Help me - I have a worm

I'm on my family's computer right now - because My own comp has a fucking virus in it - how i dunno, but its there and what it does is if my comp is online (which it is near always due to cable modem) it shuts it down automatically - it gives me this little window and begins a countdown timer of 50 seconds.... So I did take the comp off line and the countdown timer didn't appear... but once plugged the cable modem up again the timer appeared again and my system rebooted again.

i've tried to run my Norton anti-virus software and it gets as far as detecting 4 infected files in my documents and settings folder and then all of a sudden Norton immediately shuts off.

Any help would be greatly appreciated - my last option is a reformat of that hard drive (I assume that'd take care of it)

whats the name of the virus that norton detects?

http://securityresponse.symantec.com...oval.tool.html

See if that helps.

You might also want to boot it with the network disconnected, maybe it won't get the signal to shut down if it's a remote thing. Check in Start > Programs > Startup for any suspicious programs, delete the ones that look like they shouldn't be there. Run msconfig and look on the Startup tab for the same stuff. Also open Task Manager (or ctrl-alt-del if you're on Win9x) and check for suspicious processes, then end them.

I didn't manage to see what the name of the virus was - like i said norton cuts off after a couple seconds into the system scan.

Lhadhatt - I'll try the link you gave me and check the other processes and see how it goes - do you think that is what I have? Has anyone heard of a similiar problem?

I searched for the "remote procedure call" thing you told me in IM, and that's one of the results. Not sure if it's what you have, but it's worth a shot.

You can scan with Norton over a Network. As long as the family comp is protected (with Norton, and your comp doesn't have write access to the fam comp), you should have no probs with Norton shutting down in the middle of things.
If that doesn't work, well, I'm sure we can find more solutions :)

EDIT:
Could you just follow what the symantec zap/kill app does and do it manually? It shouldn't be anything too difficult... although once the virus is loaded in memory it isn't so cool, at least you might be able to do enough to stem the tide so to speak.

i'm going to basically shut down system restore - then go after the virus/worm with the tool provided and check everything in that system - if all else fails argh .... well we'll come to that.

VIRUSES SUCK!

i have that remote procedure problem that started the other night. its pissing me off. i asked at sharkyextreme and thought i fixed it but its still happening. theres people there having the same problem. id really hate to reformat again.

If it's what I think it is, then this will help. You are going to have to be quick though. Does the message pop up about something with the nt authority?? There is apparently some kind of wierd error with windows xp/nt/2000 operating systems that allows people to hack into your system. My brother had the same problem. Goto this site

http://microsoft.com/technet/treevie...n/MS03-026.asp

download the corresponding patch and you should be good to go!!

holly shit.. i have the same promblem i have 23 seconds before it shutsdown again.. shit
9,.,.

Here is the article that I read about it:

A few times a message has appeared on my screen suddenly telling me that NT AUTHORITY/SYSTEM was going to shut down my PC. All you can do is save your work and basically take it like a man unforunately and let your computer reboot.

This is a security flaw in Microsoft Windows, mainly NT/XP/Server.
If you see this message you should install Windows updates as soon as possible. There is basically someone out there sending data to your PC causing this to happen.




Advisory Warning to all users of the following operating systems:

Microsoft Windows NT 4.0
Microsoft Windows NT 4.0 Terminal Services Edition
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003

Your Microsoft Operating System may potentially be under attack by HACKER ACTIVITY. The vulnerability attack can fool software into accepting insecure commands that could let intruders steal data, delete files or eavesdrop on e-mails.

Due to the seriousness of this vulnerability the Department of Homeland Security and Microsoft encourages system administrators and computer owners to update vulnerable versions of Microsoft Windows operating systems as soon as possible.

Our recommendation is to please go to:

http://microsoft.com/technet/treevi...in/MS03-026.asp to install the patch immediately.

i got that patch. didnt help.

Do you get that message about the NT Authority?

I got that message about NT authority as well - thats what it said (in my haste i couldn't remember what he bloody window pop up said) .... I hate to see others going thru this but at least i know now i'm not alone. I'll try that stuff Abobo - thanks man, lets hope it works - i'm too will HATE to reformat.

Edit - i tried the tool fix that Lhadhatt gave me and the process interuppts all the time in the middle of its procudures - and I tried examining my system process but the fucking virus/worm interuppts that too and cuts it off with no warning - g'damn.

Well as I said, my brother had the same problem today. He called me up at work, I found the patch and he installed it and everything seems to be working fine.

Abobo - couple questions -

1.) will the patch work on already infected systems?

2.) didn't the worm interfere with the patching process?

My gf has it all of a sudden, too.

I mean, it seems like a pretty widespread thing

this sucks

dragonmaster - did you disable system restore before you implemented the patch? that might work

/me doesn't have it but hits up WindowsUpdate anyway

More complete instructions: http://securityresponse.symantec.com...ster.worm.html

unfortunatley all the attempts made by me to fix the problem were unsuccessful - i'm going to have to reformat... oh what fun (if my hard drive crashes during reformatting i'm going to go mental - so be prepared everyone :p )

Whomever the person or persons are that are responsible for this sort of thing... I don't know whats the point - is it to exploit MS's mistakes or simply harrass people? I paid for (and am still paying for) that PC they infected - its fucking mine and althought it may be a rash comparison, to me the shit they pull is akin to them walking in my room and destroying my PC with a bat. In that situation, I'd go absolutely apeshit mental on their asses and beat them to near death - there would be blood, tons of it. But since this is coming from an attacker I can't see, can't do such pleasurable things.

How many of you guys had to reformatt today?

Well, I'm going to give the patch at lsd-pl.net a try, first, before going the whole nine and having her reformat. . . Did you try that station82o?

Sounds like you got fucked. Sorry to hear it.

are you guys posting on the forums using a second computer? if not - how are you able to be online and not have the timer go off on you?


well i'm through messing about and I'm just going to reformat the hard drive. Tons of stuff lost... i guess this is my wakeup call to constantly back my stuff up now. Argh - screw you wake up call.

If somebody is trying to use RPC to fuck with you, get a firewall. I have a nice small one, called AtGuard, that you can probably still find online. Essentially block off any windows application that talks with the internet, minus obvious ones you don't want blocked like your web browser, IM and email clients, and see what the ruleassistant tells you.

Like Zone Alarm then... when you get this fixed, station, I suggest downloading it. It's free. I scane with anti-virus and updated and patched today so I think I'm clear, I'm pumping up my firewall security too.

hey thanks for your guys.. help.. so far so good after the patch.. the way i was online. i was constently restarting..i had 50 seconds or so to download, and then install.

my comp does it now too. FUCK. Whats the patch do? Does it work? Its odd that the comp only restarts when your online.

It only happens when you're online because it's a peice of malicious code thats telling your pc to shutdown. If your not online, it can't get to your machine.

Because of a microsoft vunerability, "hackers" can talk to your comp via port 130 and trigger the shutdown.


Check out the links posted above to learn more.

I should be fixed now. I updated my Nortan too. It did find a virus named msblast. I couldnt get rid of it. Any ideas? I know that this is from the worm thing.

I had this happen earlier today, and it took several frantic attempts before the computer shut down to find the patch and install it. It would have never happened, but last night I set up a DMZ host to see if that would allow me to connect to battle.net. After I installed the patch, everything was back to normal. I promptly installed the patch on the 2 other computers on the network and I haven't had any trouble since.

The virus comes through port 135 via RPC. If you don't run firewall software, get some. I know a lot of people like Zone Alarm. I prefer Sygate Personal Firewall:
http://downloads-zdnet.com.com/3000-...ml?tag=lst-0-1

If you haven't been hit, run Windows update and apply the patch (or go to the link Abobo posted to get just the one fix). This worm is just the start of this. I can see something along the lines of the SQL Slammer or worse coming in the near future if people don't get their machines patched (and they won't cause they won't know how). I also found out that just because you're not on a broadband connection, doesn't mean you can't get the worm. One of my extremely computer illiterate users (a regional sales guy, works from home) got it, and the only way he connects to the net is via AT&T Global Dialer.

If you plan to do the format, instead of doing it through the installation disk, you're best off making a boot floppy so you can access dos directly. Then from there, remember which number your harddrive was and type format so you'll have a clean erase.

Best thing to do for saving your data is have an extra harddrive handy for putting junk on so you can put in your stuff like videos, pics, gamesaves (very important unless you want to work though all that again, plus re-downloading from gamespy sucks!), porn etc etc. There's some 2.5gig harddrives you can hook into USB if you want the cheap route, they sell for $35 last time I checked.

http://www.sarc.com/avcenter/venc/da...ster.worm.html could help you out. Also, Scott Keith's Raw Rant on 411mania has a lot of info on this. http://www.411mania.com/wrestling/tv...eports_id=1248

just to answer some questions directed to me. i never have system restore on in the first place. i find it useless and takes up space. also yes i got the NT error, and finally i applied the patch like it says and i still get the error. eh......what a waste this is.

finally - things are going ok, it was really my own fault (well.. the worm wasn't) but my stupid lack of security was no one's fault but my own. I got a firewall enabled now and things are ok.... thanks to the people on this thread and extra special fucken thanks to both Lhadhatt and Tracer - and a shout out to LiFOR - they helped me bigtime today.

Heres to hoping someone kills the bastard that started all this crap.

Can I just say here that I love each and every one of you posting on this thread? My PC just started doing this yesterday and I've been ready to throw it through the window and laugh maniacally as it hits the pavement below. I now have a way to track things down and fix it, if I'm lucky, so you better all believe I'm a lot happier now than I was 10 minutes ago.

I'm writing this on a friend's PC right now. Old and slow and it doesn't shut down 2 minutes after booting.

James

firewall and dmz - make sure the dmz is disabled

also - check your ports at www.grc.com

Thank you guys for posting the patch. I thought it seriously I thought it was my shitty Dell, or my sister's chronic Kazaa binges fucking up the system.

hmm crap my comp is infected...

trying out the windows update patch.

how did it go james?

How do you know if you have 32 or 64 bit XP?

^ Unless you have an Itanium or whatever the new Intel chip is called, you have the 32bit.

By the way, I installed the patch off MSFT's website and then deleted the file C:\Windows\System32\MSBlast.exe and everything was fine again.

Here is the answer, please read the thread:
Firewalls will work, sure. HOWEVER, the PATCH for this whole mess is at: http://lsd-pl.net

Everyone: Please install this patch if you are running XP, 2000, or NT4. Please inform any friends and family that may be running those operating systems to install the patch. This thing will only get worse, and I can guarantee you that a nastier variation will come out sooner rather than later.

/me waits for CKA to come in and mention his "manly" OS, BSD...

Thanks Abobo! I was having the same problem too, & that patch fixed it right up. You are a life saver!

JM

My PC was infected with this damn worm yesterday. It added the "msblast" worm to my pc and I couldn't figure out what it was. Whats worse was that once I went online it would trigger the RPC/NT Authority error just 2 minutes thus rendering any download of a patch fruitless. So I just received the patch from a friend on disk and reformatted my pc and installed the patch. So far so good.

This morning all the news channels mentioned this worm. Three of my friends had this crap yesterday too...its spreading like wildfire.

Here's an article regarding "msblast" from cnet:

worm article

we were not alone definitley - here's an article from cnn.com

http://www.cnn.com/2003/TECH/interne....ap/index.html

Now i'm going to go reward myself and buy the futurama box set season 2 *loud frank costanza voice* "What do you think about that?!"

Three quickies:

1) The RPC update should be on Windows Update. PLEASE make sure your system is current on all patches. Also run a firewall if you can; XP comes with one, and you can download free ones like Zone Alarm.

2) If you're experiencing the system reboot cycle, you CAN stop it; in the space of time you're given when the warning comes up, go to Start -> Programs -> Accessories -> Command Prompt (or Start -> Run), and run "shutdown -a now". That should stop the shutdown sequence.

3) If you are infected, you can get a cleanup tool from http://securityresponse.symantec.com...oval.tool.html . I've already had to use the tool on one laptop, and it worked fine.

Hope this helps...

Or, you can go to Start--->Settings-->Control Panel-->Administrative Tools-->Services - double click the Remote Procedure Call and change what it does when service fails. You can't access a lot of ish when the service is down (Hotmail, and a few sites, for instance), but you can download the patch in peace. If you have a problems accessing patch sites with RPC disabled, turn RPC on, bookmark the site, restart, then disable RPC and go to the bookmark.

Thanks DB. Didn't know about that shutdown command. So far only one user in my company has been hit, out of 110 people, so that's pretty good. We patched all of our servers and desktops when the patch was first released. One of our vendors (starts with Nor, ends with Tel) is down for the day due to this thing.

A little thing about formatting in response to voltz:

Formatting through a DOS disk will only get you FAT32 at best. If you're on XP/2000/NT4, this is inefficient -- NTFS is the OS's native file system and it gives you more options, better security, etc. Sure, you can convert it later, but it's best to just format it as NTFS through the Windows Setup routine via booting from the Windows CD.

About network games, battle.net and so forth:

You don't have to enable DMZ for this. Figure out what ports the game is using and enable those on your router/firewall. Use port forwarding, port triggering, whatever works. I tend to use port triggering, which opens up the port to a specific IP as it's being requested.

This method also works for things like Direct Connect, transferring files over IM programs and anything else that needs a non-standard port.

Hmmmm...any idea if this thing could affect Xboxes? Asides from the port 135 scans, I mean. It's running a stripped version of the Win2K kernel, so it's possible they left RPC in there to handle some of the Live stuff. I doubt the worm could do anything due to the differences between the XBOS and Windows, but it makes you wonder. :)

anyone know if zone alarm is free anymore - i checked the site and couldn't see a mention of it now.... :(

oh well - my setup is fine right now, i hope everyone else here works their stuff out.

Quote:

---

Originally Posted by Wolffen

Hmmmm...any idea if this thing could affect Xboxes? Asides from the port 135 scans, I mean. It's running a stripped version of the Win2K kernel, so it's possible they left RPC in there to handle some of the Live stuff. I doubt the worm could do anything due to the differences between the XBOS and Windows, but it makes you wonder. :)

---

Don't give them ideas!

Station, check out the link to Sygate Personal Firewall (or do a search on hotfiles.com for it) that I posted earlier in the thread. It's free and great.

Brisco: :evil:

Unreleated link, except for the Microsoft part that I had to post: http://www.cs.usm.maine.edu/~mccann/macys/

I gotta thanks everyone on this thread. This shit happened to my borother today and he was freaking out, I wouldn't of been able to help him if it were not for you guys. Thanks.

Oh, and he got it off of dial up; so I would recomend everyone get that patch.

I have my router firewall's DMZ disabled, ports stealthed and good anti-virus software (www.grisoft.com) and Adaware running on my systems now - anyone have any additonal suggestions for system security?

Yes. Turn it off. :D

Quote:

---

Originally Posted by negitoro

^ Unless you have an Itanium or whatever the new Intel chip is called, you have the 32bit.

By the way, I installed the patch off MSFT's website and then deleted the file C:\Windows\System32\MSBlast.exe and everything was fine again.

---

I donwloaded the patch and it has stopped that BS of shuting down, but Norton keps telling me the virus is there. Do i need to delet that file MSBlast.exe, or is that needed?

There's a removal tool as well. Go to slashdot, they've got what you need.:)

Well, having a worm is probably better than having the clap or somesuch...

http://msn.com.com/2251-1110-5062637...subj=ns&tag=ab

"'The 'time bomb' in the worm's code, discovered by anti-virus and security researchers, will turn every infected system into a DoS agent on August 16, this Saturday. The systems will begin sending random strings of data to the windowsupdate.com Web site in an attempt to knock it offline. If the DoS attack is successful, administrators will be unable to patch their systems against the vulnerability exploited by MSBlast."


I suppose this wont be a problem if you've done what you're supposed to - stealth 135 and all other ports and have installed the patch and installed symantec's tool and done virus scans.

I got some warnings on my firewall..and when I clicked on "search for location" of where its coming from and it says its coming from my area.

so its coming from your system? perhaps the elements of the worm are still in your system - you should run that fix that symantec posted on their site (i think the link is in jeremy's post on page two).

Quote:

---

Originally Posted by station82o

so its coming from your system? perhaps the elements of the worm are still in your system - you should run that fix that symantec posted on their site (i think the link is in jeremy's post on page two).

---

But its coming in..not going out. I dont nor ever did have the countdown timer.

But I did notice that when I go to Windows Update, it takes forever to load

Hmm..the windows update seems to be working now..but after I scanned for updates..there are none!

Here's two other ways to solve the worm problem:

http://www.calliander.net/images/wor...tion_thumb.jpgYeah, that's 10.2.6 Server.

http://www.calliander.net/images/oth...tion_thumb.jpgThe worm doesn't affect WinME.

I think you can clear the virus using Housecall, by TrendMicro.