Computer Virus Alerts

pls select the product who has a good support and very common for many people ... and off course user friendly ...

based on my experience ... mc afee has a good support and more stable than norton ... just my opinion ....

brian_brian wrote:pls select the product who has a good support and very common for many people ... and off course user friendly ...

based on my experience ... mc afee has a good support and more stable than norton ... just my opinion ....

Dunno if PC-cillin has that...my bro installed it for me...I will ask him about it when he wakes up! ;)

I was speaking to friend on IM on monday and she started getting the countdown. Lucikly at the same time I was in a IRC chatroom where someone else was having the same problem.

They downloaded the patch and it stopped the problem. I installed the patch on my machine just in case.

But my friend is only on 56k so she would not have time to download the patch - so I have posted it to her on a cd :)

After looking for details about the virus, I have found out that infected machines will try to attack the microsoft update website (a Denial of service attack) on friday the 15th of agust and then ever day after

So the virus is using windows to attack microsoft

Ok I have the problem also, or I had it ???
I downloaded the patch from Mircosoft :
http://microsoft.com/technet/treevi...in/MS03-026.asp

(Make sure you download the right language version)
After I installed it I restarted my PC, now it seems back to normal, but the msblast.exe file is still in the Windows\System32 folder!!! And I can't delete it!!
Can someone tell me how to delete this file?

Evilryu wrote:Ok I have the problem also, or I had it ???
I downloaded the patch from Mircosoft :
http://microsoft.com/technet/treevi...in/MS03-026.asp

(Make sure you download the right language version)
After I installed it I restarted my PC, now it seems back to normal, but the msblast.exe file is still in the Windows\System32 folder!!! And I can't delete it!!
Can someone tell me how to delete this file?

Have you got antivirus software installed? such as Norton, McAfee, Norman etc. The antivirus softwares should be able to remove the worm. if you don't have, try the followin links:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

http://www.f-secure.com/v-descs/msblast.shtml

Download the removin tool. run it and follow the procedure!

Th reason you can't delete it is because its loaded into memory - the removal tool should get round that - reboot before and after though

Got Norton and Zone Alarm. My isp has blocked the ports 135, 139 and 445 for the time being. The worm is not able to spread thruout our network.

arghz...!! just one stupid virus made everyone so irritated with the computer.. but just be careful lohz.. pass the news around if anyone finds another..

kook05

daijoubu! Arigatou! :sweat:

MSBlaster worm spreading rapidly
By John Leyden
Posted: 12/08/2003 at 09:17 GMT


A worm that exploits a critical Remote Procedure Call (RPC) flaw to infect vulnerable Windows machines is spreading rapidly across the Internet this morning.

Although serious, the effects of the MSBlaster worm are expected to be less than that caused by the infamous Nimda worm.

The MSBlaster worm, also known as Lovsan, Blaster or Poza and which began spreading yesterday, is programmed launch an attack against windowsupdate.com on 16 August.

Microsoft last month issued a patch to guard against the problem but uptake has been predictably slow, allowing malicious code writers to come up with software that is having a severe effect on many users.

Mac, Linux and Unix computers are immune to this Microsoft-specific vulnerability.

According to a preliminary analysis of the worm by F-Secure, the worm spreads in a 6176 byte executable named MSBLAST.EXE to Windows 2000 and Windows XP systems unless recent Windows security patches have been applied. Windows NT 4 and Windows 2003 might also be affected but these systems appear to be playing a lesser role in the spread of the worm.

The worm launches a command shell and uses TFTP to connect to other infected systems to download the worm's executable. MSBlaster will scan addresses in the Internet to locate vulnerable Windows machines using TCP/TDP port 135. Once found, it will copy itself over and modify the system so the worm will be executed every time the machine is started. The worm will keep on replicating from every infected machine.

Unsuccessful propagation attempts may crash vulnerable computers, or render them unstable. Successful worm outbreaks are causing localised network latency.



Try Symantec
http://securityresponse.symantec .com/avcenter/venc/data/w32.blas ter.worm.removal.tool.html

Microsoft

Download for Windows 2000 from www.microsoft.com:
http://www.f-secure.com/dl-w2k/

Download for Windows XP from www.microsoft.com:
http://www.f-secure.com/dl-wxp/

however, the removal tool doesn't work. got problem. but as long as u dun log on net u wun hv to reboot. if u wanna log on net. click on control alt delete then go processes. look for msblast. disable it, then go internet.. tts to bypass the reboot thingy

Evilryu wrote:Ok I have the problem also, or I had it ???
I downloaded the patch from Mircosoft :
http://microsoft.com/technet/treevi...in/MS03-026.asp

(Make sure you download the right language version)
After I installed it I restarted my PC, now it seems back to normal, but the msblast.exe file is still in the Windows\System32 folder!!! And I can't delete it!!
Can someone tell me how to delete this file?

one more way to get rid of it is editing your comp registry....
i'm not sure of the steps... but you can check out techsupport forums for the step by step way to do it....

so i was wondering,is it better to just not go online tomorrow ,even if you have dl the safety patch?

valle wrote:so i was wondering,is it better to just not go online tomorrow ,even if you have dl the safety patch?

It should be safe as long as you have the ports 135, 139 and 445 blocked!

It is shocking that people are using the patch but not removing the virus

Using the patch is good but you should remove the virus first - stop it spreading!

The patch does not remove the virus!

sephy1024 wrote:It is shocking that people are using the patch but not removing the virus

Using the patch is good but you should remove the virus first - stop it spreading!

The patch does not remove the virus!

we don't have the virus,we have no probs and all works normal,we just dl it to be safe...it's better to prevent
but does the patch protects against the virus or something?*sigh*,on moments like this i wish we'd know more about pc and stuff :(

It should be safe as long as you have the ports 135, 139 and 445 blocked!

not to sound dumb but i and some others have no idea how block ports :( :shakehead: :sweat:

:shakehead:

My trusty Zone Alarm firewall has been blockin intrusion attempts from ICMP (type:8/subsystem:0) for the past 4-5 days, a port scanner which is lookin for open ports to attack. Around 1000 intrusion times is blocked from the same trojan per day. I've have heard it's one of the trojan horse attacks goin around the net! Ppl who don't have fw installed, go install now! Protect yourself from the threat! Remember to run a virus scan as well!

shiakz
that idiot worm just attacked me few dayz ago...
i have to use this removing tool n stuff
troublesome!!!
arghhh
:angry:

lots of com viruses going about these days.. now my email account seems attacked.. :shakehead:

Oh my god...i thought i was alone in this too! I've been suffering from this for like 2 weeks. While i'm surfing or downloading songs...my PC screen suddenly freeze and the worst part is, i can't even shut down!
And yes, i kept getting the the 'shutdown alert' crap warnings at times!
And my browsers download very very slow too.
My e-mails have been attacked by the Klez.Worm virus. I get like 10 annonymous e-mails EVERYDAY but luckily my Norton Anti-Virus have detected them and they were sent under quarantined for repair.

This is sooo sickening! It slower down my PC connection every minute. I'm using Windows 98 still btw. :mad: I'm still so helpless and not knowing what to do already. I spent almost SGD $400 for my PV coz it was attacked by the 'Melissa virus' last year. 3000 files in my drives were corrupted.
:shakehead: I don't think i can afford to have another repair and even worst, buy a new computer. Besides, i'm such a dumba$$ when comes to computers. :sweat:

Somebody help me?!? :(