found following post and at the and there is a patch
for it. Just install it, will se if everything is OK.

experts-exchange.comQ 20621670.htmlOpen ↗ 55880

D'amir

And someone was bad mouthing web tv. Ha ha we don.t get sick from Viruses

Fire up MTB 03

[email hidden] <[email hidden]> spoke thusly...

Quoted message said:

And someone was bad mouthing web tv. Ha ha we don.t get sick from Viruses

Fire up MTB 03

Ahh, nothing like the pleasure of full dolby digital audio while i play my 3D video games. and the
screen resolution is unbelievable.
--
~Travis "i will never move to webtv, never"

megalink.net~farmersOpen ↗

Merlin said:

[email hidden] <[email hidden]> spoke thusly...

Quoted message said:

And someone was bad mouthing web tv. Ha ha we

don.t

Quoted message said:

Quoted message said:

get sick from Viruses

Fire up MTB 03

Ahh, nothing like the pleasure of full dolby digital audio while i

play

Quoted message said:

my 3D video games. and the screen resolution is unbelievable.

Ah, the only problem with building a new 3 ghz system from scratch.

I forgot to import my kill files.

Shame on me.

P e t e F a g e r l i n <[email hidden]> spoke thusly...

Quoted message said:

Merlin said:

[email hidden] <[email hidden]> spoke thusly...

Quoted message said:

And someone was bad mouthing web tv. Ha ha we

don.t

Quoted message said:

Quoted message said:

get sick from Viruses

Fire up MTB 03

Ahh, nothing like the pleasure of full dolby digital audio while i

play

Quoted message said:

my 3D video games. and the screen resolution is unbelievable.

Ah, the only problem with building a new 3 ghz system from scratch.

I forgot to import my kill files.

Shame on me.

nice to see you too. but of course, the irony is blinding.
--
~Travis

megalink.net~farmersOpen ↗

"Chris" <[email hidden]> wrote in message
news:<[email hidden]>...

Quoted message said:

"Merlin" <[email hidden]> wrote in message "]news:[email hidden]...

Quoted message said:

And let us not forget the worm that exploits an RPC leak.

anybody happen to have a process running called msblast? how about unexplained restarts?

bigblackglasses.comArticle.aspxOpen ↗

i just got over a hit from it last night on two of my workstations. cleaver little worm. without
network/internet isolation, it is nearly impossible to stop it long enough to patch the system.

I actually found the challenge quite entertaining. while doing research online about it, it
restarted my internet gateway system 50something times. at least it was nice enough to give me a
minute to bookmark the pages i was reading.

and BTW, i was running the XP Internet Connection Firewall at the time. guess it doesn't work as
good as MS thinks it does. i lost my copy of ZoneAlarm Pro so the ICF will have to suffice for
now (with the addition of the patch).
--
~Travis

megalink.net~farmersOpen ↗

I had the same restart problem when connecting, called the ISP and was told it was a Windows
problem...so, in the forty-odd seconds I had before a restart initiated, I saw MS recommended the
firewall. I enabled it, and well, it works so far.

I can't find msblast.exe on my box anywhere...is there a patch/fix somewhere that you know of?

Chris

symantec.comsymantec.comOpen ↗ They have the removal tool .

M&M

M&M said:

symantec.comsymantec.comOpen ↗ They have the removal tool .

Which is fine if you already have the virus, but will not prevent you from getting infected in the
first place. Prevention is always best, so for those of you with XP or W2k, get the RPC patch from
the M$ website

bomba - who's spent all day helping the LAN admin to cure the network...

--
a.m-b FAQ: t-online.deambfaq.htmOpen ↗

b.bmx FAQ: t-online.debmx faq.htmOpen ↗

<Originally posted by Bomba

Quoted message said:

symantec.comsymantec.comOpen ↗ They have the removal tool .

Which is fine if you already have the virus, but will not prevent you from getting infected in the
first place. Prevention is always best, so for those of you with XP or W2k, get the RPC patch from
the M$ website

bomba - who's spent all day helping the LAN admin to cure the network...>

Actually the cool thing Symantec did was offer the Microsoft link for the patch at the end of the scan. So it is right there for you.

---> Hundreds of clueless e/u all calling at once... "I got worms"

Jimbo(san)

"Merlin" <[email hidden]> wrote in message "]news:[email hidden]...

Quoted message said:

Nelson Binch <[email hidden]> spoke thusly...

Quoted message said:

I suspect somebody on this group has been infected with a virus. I

received

Quoted message said:

Quoted message said:

an email containing a worm with the subject speaking of Disk Brakes,

which

Quoted message said:

Quoted message said:

was caught and killed by my antivirus. It came via my [email hidden] address, which is
only used for newsgroups.

Time to update and scan, folks, especially with this Lovesan bug going around.

And let us not forget the worm that exploits an RPC leak.

anybody happen to have a process running called msblast? how about unexplained restarts?

bigblackglasses.comArticle.aspxOpen ↗

i just got over a hit from it last night on two of my workstations. cleaver little worm. without
network/internet isolation, it is nearly impossible to stop it long enough to patch the system.

I actually found the challenge quite entertaining. while doing research online about it, it
restarted my internet gateway system 50something times. at least it was nice enough to give me a
minute to bookmark the pages i was reading.

and BTW, i was running the XP Internet Connection Firewall at the time. guess it doesn't work as
good as MS thinks it does. i lost my copy of ZoneAlarm Pro so the ICF will have to suffice for now
(with the addition of the patch).
--
~Travis

megalink.net~farmersOpen ↗

while it is shutting the system down does it give a window stating something about remote procedure
or something? If so then I think a friend of mine has
it.

T_Blood <[email hidden]> spoke thusly...

Quoted message said:

"Merlin" <[email hidden]> wrote in message "]news:[email hidden]...

Quoted message said:

Nelson Binch <[email hidden]> spoke thusly...

Quoted message said:

I suspect somebody on this group has been infected with a virus. I

received

Quoted message said:

Quoted message said:

an email containing a worm with the subject speaking of Disk Brakes,

which

Quoted message said:

Quoted message said:

was caught and killed by my antivirus. It came via my [email hidden] address, which is
only used for newsgroups.

Time to update and scan, folks, especially with this Lovesan bug going around.

And let us not forget the worm that exploits an RPC leak.

anybody happen to have a process running called msblast? how about unexplained restarts?

bigblackglasses.comArticle.aspxOpen ↗

i just got over a hit from it last night on two of my workstations. cleaver little worm. without
network/internet isolation, it is nearly impossible to stop it long enough to patch the system.

I actually found the challenge quite entertaining. while doing research online about it, it
restarted my internet gateway system 50something times. at least it was nice enough to give me a
minute to bookmark the pages i was reading.

and BTW, i was running the XP Internet Connection Firewall at the time. guess it doesn't work as
good as MS thinks it does. i lost my copy of ZoneAlarm Pro so the ICF will have to suffice for
now (with the addition of the patch).
--
~Travis

megalink.net~farmersOpen ↗

while it is shutting the system down does it give a window stating something about remote
procedure or something? If so then I think a friend of mine has
it.

that would be the one. the worm name may be different, but the leak in the RPC service is the same.
have your friend download the patch (there is a link to the M$ website for the patch within that
other link i gave).
--
~Travis

megalink.net~farmersOpen ↗

bomba <[email hidden]> wrote in message news:<[email hidden]>...

Quoted message said:

M&M said:

symantec.comsymantec.comOpen ↗ They have the removal tool .

Which is fine if you already have the virus, but will not prevent you from getting infected in the
first place. Prevention is always best, so for those of you with XP or W2k, get the RPC patch from
the M$ website

bomba - who's spent all day helping the LAN admin to cure the network...

Got it on my most recent XP update patch ( tonight ) . Double checked on the M$ site and the patch
is already in my system .

M&M