Nightmist Online Forum
        (http://www.nightmist-online.co.uk/cgi-bin/YaBB/YaBB.pl)
      

        Nightmist Online - Please read the terms of use before posting here >> Discussion Forum >> [ LATEST VIRUS INFORMATION ]
        
(Message started by: Pandilex on 08/12/03 at 12:50:27)
Title: [ LATEST VIRUS INFORMATION ]
Post by Pandilex on 08/12/03 at 12:50:27
Yesterday, on August 11th, a virus took the world by force by exploiting a known problem with windows.

It affected hundreds of thousands of computers in a matter of hours, including my own.

The symptoms for the virus include:


  • Your computer shuts down without reason
  • Parts of your operating system fail as a key part of windows is given invalid instructions and crashes (svchost.exe on windows 2000)


It opens many ports on your computer and is transmitted to computers not running a firewall.

Details from symantec can be found here (http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html).

There is an update patch to fix this exploit in windows 2000 and XP, but I'm not clear on how it spreads on windows 9x systems (Microsoft claim windows ME is not affected, but I'm not convinced).

Click here (http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp) for the microsoft bulletin describing the problem (No patch for windows 9x... don't know why seeing as the virus appears to affect these systems).

There is also a security tool on the symantec site for searching and eradicating this virus - be warned it can come back if your computer is not secured.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by CKY on 08/12/03 at 15:17:24
My XP computer crashed about 20 times yesterday. It seemed as if it waited til I was online, and had about 4 browsers open. When I finally got frustrated I went to my moms computer, which has ME because she's lazy and won't let me put XP on it from "fear of file loss."

Didn't affect me on ME at all really.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Astrona on 08/12/03 at 15:39:16
Thanks for the heads up Pandi..turns out I have it..
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Infiniti on 08/12/03 at 16:26:06
Yeah, I just managed to clear it from my pc today, reboots your system any time you go near an internet program, I had to download the patches on win 98, lucky to have it really, not sure how your supposed to download the scanner from symantec and patch from microsoft when your computers infected.

I know for sure though that 98 and below are safe.

But the links Pandilex gave ya are all you need, if your sure you aint got (it and believe me you would know if you had as cky mention with the reboots) then get the patch, otherwise get the scanner from symantec then patch it.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by James on 08/12/03 at 16:45:49
got my dads computer I walked in there and told him about it and his computer was rebooting but it didin't cause any damage  so he got lucky just ran the update so who ever is sending it out to ya :p
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Teh Dark Fluff on 08/12/03 at 17:18:38
I have Windows ME and it never affected me and my dad has XP and I haven't heard any complaints from him mind you he doesn't use the net, lucky annoyance.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by James on 08/12/03 at 17:21:22
yea well you should get the patch any ways its your computer do with it what you will good luck ya'll
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Exor on 08/12/03 at 17:24:22
I got this error on my computer with Windows XP.It really did suck.Just downloaded the patch.Gonna go install it now.

Thanks alot for the info pandi.You're a life saver ;) lol
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by JLH on 08/12/03 at 17:45:17
we did about 15 repairs on customer/business machines today at work and a few onsite repairs, nasty little worm, i like it. only seems to affect nt4/2k/xp.
will spread on to a machine via RPC port 135 if it's not firewalled off, the patch to fix RPC was released by Microsoft july 16th, and those people with it can't be affected by it unless they get it via an email and run it themselves, if that happens, then you need the latest update from norton to remove msblast.exe from your system.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by James on 08/12/03 at 17:59:18
isn't it great to know that there are people in this world dedicated to the distrution of every thing they can get there hands on?
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Exor on 08/12/03 at 18:09:43
Installed the patch and im running without getting that gay RPC message. Thanks again pan for the info.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Rattlesnake on 08/12/03 at 18:42:53
Bleh. Annoying little thing it is. Ran the thing to get it removed and now I'm getting the patch.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Bill on 08/12/03 at 19:24:04
Just a question... How do i find out if i have 32 or 64bit XP and what's the difference between them?
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by James on 08/12/03 at 19:27:07
unless you bout a motherbord with 64 bit then u have 32 so mostly likly you have 32 as that is still the standers so another words just download 32 version

what this is there are traces or also knowen as leads on your motherbord that are the eletrical path for the information to travil and there are 32 of them on a stander mother bord they are now working on 64 versioin and are actuly out but more comminly used for people who run 2 cpu's (proccessors)
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by dognapot on 08/12/03 at 20:28:20
i have to go fix my g/f's computer in a little bit, so i was reading about this virus much of last night and even though it's a pain in the ass for everyone it's still sorta cool. i mean, this is apparently in the worm itself...


Quote:
The worm contains the following text, which is never displayed:

I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!


see? he gives a shout out for his peeps and bashes, playa, bill gates. the author is totally a destructive annoyance, but maybe his heart's in the right place.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by -Gaddy- on 08/12/03 at 20:49:02
Yes! i'm pretty sure my computer isnt good enouugh for this virus thing :D
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Issy on 08/12/03 at 21:35:37
I was called into work - and had to repair 18 machines today that were all infected. It is a very interesting worm.

Thanks for the post Simon  ;)

Isaiah
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Insomnia on 08/12/03 at 22:58:30
Anyone who's got a working version of Norton Antivirus for XP? Feel free to AIM GUSish if you do.. :)
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Rattlesnake on 08/12/03 at 23:08:02
wow. * also found 20 cases of W32.Spybot.worm on her computer.
* grumbles
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Argus on 08/13/03 at 01:52:46
Funny part was people thought it was just going around NM.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by magitoma on 08/13/03 at 03:23:59
i have ME and my comps healthy as can be ;)
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by PuppeT on 08/13/03 at 04:06:26
I got a question for you though Pandilex:

If I buy Windows XP after this bug, will I still have to run/download the patch, or should it be updated by then? My family was thinking about buying XP, then I told them about this going around.

As everyone else has said, thanks for the heads up Pandilex.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Argus on 08/13/03 at 04:32:24
It depends when you buy it, if you buy it like, tommorrow, then yes....if u buy it a while from now then it might  already be patched.

BTW, the virus was named "Love San".
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Bean on 08/13/03 at 04:54:36
So far 98 is a safe product....

Finally the virus community has become too advanced to affect my computer  ;D ;D ;D

TEchnichally this isnt really a destructive virus though is it?? All it does is shut your computer off every time you try to go on the internet... Kinda reminds me of my how my mom used to turn the t.v off every time I ignored her and I would turn it on, change the channel and she would just turn it back off... Lol :P

Hope no one goes crazy with an uzi because of this viurs....
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by dognapot on 08/13/03 at 04:58:09
i read that on the 15 or 16 it will dos microsoft's update site. i'd call that destructive, and humorous too.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by PuppeT on 08/13/03 at 04:58:28

on 08/13/03 at 04:54:36, Bean wrote:
TEchnichally this isnt really a destructive virus though is it?? All it does is shut your computer off every time you try to go on the internet...


But when it's not shut down properly, it loses data/memory or something along that line doesn't it? It checks your harddrive for errors, and tells you to shut down properly on 98.. I've never tried XP though, so I can't really tell what it does if it's not shut down correctly.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Argus on 08/13/03 at 05:12:58
Besides what it "will do in the future" currently the virus is able to remotely control anyone's computer like a trojan. If you are infected with this virus and access the internet you can lose full control of your computer and cant do anything but pull the plug or hit the off button. With this, they can steal pw's, credit card information, email accounts (used to help spread virus'.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by dec on 08/13/03 at 08:25:09

on 08/13/03 at 04:06:26, PuppeT wrote:
I got a question for you though Pandilex:

If I buy Windows XP after this bug, will I still have to run/download the patch, or should it be updated by then? My family was thinking about buying XP, then I told them about this going around.

As everyone else has said, thanks for the heads up Pandilex.


just ask the guy in the shop or tech dude if its patched he should know
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Vodka on 08/13/03 at 09:05:14

on 08/13/03 at 04:54:36, Bean wrote:
So far 98 is a safe product....

Finally the virus community has become too advanced to affect my computer  ;D ;D ;D


Thank ya jesus, that nothing has came our way, yet.. and hopefully nothing does.  :-/ My CPU.. is crappy enough as it is.. I don't need anymore damage done to it.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Bean on 08/13/03 at 09:42:21
Amen to that...
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Bill on 08/13/03 at 10:08:42
"So far 98 is a safe product"

Oh my god man, there are tons of viruses out there that can still affect 98, and some of those viruses are much more damaging/wide spreading than this one, this isn't like the only virus in the world.


And another thing...If it shuts you down everytime you try to access the net, then how are you supposed to dl the FixBlast program to get rid of it?   :-/
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by dec on 08/13/03 at 10:28:29
get a friend to do it, if u can
Title: kRe: [ LATEST VIRUS INFORMATION ]
Post by Bill on 08/13/03 at 11:00:34
K, thanks, was just wandering.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Pandilex on 08/13/03 at 14:51:06
You should enable the XP firewall after you install it, then download all the patches from the site. No virus can harm you provided you don't run any malicious files in e-mail, and you keep the firewall up until you're fully patched.

Because of that, its perfectly safe to buy XP.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Astrona on 08/13/03 at 16:38:45
Hmmm..The odd part was, I had files named that on my computer...Yet..It didn't shutdown when I went to go online...? Dunno..*blink* My computers so messed up it'd probably confuse the most advanced of viruses..
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Soap on 08/13/03 at 17:37:13
Here is how I got rid of the Virus....

I have Cable Internet so it was a lil bit easier.

I turned off the cable modem rendering me access to the internet. Went into my Network properties and looked at my Connection properties.. Went to the Advanced Tab. and enabled the Firewall... Turned the Modem back on and found some documentation on the virus and where I could download the patch at. downloaded the patch & installed... and turned off the firewall..

~That is all
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by JLH on 08/13/03 at 17:39:27
a shutdown will only be started if another computer somewhere happens to randomly hit your ip on port 135 and tell it to. the shutdown is a windows started one, so nothing will be lost data wise as it's just the same as you doing start-shutdown, afaik.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Stunna on 08/13/03 at 17:41:30
i have windows XP and havnt gotten it yet   :/ im waiting for it,uh-oh
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by deSade on 08/13/03 at 17:51:27
To get the patch without your machine shutting down and you don't have a nearby friend with the patch on floppy do the following;

Right click  
My Computer-> manage->services and apps-> services->  

Find the Remote Procedure thing "the top RPC of the 2"

Right click on that, then click properties

Theres an option on one of the tabs "middle one" that lets U disable the shutdown. Do that then......


Then download this patch

http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC- 9532-3DE40F69C074&displaylang=en

Hope that is of some help  ;D

Hugh
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Lady_Maha on 08/13/03 at 18:22:10
From the Maryland Independent:

Computer virus shuts down MVA

A computer worm infected the Maryland Motor Vehicle Administration's computers Tuesday, forcing the closure of all MVA offices throughout the state at noon and crippling its online, automated telephone and kiosk services as well.

MVA spokeswoman Erin Henson said the system was shut down to help prevent the spread of the "Blaster" worm and protect data files from damage. She said the MVA hopes to repoen today for regular business hours.

The parking lot in front of the Waldorf office on Tuesday was vacant, save for a steady trickle of people arriving to do business and leaving once they heard the news.

"This is crazy," said Waldorf resident Ruth Burroughs, whose license was scheduled to expire. "But if they give me some more time, then that's good."

Henson said that residents with expiring licenses have been granted an extension due to the shutdown.

"For all those people whose licenses were expiring because it was their birthday, we will give them another day," she said.

She added, "All indications show that the data is secure."

The "Blaster" or "LovSan" worm began infectiong thousands of computers worldwide Tuesday. The worm exploits a security hole in Microsoft's Windows 2000 and Windows XP operating systems, installing itself and using an infected machine to attack other machines. Unlike many parasite codes, "Blaster" does not require a user to open an infected file, nor does it damage its host machine.

First it installs itself and forces a host computer to reboot. Once restarted, the host begins running a time bomb program that will cause it to continuously request information from Microsoft's Update servers, beginning on Aug. 16 and continuing through Dec. 31. With thousands of infected machines swamping the servers, the worm could overload the Microsoft machines and shut down the service.

The MVA installed  new $40 million Windows-based computer system early this year to speed up its license issuing process and provide services online. The system's pilot program in Waldorf was so plagued with technical and user glitches that it caused wait time at the offices to increase, in some cases doubling or tripling the time. The MVA delayed the statewide rollout of the system until midsummer.

Charles County sheriff's deputy Charles Baker briefly took up the task of standing outside the MVA office door and informing people of the news Tuesday.

"They're closed," he told an elderly couple. "Sorry, computer snafu."
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by dec on 08/15/03 at 09:56:09
My mum told me this morning that she heard on the radio that a new virus is out i didnt really here many details but its meant to wreck your computer. It says something about bill gates it may be an email or a pop up (stupid mum) or it mite even be a hoax but incase its not. I unno maybe pandliex could check it out or something.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Jurian on 08/15/03 at 10:58:06
the blaster thing had the bill gates thingy in it :D allthough there are now several different versions/variations on the virus allready :D
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by dec on 08/15/03 at 11:20:21
oh ok stupid mum lol ;D
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by deSade on 08/16/03 at 12:53:48
There are some e-mails going about that say the attachment is a patch for the virus. Delete them! They are in fact viruses themselves and alot more malicious than the LoveSan/Blaster virus they proport to fix.  >:(

A friend of mine on another forum opened one and has spent the last 3 days fixing his machine.

Hugh
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by SullenUrchin on 08/16/03 at 13:01:47
lol its called dos:

format C:
go to cd drive usuly E:
install

and reload?

well seeing how I'v done it a million times its no problem for me and if u want to save data its a pain but thats why u keep a second drive partion ur hd but what do I know lol
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by sayadin on 08/17/03 at 13:14:22
some people believe that people that create viruses or hacks are terrible people... but not really... if you think about it, if there were no viruses or hackers... then why would we need anti-virus programs. lets say that everyone on nightmist knew what to do and how to do it, they never steal, curse, or break any rules.... if that start to happen then why would we need staff.... stupid as it seems but we need hackers and virus developers or else you will see alot of people just losing their jobs... i just wish the same could happen to cops... you know... kinda like no crime for several years and all cops lose their jobs because we won't need them no more.... and then we bring in the shibbs when there are no more cops  ;D
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by dec on 08/17/03 at 13:47:14
is anyone else confused ???
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by deSade on 08/17/03 at 14:03:16
So by extension cancer and aids are good 'cas they keep doctors and nurses in jobs??  ???

Yeah right, thats some pretty messed up logic!  :P

Hugh
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Oracle on 08/18/03 at 04:48:06
There's more behind that jest that you think... I heard on high authority a whisper that in some 3rd world countries where they can't afford medics, they have found a way of curing cancer by means of resonanting frequency. It is actually against the law in Britain to claim to know how to cure cancer is what I am told. The govenment makes so much money through getting people addicted on cigarettes and charging a bomb load of tax on them for one but overall they make money on curing cancers so they do not wish to start the curing procedure.


Like I said this is just what a sertain person told me, it is not indefinatly fact and you may or may not chose to believe it is the truth.

I can't see how hacking can be claimed one of the things that the world needs after seeing the amount of cost and damage it can do.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Astrona on 08/30/03 at 15:51:20
It was just found that this lovely virus was created by an 18 year old boi! Yeah I bet all those big companies feel pretty stupid too. Anyways..He's currently being arrained and is in PRISON for the creation of the virus until the time being. Just thought I'd give a conclusion to all the virus insanity it caused.

Btw, The Virus had hit Wendys computers. You should have heard the manager screaming, asking us all what the hell was wrong with the computer.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Poopoo on 08/30/03 at 18:53:34
I must be the only idiot that didnt get it  :o
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Poopoo on 08/30/03 at 18:57:45
You people should download Nortan Anti Virus...
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Lady_Maha on 08/31/03 at 06:03:06
Didn't get me either... muahahaha.. of course my system is too outdated to be interesting for this virus too (win 98 ), but even if, my comp doesn't go online without Norton Antivirus and ZoneAlarm enabled.
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Vodka on 08/31/03 at 07:14:31
Yeah, mine wasn't effected with my beautiful Windows 98.

Someone get that friggin' scanner to work for me!  :-/
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Sera on 08/31/03 at 07:53:44
*shrugs* I have windows XP... but I didn't get it. I run Zone Alarm
Title: Re: [ LATEST VIRUS INFORMATION ]
Post by Oracle on 08/31/03 at 18:21:15
I have windows XP and don't run any anti-virus protection, I just keep it upto date with windows update. Obviously didn't get me :)


Nightmist Online Forum » Powered by YaBB 1 Gold - SP 1.3.1!
YaBB © 2000-2003. All Rights Reserved.