Nasty Worm going around

from WinCustomize Forums

This hasn't shown up on any news sites yet that I know of but there is a really nasty worm going around the net that uses an exploit in RPC on XP. Make sure you have the latest updates to Windows XP installed or you will get zapped by this at some point.


It will cause a crash in RPC which will force your machine to reboot 60 seconds later (With a count down). It's a PITA to remove too once you get it.

27,408 views 52 replies
Reply #1 from WinCustomize Forums Top
At the risk of sounding stupid.......What does RCP stand for?
Reply #2 from WinCustomize Forums Top
RPC: Remote Procedure Call.

In a nutshell, it (the RPC service,) is one of the critical services of Windows NT. ^.^
SoundPackager - Customize the Windows sound scheme
Reply #3 from WinCustomize Forums Top
https://grc.com/x/portprobe=135 is a direct link to test if your port 135 is open or closed. Open is bad....closed or stealth is good.
Reply #5 from WinCustomize Forums Top
ok even i have this bug now .. i wish i knew how 2 get rid of it .. its very very annoying .. i hope none of u get it ..
Reply #6 from WinCustomize Forums Top

Use REGEDIT.EXE and wipe out the value referencing MSBLAST.EXE at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.


Reboot. \windows\system32\msblast.exe (location may vary slightly depending on OS) should now no longer be running. Get rid of it.


Use WindowsUpdate to make sure you're patched or grab it by following the links for your OS from here: http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp

Reply #7 from WinCustomize Forums Top
here is a direct link to the update
http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

Thanks so much for telling us about this!

Barb
Reply #8 from WinCustomize Forums Top
Grrrrrrrr I got it and I never get anything

O well all better now
Reply #9 from WinCustomize Forums Top
Seems no matter what I do, the link above still reports that port 135 is "Open". I've applied the patch, changed the registry entry for DCOM service, even used DCOM config to disable and it still says...."OPEN". Am I suffering from another bout of "headuperectus" or just is it just full-blown Dumass Inc.?
Reply #12 from WinCustomize Forums Top
thanx for the infos... nasty worms. checked my port. its stealth yay . ehmm i guess my system is protected. even tho my 135 port is stealth (according to the grc test),i would still like to know how to close it..
Reply #13 from WinCustomize Forums Top
Cool! my port is closed! (gee, that sounds a little nasty) But, it doesnt surprise me. We have two puters networked here and we have them as tight as a drum
Reply #14 from WinCustomize Forums Top
kthxbye
thx for the info on RPC
Reply #15 from WinCustomize Forums Top
This thing pounded us today. We had 12 servers RPC service all die at the same time and subsequenly it started spreading around to the desktops. Unfortunately it's almost impossible to keep up with the Microsoft/Anti-Virus patching machine
Reply #16 from WinCustomize Forums Top
Just a heads up... despite my port being stealthed i still got hit somehow

Edit: got hit cause it's more than port 135 to worry about
http://isc.sans.org/diary.html?date=2003-08-11
Reply #17 from WinCustomize Forums Top
I got it everytime I tried to open my computer a countdown would start ...I went to get that patch from Microsoft and applied it and so far no countdown I hope it stays like
Reply #18 from WinCustomize Forums Top
Thanks for the info I thought I was flippin me lid
Reply #19 from WinCustomize Forums Top
I recently switched to Trend Micro's Anti Virus software and have been very satisfied.

Like most of the major Anti-Virus companies, Trend Micro offers a free on-line scan. House Call is available from http://housecall.trendmicro.com/

Manual removal instructions are available from http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A

I hope that this helps.
Reply #20 from WinCustomize Forums Top
Ok... I got this thing and I was able to stop the shutdown process:
start > run > shutdown -a

done...
Reply #22 from WinCustomize Forums Top
thanks for the heads up, this thing was doing its dirty work every time i started msn messenger. now i can stop ripping my hair out
Reply #23 from WinCustomize Forums Top
OK...I admit I got it too.. ...

but with your info...everything is A-OK again!!!
Thank you very much for this one!!!!

Live long, and prosper...!!!
Reply #24 from WinCustomize Forums Top
Ditto., I got it and have no idea how,,, i've been virus free for years..
disabled all startup proggies and no reboot since,, now i know what to look for and kill the Mo Fo.

Thanks folks
Reply #25 from WinCustomize Forums Top
Hate to say this but Starone and I got that Worm. I don't cruise the net and rarely go to another site but to buy or pay bills other than camp out here. Starone goes everywhere. It came thru a firewall. Downloaded the patch on her DSL as my 56k couldn't stay connected long enough. All fixed now but was pissed for a while. That isn't an accusation against this site.So I hope no one thinks that. SkinStudio says that all you had to be is connected to the internet to get it.