WinXP Exploitation

[dysfunction]

My parents got hit by this new "virus" (They seem to get everything!! )

Looks like its a new variant of the MSBlast virus but attacks the LSA Shell (Some sort of XP Logon verification system??)

Anyway it causes your PC to keep restarting...

You'll need this patch:

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

I found the solution here:

http://www.computing.net/security/wwwboard/forum/11377.

 

[]AC[dRuM]

Not telling you how to suck eggs, but your parents don't have the restart on sys faliure option enabled do they?

Sys Properties - Startup & Recovery - System Faliure - (check box) Automatically Restart.

Just saying this because it might not be a virus.

 

[dysfunction]

Its definitely a virus/worm/watchamacallit...

Cos the patch from M$ fixed the problem. And others have had the same problem on another forum I visit.

 

[dysfunction]

Its the Sasser worm...

http://www.sky.com/skynews/article/0,,30000-13079037,00.html

 

[Gray]

o2 where i work got completely hammered by it, totalled all of our systems.

Took em a few good hours to fix it, but found out we was running the BlackIce firewall... hmmm

yea

 

[Cyradix]

Pretty fun to fix an infected pc when at 100% processor. I have to wait 3 minutes between every click

 

[mookie]

hmph. is it really that hard to click the 'download and install' button when widows updates are available? you all deserve to get stupid worms.

 

[Athan]

Whilst there's never any good reason to get infected, with this patch there were some people that could NOT use it in its initial form as it caused machines to lockup and otherwise become unstable. Seems to be some bad interaction with certain hardware/drivers.

Of course a decent firewall would protect people in this case (it's using a port 445 expoit initially, and then a couple of other ports), well, if not for the way far too many manager types will insist on being able to take their laptop betwene office and home where they can get infected all too easily. Good luck convincing them to let you firewall them up the wazoo at both home and office to try and stop that.

-Ath

 

[gunner440]

hmph. is it really that hard to click the 'download and install' button when widows updates are available? you all deserve to get stupid worms.

just remember though, not everyone has a high speed con... 56k users still exist and those microsoft updates can take a while to download :/

 

[mookie]

just remember though, not everyone has a high speed con... 56k users still exist and those microsoft updates can take a while to download :/

'oh damn, i've just cut off my arm, i would call an ambulance, but the phone is all the way over there.'
lazyness?

the bit that really annoys me is when i hear that the coast guard and god knows how many other companies got affected by it. I sure would give my network admin a bloody good talking to if they cant keep the machines up to date with critical updates. fair enough, small companies, hard enough to keep the network up at all, but emergency services? heads should roll.

 

[PR.]

All companys that have enough computers on a Win2k domain to make updating each one individually annoying should be running Software Update Services http://www.microsoft.com/sus to deploy them. Its free its simple to install and it does exactly what it says on the tin.

The newer version will support updating non-critical updates and other applications such as Office.

 

[Infernus Flammus]

anyone noticed any probs after installing the windows update, my pc keeps shutting down at random, and its very frustrating. defo not a virus, unless the 3 didd virus scans i ran were lying to me. any info would be most appreciated b4 i get too peeved and re-format

 

[Furr]

This virus essentially knocked out the majority of people computers at my uni, the system was getting so overloaded that anyone who showed signs of being infected was cut off from the network.. including me! note to self never leave computer on unattended for days at a time

 

[dysfunction]

anyone noticed any probs after installing the windows update, my pc keeps shutting down at random, and its very frustrating. defo not a virus, unless the 3 didd virus scans i ran were lying to me. any info would be most appreciated b4 i get too peeved and re-format

Ive not had any problems after installing windows update.

Maybe you still have the virus running on your system. Perhaps you should look at the solutions in my first post about getting rid of the virus completely...

 

[Athan]

anyone noticed any probs after installing the windows update, my pc keeps shutting down at random, and its very frustrating. defo not a virus, unless the 3 didd virus scans i ran were lying to me. any info would be most appreciated b4 i get too peeved and re-format

Not personally, but there was a thread on BUGTRAQ about this. There are some bad interactions between the anti-Sasser patch and various drivers/pieces of software. VPNs was one thing mentioned, also something about some USB devices. A search on the M$ knowledge base should turn up something. Also see www.securityfocus.com for the BUGTRAQ archives.

-Ath