The new internet virus....nasty one

[GrayRage]

If u run Windows XP run this:

http://download.microsoft.com/download/9/8/b/98bcfad8-afbc-458f-aaee-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe


Then run this:

http://securityresponse.symantec.com/avcenter/FixBlast.exe


If u don't and u get this fucker, it will shut down the RPC process which will then give u 60 seconds before it shuts down yer puter. Real pain in the ass. Run this stuff before u get it if possible, if not lemee kno0w I will tell u how to temporily disable some stuff so it won;t do it until u can clean yer shitz.

[Xondio]

To disable RPC (Remote procedure call)

Go to run

Put in: Services.msc

Scroll down to RPC (not the manager) and right click then click properties


Then click on recovery tab and highlight don't take any action.



I had this virus and already knew how to fix it, but its a pain in the ass. I hope whoever made it is fucking skinned alive.

[GrayRage]

Well, I am sure Xondio does not mean "disable" RPC...cause u cannot run windows without it ;p Worry not thio, i don;t think u have the option of disabling it anyhow.

What this virus does is shut down the 3rd SVCHost.exe which seems to be the RPC service. I am not certain how it does it other then it's started when u go online. Seems to use msblast.exe to do it's dirty work tho.


In any case, if you HAVE it already, u need to do the following:

1. Don't get online.
2. Start menu
3. run
4. Type "msconfig"
5. Hit enter
6. Select the start up tab
7. Turn everything off. (u should have this crap unchecked anyhow)

You will notice the msblast.exe and another thing there that's not supposed to be there. Doing this is a TEMPORARY FIX. It gives u enough time to prolly download the stuff I put in my first post and actually clean your system of this fucker. If u don;t get the patch and clean the virus, u will get it again...and it does not take long.

[Xondio]

Oh i didn't mean disable it, i ment to disable the restarting of it.


When you click on the recovery tab it has highlighted restart computer in 60 seconds... if you click on the tab and click take no action it wont restart your computer

[Daero]

I had this shit and it was pissing me off but I updated through Windows and ran that worm thing and all better. Hooray.

Daero

[Hamadryad]

I had this....when I got back after the shutdown I did a complete virus scan and nothing turned up (my definitions are up to date) and then I remembered I had put off that windows security update :p So I did that, and nothing bad has happened since...I'm just kinda assuming that the problem is gone!

Whatever it did though it messed something up, now I am missing a file that windows looks for every time I start up. The file is...TFTP3244, doesn't have an extention. I get the same "missing file" error every time. I've always been careful with downloads and keeping my anti virus up to date, I'm ill equipped to deal with this

[Hamadryad]

Okay checked msconfig...there is no msblast or whatever the virus is called. However the TFTP3244 is in the list of files/programs to load on startup. I unchecked it. /shrug

[GrayRage]

That should have fixed your problem. The windows update kinda fixes it but does not remove it. The second link removes the crap. Run it if u have any doubts it won't hurt anything.

U don;t need anything checked in startup...all that stuff does is AUTO load when u start windows....if u need a program running u can just start it yourself. That's why i keep that crap off. Much of it is just memory hog stuff. Lots of services u don;t need to run too which take alot of memory.

http://www.blackviper.com is a good place to read about this stuff.

[Xondio]

yeah, i don't have anything checked in MSCONFIG... i don't like programs running in the background if I don't have to have them.

[Hamadryad]

Cool :) I fixed the computers at work too, hehe

[Xondio]

to prevent anything else like this happening again... go to

1) Control Panel
2) then Network Connections
3) Right click on the only connection there, then click advanced tab
4) Checkmark the box that says internet connection firewall (it's a built-in firewall for XP)

[Hamadryad]

Windows firewall wont help you much :\ It's like the crappiest of the crap as firewalls go. If you want something decent you need to get zone-alarm. I had zone-alarm for awhile but lacked the patience to set it up properly.

[Danubi]

Teh hama is back woot woot... RHAINY come join us plz :D

good to see you again hama, how are u doing? sleeping around when u get to much to drink etc? or just the nice little school girl as before?

[Xondio]

i like school girls .... ....

but yeah hama, i agree it's a pretty shitty firewall, but hey it gets (part) of the job done... zone-alarm is the best one out there by far

[Danubi]

Zonealarm>all