🚀 go-pugleaf

"A Whiteford" <awhitefo@austarmetro.com.au> wrote in message
news:3f950101@news.comindico.com.au...
> I got the Blaster virus when it was going around a couple of months ago.
I
> downloaded the patch, ran it etc and everything seemed to be OK until last
> night.  My PC has gone into a continuous shutdown loop since then.
>
> I power up and approximately 2 minutes later I get the message which came
> with Blaster that it's being auto powered down.  It turns itself off.  The
> first time this happened I ran Norton's AV which I'd auto updated last
week.
> It didn't identify any viruses.  I also looked at the original Blaster
patch
> information and did a search for the Blaster.exe file - nothing on the PC
> (including in hidden folders).
>
> Q.    So do I have the Blaster virus or something that mimics it?
>
> Since the original power down the time lag between auto power downs has
> decreased so I only have a couple of minutes MAX before the PC auto shuts
> down
>  - can't get anything done on PC in that time
>
>
> Q.    How do I stop this process so I can get an appropriate patch
> installed?
>
> I've been advised to look at a site with info about the
> w32.hllw.gaobot.az.virus info but it's pretty useless if I can't get the
PC
> to stay powered up long enough to download the required patch.
>
> Advice appreciated
> Thanks
>
> Anne
>
>
>
>
Hi Anne

You could download the required patch to another PC; such as the one that
you`re using now; and then put it on a CDR and then try to update your
problem comp from that, if time allows.

http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.az.h
tml

"colin" <colmac14@hotmail.com> wrote in message
news:3f958a5b$0$21651$afc38c87@news.optusnet.com.au...
>
> "A Whiteford" <awhitefo@austarmetro.com.au> wrote in message
> news:3f950101@news.comindico.com.au...
> > I got the Blaster virus when it was going around a couple of months ago.
> I
> > downloaded the patch, ran it etc and everything seemed to be OK until
last
> > night.  My PC has gone into a continuous shutdown loop since then.
> >
> > I power up and approximately 2 minutes later I get the message which
came
> > with Blaster that it's being auto powered down.  It turns itself off.
The
> > first time this happened I ran Norton's AV which I'd auto updated last
> week.
> > It didn't identify any viruses.  I also looked at the original Blaster
> patch
> > information and did a search for the Blaster.exe file - nothing on the
PC
> > (including in hidden folders).
> >
> > Q.    So do I have the Blaster virus or something that mimics it?
> >
> > Since the original power down the time lag between auto power downs has
> > decreased so I only have a couple of minutes MAX before the PC auto
shuts
> > down
> >  - can't get anything done on PC in that time
> >
> >
> > Q.    How do I stop this process so I can get an appropriate patch
> > installed?
> >
> > I've been advised to look at a site with info about the
> > w32.hllw.gaobot.az.virus info but it's pretty useless if I can't get the
> PC
> > to stay powered up long enough to download the required patch.
> >
> > Advice appreciated
> > Thanks
> >
> > Anne
> >
> >
> >
> >
> Hi Anne
>
> You could download the required patch to another PC; such as the one that
> you`re using now; and then put it on a CDR and then try to update your
> problem comp from that, if time allows.
>
>
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.az.h
> tml
>
I agree with Whitford, however you will also need to turn off the "Auto
Restore Feature" assuming you are using XP, prior to applying
patch/anit-virus, or else all your efforts will be in vain.

Once you turn the "feature" off and apply the patch, then turn your machine
off and on a couple of times manually prior to turning the "feature" back
on, this will ensure that you have corrected the problem and hopefully
eliminate any future problems.

Good luck,

Eric

If you are using NT4 Workstation (not Server) it crashes after patch 823559
and 823980 are installed - you have to uninstall 823559 and rely on your
firewall to stop the virus.  Also there are incompatibility issues with
Intellimouse (older versions) and some recent patches [in this case you
would not be able to log in at all, however].  You have to have the latest
version of intellimouse drivers - get them before you do anymore updates.

Microsoft no loger support NT4 Worstation so refuse to fix the problem.


"A Whiteford" <awhitefo@austarmetro.com.au> wrote in message
news:3f950101@news.comindico.com.au...
> I got the Blaster virus when it was going around a couple of months ago.
I
> downloaded the patch, ran it etc and everything seemed to be OK until last
> night.  My PC has gone into a continuous shutdown loop since then.
>
> I power up and approximately 2 minutes later I get the message which came
> with Blaster that it's being auto powered down.  It turns itself off.  The
> first time this happened I ran Norton's AV which I'd auto updated last
week.
> It didn't identify any viruses.  I also looked at the original Blaster
patch
> information and did a search for the Blaster.exe file - nothing on the PC
> (including in hidden folders).
>
> Q.    So do I have the Blaster virus or something that mimics it?
>
> Since the original power down the time lag between auto power downs has
> decreased so I only have a couple of minutes MAX before the PC auto shuts
> down
>  - can't get anything done on PC in that time
>
>
> Q.    How do I stop this process so I can get an appropriate patch
> installed?
>
> I've been advised to look at a site with info about the
> w32.hllw.gaobot.az.virus info but it's pretty useless if I can't get the
PC
> to stay powered up long enough to download the required patch.
>
> Advice appreciated
> Thanks
>
> Anne
>
>
>
>

In article <mnnlb.160824$bo1.113551@news-server.bigpond.net.au>,
 "Michael" <mixstatdonotspam@bigpond.net.au> wrote:

> If you are using NT4 Workstation (not Server) it crashes after patch 823559
> and 823980 are installed - you have to uninstall 823559 and rely on your
> firewall to stop the virus.  
...
> Microsoft no loger support NT4 Worstation so refuse to fix the problem.

The original poster said he got the Blaster virus previously, and it's 
specific to Windows 2000 and XP, so he ain't using NT4.

> "A Whiteford" <awhitefo@austarmetro.com.au> wrote in message
> news:3f950101@news.comindico.com.au...
> > I got the Blaster virus when it was going around a couple of months ago.
> I
> > downloaded the patch, ran it etc and everything seemed to be OK until last
> > night.  My PC has gone into a continuous shutdown loop since then.

Blaster Virus also attacks NT4 - that is what the 823980 patch is for....

See http://www.microsoft.com/security/incident/blast.asp under "Products
Affected by This Worm" in the red box.

I agree that it would have helped if (s)he had stated which version of the
OS (s)he was using.  {Anne looks more like a female name than a "he"]

Michael

"Matthew Kirkcaldie" <Matthew.Kirkcaldie@deletethis.newcastle.edu.au> wrote
in message
news:Matthew.Kirkcaldie-BE3498.15043422102003@seagoon.newcastle.edu.au...
> In article <mnnlb.160824$bo1.113551@news-server.bigpond.net.au>,
>  "Michael" <mixstatdonotspam@bigpond.net.au> wrote:
>
> > If you are using NT4 Workstation (not Server) it crashes after patch
823559
> > and 823980 are installed - you have to uninstall 823559 and rely on your
> > firewall to stop the virus.
> ...
> > Microsoft no loger support NT4 Worstation so refuse to fix the problem.
>
> The original poster said he got the Blaster virus previously, and it's
> specific to Windows 2000 and XP, so he ain't using NT4.
>
> > "A Whiteford" <awhitefo@austarmetro.com.au> wrote in message
> > news:3f950101@news.comindico.com.au...
> > > I got the Blaster virus when it was going around a couple of months
ago.
> > I
> > > downloaded the patch, ran it etc and everything seemed to be OK until
last
> > > night.  My PC has gone into a continuous shutdown loop since then.

In article <hvGlb.161608$bo1.10394@news-server.bigpond.net.au>,
 "Michael" <mixstatdonotspam@bigpond.net.au> wrote:

> Blaster Virus also attacks NT4 - that is what the 823980 patch is for....
> 
> See http://www.microsoft.com/security/incident/blast.asp under "Products
> Affected by This Worm" in the red box.

Thanks for the correction - I use OS X so my interest has been largely 
academic.
 
> I agree that it would have helped if (s)he had stated which version of the
> OS (s)he was using.  {Anne looks more like a female name than a "he"]

Ah yes, the old gender assumption mistake.  A bad afternoon for me.  
Thanks for being poilte about it!

      Cheers,

         Matthew.

On Wed, 22 Oct 2003 15:04:34 +1000, Matthew Kirkcaldie 
>In article <mnnlb.160824$bo1.113551@news-server.bigpond.net.au>,
> "Michael" <mixstatdonotspam@bigpond.net.au> wrote:

>> If you are using NT4 Workstation (not Server) it crashes after patch 823559
>> and 823980 are installed - you have to uninstall 823559 and rely on your
>> firewall to stop the virus.  

>> Microsoft no loger support NT4 Worstation so refuse to fix the problem.

>The original poster said he got the Blaster virus previously, and it's 
>specific to Windows 2000 and XP, so he ain't using NT4.

Hmm.  AFAIK NT 4 does share the RPC etc. defects, though not sure
whether the exploits coded for NT 5.x will work (i.e. infect) or just
crash the system.  Also not sure that there aren't malware (possibly
Lovesan variants) that do infect NT 4.

There's a tendency to lump all RPC-exploiters as "Blaster" - though
the subject line shows a specific awareness of this and includes all
RPC-exploiters - and some use alternate means of spread.  For example,
SDbot.RPC.A can be caught on a Win9x via MIRC etc., even though the
RPC add-on for Win9x doesn't share the same holes as NT's RPC.



>------------------------- ---- --- -- - -  -    -
   Kick-Butt Support!  Call us, explain the problem,
   and we'll pop right over and kick your butt.
>------------------------- ---- --- -- - -  -    -

The Symantec web site says that Blaster does not affect NT systems.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

however Microsoft says NT4 is affected by the Blaster worm and its variants.
See http://www.microsoft.com/security/incident/blast.asp .

If the two major companies involved can't agree what hope have we got?
Considering this is one of the better known worms I would have thought it be
thoroughly analysed and everyone be in agreement.

It would be nice if the original poster could let us know what type of
system she had and how / why she thought it was the Blaster worm and we may
be able to provide more specific answers instead of arguing amongst
ourselves.

When I applied the Blaster worm patch to my NT4 Workstation I got almost the
same problem the original poster described in that the computer would log me
out after a short period (reboot I think).  I therefore reported my
experience and how I got it working again.

Its interesting that the Blaster worm does not appear to continually reboot
the computer but this is what the poster described as a symptom so I think
she may have some confusion about what has actually happened to the system.
If she would respond with more detail we may be in a position to assist.

Michael


"cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in message
news:7efdpvgvdfpsvfmuemlj2pkju4bc31lemj@4ax.com...
> On Wed, 22 Oct 2003 15:04:34 +1000, Matthew Kirkcaldie
> >In article <mnnlb.160824$bo1.113551@news-server.bigpond.net.au>,
> > "Michael" <mixstatdonotspam@bigpond.net.au> wrote:
>
> >> If you are using NT4 Workstation (not Server) it crashes after patch
823559
> >> and 823980 are installed - you have to uninstall 823559 and rely on
your
> >> firewall to stop the virus.
>
> >> Microsoft no loger support NT4 Worstation so refuse to fix the problem.
>
> >The original poster said he got the Blaster virus previously, and it's
> >specific to Windows 2000 and XP, so he ain't using NT4.
>
> Hmm.  AFAIK NT 4 does share the RPC etc. defects, though not sure
> whether the exploits coded for NT 5.x will work (i.e. infect) or just
> crash the system.  Also not sure that there aren't malware (possibly
> Lovesan variants) that do infect NT 4.
>
> There's a tendency to lump all RPC-exploiters as "Blaster" - though
> the subject line shows a specific awareness of this and includes all
> RPC-exploiters - and some use alternate means of spread.  For example,
> SDbot.RPC.A can be caught on a Win9x via MIRC etc., even though the
> RPC add-on for Win9x doesn't share the same holes as NT's RPC.
>
>
>
> >------------------------- ---- --- -- - -  -    -
>    Kick-Butt Support!  Call us, explain the problem,
>    and we'll pop right over and kick your butt.
> >------------------------- ---- --- -- - -  -    -

"Michael" <mixstatdonotspam@bigpond.net.au> wrote in message
news:xcZlb.162941$bo1.129909@news-server.bigpond.net.au...
> The Symantec web site says that Blaster does not affect NT systems.
>
>
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
>

Actually, you are confusing things for some. XP and 2000 are built on NT so
basically it affects NT but not NT4 according to Symantec - which isnt right
anyway.

> however Microsoft says NT4 is affected by the Blaster worm and its
variants.
> See http://www.microsoft.com/security/incident/blast.asp .
>

It IS affected though not as dramatically as XP and 2000.

> Its interesting that the Blaster worm does not appear to continually
reboot
> the computer but this is what the poster described as a symptom so I think
> she may have some confusion about what has actually happened to the
system.

No, actually I think you do. When a hacked machine that is unpatched is
being exited, the DCOM service, set by default to RESTART THE COMPUTER will
restart in 55 seconds. All you have to do is change that to restart the
SERVICE. Better yet, patch the computer.