This happened to many of u?!

[chimaira]

http://daoc.catacombs.com/forum_news.cfm?ThreadKey=2&DefMessage=480275

 

[Wij]

Yes. Everyone who hadn't got a firewall running on Sunday basically.

 

[Fafnir]

Originally posted by chimaira
http://daoc.catacombs.com/forum_news.cfm?ThreadKey=2&DefMessage=480275

Nope I was to hangover to use my comp early on sunday And when i logged on my comp i downloaded this fix at once.

 

[parisienscot]

My system doesn't shut down, but when I conect to the internet it's completely blocked - I checked and after trying to connect to DAOC, download mail and download web pages my comp had only sent one packet!

Do you think this could be the same worm? Maybe I don't have the worm but a lot of people using my broadband server do and it's swamping the network?

Or is it something else?

I've had zonelarm up the whole time though and not had any New Programe alerts...

 

[Wij]

It can eat yer bandwidth yeh.

 

[parisienscot]

Yeah but my comp is not actually sending anything at all - I have two ways to check this - zonealarm and my adsl monitor and it looks like zero data is being sent out of my comp.

If you meant that it's eating up the bandwidth on my isp from other people's infected comps however than that's possible - hope not though coz there isn't much I can do about that.

 

[parisienscot]

YAY it's working again - seems I wasn't infected after all

 

[old.Gromnir]

Yup and I now have a computer thats clean of the worm once more. Took me a few hours to restor all our computers. Since its kind of hard to do anything when you cant do nothing when svchost.exe crashes and when RPC no longer allow you to install virussoftware.

 

[jammin0o]

Whats is svchost.exe ?
I sorted out my RPC problem, hope its all fixednow

 

[old.Gromnir]

most things under windows is run though the svchost.exe - If it crashes you will be unable to do the following (that I know off)

Copy&Paste - which in turn dose that you can make a back up of say your emails and documents on another drive and then make a reinstall of C:\ - bucause the copy and paste function is disabled.

*cough* only fools have doc's and other important stuff on the main drive *cough*

Drag&Drop - which is sort of also tied to the Copy&paste function wont work either. You'll get a "No No" Mouse marker if you try and move something.

Those are the things I know off because you notice them quickly. But if you remove MSBlast then your svchost.exe should be home free.

 

[DocWolfe]

I had that Grom, I told one of my mates on irc when I was trying to back up my comp, and they suggested it could be the worm, even though I never turned my computer on on sunday... installed patch and then ran a scanner prog and it fixed . I had to reboot tho... which is a risky business with my computer atm... coz gfx card is pretty much gone... takes 5/6 reboots for it to start up without any gaphics glitches.

 

[speshneeds]

simple rule - Firewall...

if you got one, you wont get touched by this seeing that it gets in on 69udp and 135tcp... no firewall is gonna allow people or things to connect to them really


edit - wrote a guide on the ISP i work fors service status page earlier.. might be useful

http://www.ntl-isp.ntl.com/lookup/default.asp

 

[Cyradix]

avchost.exe is a service host for loading dynamic-link libraries (DLL) as a services.... Don't touch them

 

[old.Gromnir]

Originally posted by Cyradix
avchost.exe is a service host for loading dynamic-link libraries (DLL) as a services.... Don't touch them

Oh thanks now I know what its stands for :]

If any of you are dansih and/or understand just a little danish, this link is to a website that talks about what the virus :

http://www.virus112.dk/index.php?page=artikel&artid=741

 

[razorboy]

Originally posted by old.Gromnir
most things under windows is run though the svchost.exe - If it crashes you will be unable to do the following (that I know off)

Copy&Paste - which in turn dose that you can make a back up of say your emails and documents on another drive and then make a reinstall of C:\ - bucause the copy and paste function is disabled.

*cough* only fools have doc's and other important stuff on the main drive *cough*

Drag&Drop - which is sort of also tied to the Copy&paste function wont work either. You'll get a "No No" Mouse marker if you try and move something.

Those are the things I know off because you notice them quickly. But if you remove MSBlast then your svchost.exe should be home free.

Had it myself and the copy-paste thing is one of the few things that happens, what also happened to me when it crashed:

Javascript doesnt work anymore. So no catacombs, no duskwave etc, but more important, it seems that windows is programmed with it (or some other crashed thing), so you can not open event viewer, control panel crashes, etc etc...

Guess its time to install a firewall

 

[Carnalito]

omg this worm was one nasty thing.

As i'm on dial temporarly i wonder how the fuck i could lag so much when playing daoc (i heard that dial actually was ok to play with).

And then the puter started rebooting with some strange messages, locking up etc.


Well mblaster.exe is gone now thanx to the fix program on symantecs hp, but i wonder if the Spyworm and blaster worm is the same thing ? or do i need to remove the spy one too ?..