Re: URGENT - BLASTER LIKE VIRUS, PC IN CONTINUOUS SHUT DOWN LOOP - Article 36 - go-pugleaf

Article View: alt.comp.virus

Article #36

Re: URGENT - BLASTER LIKE VIRUS, PC IN CONTINUOUS SHUT DOWN LOOP

#36

From: The person you think
Date: Sun, 26 Oct 2003 12:11

30 lines
2685 bytes

"Michael" <mixstatdonotspam@bigpond.net.au> wrote in message
news:xcZlb.162941$bo1.129909@news-server.bigpond.net.au...
> The Symantec web site says that Blaster does not affect NT systems.
>
>
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
>

Actually, you are confusing things for some. XP and 2000 are built on NT so
basically it affects NT but not NT4 according to Symantec - which isnt right
anyway.

> however Microsoft says NT4 is affected by the Blaster worm and its
variants.
> See http://www.microsoft.com/security/incident/blast.asp .
>

It IS affected though not as dramatically as XP and 2000.

> Its interesting that the Blaster worm does not appear to continually
reboot
> the computer but this is what the poster described as a symptom so I think
> she may have some confusion about what has actually happened to the
system.

No, actually I think you do. When a hacked machine that is unpatched is
being exited, the DCOM service, set by default to RESTART THE COMPUTER will
restart in 55 seconds. All you have to do is change that to restart the
SERVICE. Better yet, patch the computer.

Technical Details

Message-ID: <aSOmb.780$Lx5.29885@nnrp1.ozemail.com.au>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!news-out.visi.com!petbe.visi.com!news1.optus.net.au!optus!snewsf0.syd.ops.aspac.uu.net!nnrp1.ozemail.com.au!53ab2750!not-for-mail

References:

<3f950101@news.comindico.com.au> <mnnlb.160824$bo1.113551@news-server.bigpond.net.au> <Matthew.Kirkcaldie-BE3498.15043422102003@seagoon.newcastle.edu.au> <7efdpvgvdfpsvfmuemlj2pkju4bc31lemj@4ax.com> <xcZlb.162941$bo1.129909@news-server.bigpond.net.au>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: fcd68,e0148b89e1d6791
X-Google-Attributes: gidfcd68,public
X-Google-Thread: 10d683,e0148b89e1d6791
X-Google-Attributes: gid10d683,public
X-Google-Thread: 108c83,e0148b89e1d6791
X-Google-Attributes: gid108c83,public
X-Google-ArrivalTime: 2003-10-26 04:11:51 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!news-out.visi.com!petbe.visi.com!news1.optus.net.au!optus!snewsf0.syd.ops.aspac.uu.net!nnrp1.ozemail.com.au!53ab2750!not-for-mail
From: "The person you think" <spamis@theshithouse.com>
Newsgroups: alt.comp.virus,aus.computers,aus.computers.ibm-pc
References: <3f950101@news.comindico.com.au> <mnnlb.160824$bo1.113551@news-server.bigpond.net.au> <Matthew.Kirkcaldie-BE3498.15043422102003@seagoon.newcastle.edu.au> <7efdpvgvdfpsvfmuemlj2pkju4bc31lemj@4ax.com> <xcZlb.162941$bo1.129909@news-server.bigpond.net.au>
Subject: Re: URGENT - BLASTER LIKE VIRUS, PC IN CONTINUOUS SHUT DOWN LOOP
Lines: 32
MIME-Version: 1.0
Content-Type: text/plain;
 charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Message-ID: <aSOmb.780$Lx5.29885@nnrp1.ozemail.com.au>
Date: Sun, 26 Oct 2003 23:11:49 +1100
NNTP-Posting-Host: 203.103.152.66
X-Trace: nnrp1.ozemail.com.au 1067170310 203.103.152.66 (Sun, 26 Oct 2003 23:11:50 EST)
NNTP-Posting-Date: Sun, 26 Oct 2003 23:11:50 EST

Reply to Parent Message