Virus 2?

[]SK[]

I have had two customers in the same day mention an error with XP stating that...

"I had infringed the NT Authorised System. It said that Remote Procedure Call Service had terminated unexpectedly and then shut down the computer."

Ive never heard of such above before, but to have two at the same time?

After browsing symantec site I noticed...

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Sounds related but the error ive been given doesnt get a mention on their page.

Anyone else had this error appear today?

 

[PR.]

This has been talked about in the Hardware forum...

 

[dysfunction]

My mum has been struck by this. Everytime she connects to the internet her PC shuts down!





Luckily Ive been updating XP very often as well as my virus definitions



http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

 

[Trem]

Everyone I know has had this error, there is a fix for it on microsofts site but you also have to remove it from your registry(MS Blast or summat), McAfee also found it and removed it, if I find a link to it on MS's site I will post it. Only an XP and 2000 error by the way.

 

[kameleon]

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

 

[Trem]

ok, the file name for the Microsoft patch is - WindowsXP-KB823980-x86-ENU.exe

Hope if you search for that it will bring it up.

 

[dysfunction]

Just follow the link in my post...you can d/l the file there...

 

[]SK[]

Yea reading about in hardware forum, cant get to the customers today to fix though :/

PS
CALL OUT CHARGES RULE!!!!

 

[kameleon]

just give them a freebie and tell them to turn on xps built in firewall.

 

[Will]

Is this where we get to lecture people about the dangers of not using a firewall, and why they should patch Windows more often?

 

[Scooba Da Bass]

This is where I get huffy about posting the fix 3 weeks ago and people only start doing it when the script kiddies find a worm that takes advantage.

 

[]SK[]

Well one guy didnt use a virus scanner and no firewall. Other one does but was at home with his laptop and used DUN to pickup his work emails. 10 seconds online and FUBARed his laptop.

I love virus's their so much fun...when theres a fix.

Maybe this will teach people to try to stay protected.

 

[Will]

Originally posted by Scooba Da Bass
This is where I get huffy about posting the fix 3 weeks ago and people only start doing it when the script kiddies find a worm that takes advantage.

You actually made me go and patch my flamates computer when you posted that.

Which is a shame, since I have a working piece of exploit code, and I wanted to show him why he should run a firewall.

 

[PR.]

Originally posted by ]SK[
Maybe this will teach people to try to stay protected.

BWAHAHA, How long you been in IT?!

PC World will be busy this weekend thats for sure, with people going in saying their machine is shutting down and the PC World staff running a virus check removing the worm and then tell them their PC has sustained irreparable damage from the heat and they will need a new CPU and Motherboard which is lucky cos they have an offer on at the moment...

 

[kameleon]

it's going to make microsoft huffy on the 16th of august when their update site wont be accessible - especialy since they've had the patch on there since July 17th. Still , its only taken them 2 years to fix it.

 

[Wij]

I had this yesterday twice so I turned on the XP firewall (turned it off months ago when I had ICS on cos it caused problems.) Once the firewall was on I got no more reboots. Should I do something else too ?

 

[throdgrain]

Help me out here
I use a router for my connection these days, is this an effective fire wall, or should I re-install wassname again too ?

 

[throdgrain]

Originally posted by Wij
I had this yesterday twice so I turned on the XP firewall (turned it off months ago when I had ICS on cos it caused problems.) Once the firewall was on I got no more reboots. Should I do something else too ?

You can download a tool to remove it from the symantec page quoted above

 

[Will]

Originally posted by throdgrain
Help me out here
I use a router for my connection these days, is this an effective fire wall, or should I re-install wassname again too ?

It is effective against external connections, but you should install a client-PC firewall too, to control outgoing connections.

 

[Trem]

Originally posted by Will
Is this where we get to lecture people about the dangers of not using a firewall, and why they should patch Windows more often?

AY UP WILZ0R!!!

I hadn't turn my second pc on for 3 days and it was protected by Windows firewall and also McAfee firewall, it gets around them apparently.............well it did on my pc :/

 

[]SK[]

A router should be ok to stop it coming though. Make sure your antivirus is upto date. Most virus programs now have updates for this worm.

Free AntVirus: http://www.grisoft.com/us/us_dwnl_free.php