MSBlast Worm

[raiden]

Did you get the RPC worm on Windows?

Edited August 15, 2003 by Guest

[Iggy]

WTF IS RPC TARD!?

[dark_vegeta2003]

What is that worm?

[xerox]

its MS.BLAST.A aka w32.blaster

[dark_vegeta2003]

know i know it!

The blaster worm.

there is a removal tool here http://www.microsoft.com/security/incident/blast.asp

or http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

[MAD_BOY]

yes, but i used the removal

[dark_vegeta2003]

I am lucky!

The remove tool din't found the virus

[Iggy]

evil_shady said that there was a virus that shut down every single xp computer that was on a few days ago...i dunno t o believe him but i did admit the my computer did just shut off for some wierd reason, anyways, I DONT HAVE WINDOWS

[raiden]

That would be RPC, XP and 2000 systems shut down every 60 seconds.

[petebog]

evil_shady said that there was a virus that shut down every single xp computer that was on a few days ago...

That would be one hell of a virus! Every XP machine?

Or just the ones owned by dumb people without firewalls and anti-virus software...

[raiden]

Not all XP systems, just some. And I had a router and firewall and still got it.

[petebog]

Not all XP systems, just some. And I had a router and firewall and still got it.

I know that not all Xp systems were affected, I was just poking a gentle bit of fun at Iggy's mate.

BTW a router does nothing to protect you from worms and viruses unless it specifically claims to include protection, e.g. built-in firewall.

The most important thing to protect against viruses and worms is up to date anti-virus software, I notice you didn't say if you had any.

[raiden]

It has a built in firewall and I've never had anti-virus software, seem to do just fine not catching viruses usually. RPC is the first one I've caught in a long time.

[Iggy]

i have norton firewall

[petebog]

I've never had anti-virus software, seem to do just fine not catching viruses usually. RPC is the first one I've caught in a long time.

Please don't take this as a personal attack, but that is a very ignorant and selfish attitude to have. How do you know you haven't been infected in a long time if you don't have a scanner?

For all you know your machine could be riddled with viruses that have been spreading to every other PC you come into contact with, just biding their time till their activation date. If everybody ran up to date anti-virus software it would stop 90% of viruses dead in their tracks and we wouldn't have these big virus scares...

I know that viruses are not really as common as many people believe, but the potential risks far outweigh the minimal effort involved in downloading free anti-virus software and keeping it regularly updated.

I repeat, this is not a flame, just some very important advice to everyone who thinks they don't need a virus scanner.

[Kent747]

umm a router IS a firewall...

hence having to forward ports to get things to work...

[[xNet]DrDre]

first of all raiden, cant believe noones corrected you on this, this isnt called a "RPC Worm", RPC is a service on your pc, and theres an exploit in it, another person copied and made W32.Randex, another worm that uses the RPC exploit, but it isnt as bad.

But MSBlast does the following

Sends itself to other people, and RPC has a system shutdown feature if an error happens in the service(RPC is not a virus, its windows software). if RPC crashes, its told to reboot pc, so the Worm itself isnt shutting down the pc, the worms causing errors in RPC.

Then the worm opens up port 69 for sending itself.

then it opens port 4444, a remote trojan port, it creates a hidden CMD.exe shell on your pc, allowing hackers to run commands.

Then the worm DoS Attacks windowsupdate, therefore ms blocks u from updates.

Then how it spreads, the worm calculates random ip's, and checks the subnet for valid ip's, tries to send itself to valid ip thru port 135.

if it has an error, aka mis properly sent, bad fragment, the targets pc will reboot due to RPC crashing. but wont get the virus, or else, they will, and rpc will most likely crash still, and reboot.

most people say their pc reboots every 10 mins, its stoppable .

my forums giv a good topic on this virus, and detailed instructions of how to remove it

http://www.xilez.net/forums

Admin/Mods, im gonna post about the worm on new topic, please pin it

[xerox]

brilliant info on that 'virus'

now all those anti-ms people who run ms (you know who you are) might actually want to get this one =)

I do have to admit, it was really well made =P At least it doesnt destroy pcs. What would be really nice is if it deleted any traces of itself from the system after the attack

[Shoarma kip]

yes i had it my dad blamed my sister but then i found out it was the crapy worm hehe crazy comp restartet every 40 sec

[SteadVéx]

i think i just have a wierd comp, cuz i kept getting attacked by it everytime i went on the internet until i dl'd that patch (and i have antivirus and firewall)

but with me, just lots of things didn't work, like i couldn't copy n paste inside explorer and internet explorer, or open a new window i'd had to load another copy of it, and visual studio refused to open, installs wouldn't install, and generally made me very annoyed but it never restarted for me, however i was restarting it every few minutes

[petebog]

i think i just have a wierd comp, cuz i kept getting attacked by it everytime i went on the internet until i dl'd that patch (and i have antivirus and firewall)

but with me, just lots of things didn't work, like i couldn't copy n paste inside explorer and internet explorer, or open a new window i'd had to load another copy of it, and visual studio refused to open, installs wouldn't install, and generally made me very annoyed but it never restarted for me, however i was restarting it every few minutes

When windows starts acting like that, it's definately time for a re-install.

[SteadVéx]

yup, you were right, but i was super miffed when it kept doing that after i formated and reinstalled virtually everything...so i did it again and then i decided to go and look for new types of virus's i only heard about that blasta thing yesterday..

[raiden]

Hey Dre, thanks for correcting me. I didn't know much about the virus because I'm not the one who got rid of it on my home network.. I just called it RPC because I'm retarded and stuff.