Internet Worm Plaguing Computers Worldwide

Washington Post ^ | Brian Krebs

[WaterDragon]

A fast-spreading Internet worm infecting more than a million computers worldwide forced the Maryland Motor Vehicle Administration to shut its offices for the day and is causing problems for other computer networks in the Washington region. The worm, dubbed "Blaster" by security experts, is having a "sporadic" effect on federal agency networks, said a spokesman for the U.S. Department of Homeland Security......(snip) [Article is long but good]

[6ppc]

If you are running XP or 2000 you had to set up an administrator account when you first installed the OS (or turned on the computer when it was new). With XP you may have fast user switching turned on, so I don't think it matters.

[King Prout]

while I'm at it, is there a patch for Win98? The internet-capable computers at the ofice use 98, and there doesn't seem to be a link for it on the Blaster patch page.

[Flyer]

We are going to have a good gloat the day someone cares enough to create a worm or virus that hits Macs and Linux.

[Diddle E. Squat]

The guy who started that thread suckered you into taking it?

[Light Speed]

Thanks for your info.
I lost my Windows xp Yesterday..RPC sent the comp into shutdown really fast.
I phoned a tech at my DSL centre...he explained how to disable the RPC..then go get the patch.

*** also found out that disconnecting the DSL..gets you time to go to Run off start type in services.msc. find RPC call in the ledger < double click...then click on recovery...change all the RPC fields to..{take no action)

after ..was able to plug the DSL back in..go get the patch..then go back..follow the same service.msc route..change the fields in RPC to [restart the service]

Stomp that Worm : )

[King Prout]

kewl.
*doing ctrl-alt-del*
Not on the machies at work.
*whew*

[Howlin]

Wow.....what kind of computer is it??

[bluesagewoman]

[David1]

Before it shut down and rebooted itself, did it always happen to say something like "Remote Procedure Call" has unexpectedly terminated? Because if it did, then you had the same problem I had yesterday. My computer rebooted like 15 times and each time i got a message giving me about a minute to save everything saying that "Remote Procedure Call" unexpectedly terminated. I called my uncle and he told me it may be a hacker using an outside computer to get into my computer. So he told me to download zonealarm.com (free version). Let me tell you that zonealarm really worked and stopped the rebooting. But after reading about this worm story and your story, I now wonder that it may not have been some hacker but this internet worm that affected many computers yesterday.

[David1]

What is msblast.exe???

Read more about what happened to my computer yesterday here: http://www.freerepublic.com/focus/f-news/962892/posts?page=69#69

I think I do have msblast because it shows up in the program section of the zonealarm I downloaded yesterday. So I am wondering what is it that this msblast thing do.

[philetus]

Why pay Norton for a 2nd rate firewall when Zone Alarm is free?

[Howlin]

Get the patch:

http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

And update your virus software.

[Preech1]

No patch for Windows 98 on the website...is it not affected>?

[King Prout]

If that ain't a patch for windows 98, I cannot use it here at the office. Is it?
*checking*
Nope, that's the XP patch. Will it do anything useful for Win98?

I've already downloaded the 2k patch and mailed it to my home machine. I'll install it when I get home.

[Howlin]

http://www.freerepublic.com/focus/f-news/962206/posts?page=78#78

[Howlin]

I'm not positive, but I believe this is limited to Windows XP, ME, 2000, and some NT.

Do NOT quote ME on that. :-)

[Terpfen]

Because neither Norton's or Zone Alarm will do much against determined people. Get a hardware firewall.

[King Prout]

content for the moment to cross fingers and pray ==> me

[justshe]

Well now......this is interesting.

I did a "edit-find" on my registry for msblast.exe.....and I have the same type of entries as Raybob...only instead of a--b--c-- the entries are listed as:

ab 000 REG SZ (value not set)
ab 001 REG SZ wuaumgr.exe
ab 002 REG SZ explored.exe
ab 002 REG SZ msblast.exe
etc.

BUT.....the REALLY INTERESTING THING TO ME IS.....this is AFTER I have downloaded the Symantec FIX-IT tool and run it.....and have installed the MS Patch. AND Symantec tells me I don't have this file on my system.

What do you make of THAT?

[Preech1]

I found the same thing in my registry AFTER running the patch as well...