Help me - I have a worm

[Wolffen]

Thanks DB. Didn't know about that shutdown command. So far only one user in my company has been hit, out of 110 people, so that's pretty good. We patched all of our servers and desktops when the patch was first released. One of our vendors (starts with Nor, ends with Tel) is down for the day due to this thing.

[Lhadatt]

A little thing about formatting in response to voltz:

Formatting through a DOS disk will only get you FAT32 at best. If you're on XP/2000/NT4, this is inefficient -- NTFS is the OS's native file system and it gives you more options, better security, etc. Sure, you can convert it later, but it's best to just format it as NTFS through the Windows Setup routine via booting from the Windows CD.

About network games, battle.net and so forth:

You don't have to enable DMZ for this. Figure out what ports the game is using and enable those on your router/firewall. Use port forwarding, port triggering, whatever works. I tend to use port triggering, which opens up the port to a specific IP as it's being requested.

This method also works for things like Direct Connect, transferring files over IM programs and anything else that needs a non-standard port.

[Wolffen]

Hmmmm...any idea if this thing could affect Xboxes? Asides from the port 135 scans, I mean. It's running a stripped version of the Win2K kernel, so it's possible they left RPC in there to handle some of the Live stuff. I doubt the worm could do anything due to the differences between the XBOS and Windows, but it makes you wonder.

[station82o]

anyone know if zone alarm is free anymore - i checked the site and couldn't see a mention of it now....

oh well - my setup is fine right now, i hope everyone else here works their stuff out.

[Brisco Bold]

Hmmmm...any idea if this thing could affect Xboxes? Asides from the port 135 scans, I mean. It's running a stripped version of the Win2K kernel, so it's possible they left RPC in there to handle some of the Live stuff. I doubt the worm could do anything due to the differences between the XBOS and Windows, but it makes you wonder.

Don't give them ideas!

[Wolffen]

Station, check out the link to Sygate Personal Firewall (or do a search on hotfiles.com for it) that I posted earlier in the thread. It's free and great.

Brisco:

Unreleated link, except for the Microsoft part that I had to post: http://www.cs.usm.maine.edu/~mccann/macys/

[NoboruWataya]

I gotta thanks everyone on this thread. This shit happened to my borother today and he was freaking out, I wouldn't of been able to help him if it were not for you guys. Thanks.

Oh, and he got it off of dial up; so I would recomend everyone get that patch.

[station82o]

I have my router firewall's DMZ disabled, ports stealthed and good anti-virus software (www.grisoft.com) and Adaware running on my systems now - anyone have any additonal suggestions for system security?

[Lhadatt]

Yes. Turn it off.

[DarkCrow676]

^ Unless you have an Itanium or whatever the new Intel chip is called, you have the 32bit.

By the way, I installed the patch off MSFT's website and then deleted the file CWindows\System32\MSBlast.exe and everything was fine again.

I donwloaded the patch and it has stopped that BS of shuting down, but Norton keps telling me the virus is there. Do i need to delet that file MSBlast.exe, or is that needed?