Hard Light Productions Forums

Off-Topic Discussion => General Discussion => Topic started by: RandomTiger on August 12, 2003, 04:46:25 pm

Title: MSBlast - virus warning
Post by: RandomTiger on August 12, 2003, 04:46:25 pm
It got me :)

Get your firewalls up and your virus software updated and wait for your less secure friends to start phoning.

http://news.bbc.co.uk/1/hi/technology/3143625.stm
Title: MSBlast - virus warning
Post by: Taristin on August 12, 2003, 04:52:28 pm
LOL! I heard about this one on the news! It attacks Microsoft from MS enabled computers! Funny stuff...
Title: MSBlast - virus warning
Post by: Ashrak on August 12, 2003, 05:37:58 pm
how do i get rid of it? only antivirus soft?
Title: MSBlast - virus warning
Post by: vyper on August 12, 2003, 05:52:14 pm
Could this be.... this>> http://www.hard-light.net/forums/index.php/topic,16729.0.html
Title: MSBlast - virus warning
Post by: Taristin on August 12, 2003, 06:00:29 pm
*downloads sysgate*
Title: MSBlast - virus warning
Post by: Unknown Target on August 12, 2003, 06:03:00 pm
where can I get the patch? Just the patch, not the fix.
Title: MSBlast - virus warning
Post by: Whitelight on August 12, 2003, 06:12:03 pm
A format will also kill it, but then it would kill all data. It would be an uphill climb trying to re-program.. And to get it back in the condition it was previously in before the bug..

 But then I have a better solution, its called GO BACK it can reinstate all data on your harddrive back to a time before you picked up a nasty bug, or even if your system won`t Boot up. Go Back will hold up to a full weeks restore data (7) days. :)

A Virus program is a must have thing, i have stopped 2 bugs to date, have them trapped on a floppy serving a life sentence:lol: Hmm, now where did I put floppy prison, oh well i`ll just have to make a new one..

There three choices that i know of.. If you choose a virus scanner, don`t forget to update your virus definitions, me I have an auto-update, at lease twice a week.:)
Title: MSBlast - virus warning
Post by: Exarch on August 12, 2003, 06:27:41 pm
Easiest way to get the patch is to simply connect to the internet and run windows update, then grab any updates with 'security' in the title.
Title: MSBlast - virus warning
Post by: Solatar on August 12, 2003, 07:08:51 pm
meh, I just wasted my time downloaded all the updates.:D
Title: MSBlast - virus warning
Post by: IceFire on August 12, 2003, 07:27:25 pm
Quote
Originally posted by Solatar
meh, I just wasted my time downloaded all the updates.:D

Generally thats not a waste of time.  You're probably safe for the next few updates.

Most fixes come out a few weeks before the announcement that a hack or bug is present in the code.
Title: MSBlast - virus warning
Post by: Warlock on August 12, 2003, 07:41:44 pm
Ummm yea,... I just got rid of this bastard.

Fair warning,... I'm running Avast Antivirus, and the full Norton System Works 2003 Suit,...and NONE of them detected nor were able to remove this virus.

If you go to the Norton site you can find info here : http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

They've included a download link for the removal tool (near the bottom) which also links you to the win update page for the windows patch file that will make your system immune to MSBlast.
Note: This only attacks Win2000 and WinXP, it also blocks use of updaters (Winupdate and Norton Liveupdate) and can possibly block internet useage.

Sadly I only knew I had it because I'm constantly using my Win2k's Task monitor to see what programs are kicking and remove background progs,...and I noticed "MSblast.exe" and this morning heard about the virus on the radio going into work, none of my active protections caught the bug.
Title: MSBlast - virus warning
Post by: Turnsky on August 12, 2003, 08:07:21 pm
i think i must be lucky.... i haven't got it yet, that said.. i did download all the security updates..:nod:
Title: MSBlast - virus warning
Post by: TheVirtu on August 12, 2003, 08:10:39 pm
*hugs Windows 98*

I'mm immmmune...immmune!

Windows 95/98/ME arent affected by MSBlaster.
Title: MSBlast - virus warning
Post by: mikhael on August 12, 2003, 09:36:15 pm
I walked into work this morning, dropped my laptop on the docking station and powered up.

And had the network practically all to myself.

All the Windows machines were offline while IT went around with a CD full of the latest patches and patched everyone up. Meanwhile, us FreeBSD and Linux users were able to get our work done with zero hassle. :D

What I want to know is why IT, who push patches to the network clients DAILY,  hadn't patched the clients up to date for a vulnerability that had been reported and patched a month ago?
Title: MSBlast - virus warning
Post by: Liberator on August 13, 2003, 01:08:33 am
The son-of-a-@#$@$ got on my dad's laptop.  The only symptom was a failure of the RPC service when you were connected to the Internet.  I DLed Norton's fix and IT DIDN'T WORK.  So I did a search for files named *blaster*.*.  Bingo, there it was MSBLASTER.EXE  and an associated file.  I looked in the task manager and turned it off and then deleted both files.  Problem solved.  My dad thinks it's my fault anytime anything #@$@s up on his comp because I have installed a few programs and he doesn't know what's going on half the time when I show him anyway.
Title: MSBlast - virus warning
Post by: Kamikaze on August 13, 2003, 01:27:08 am
ah, I wuv my firewall. :D (not that it matters in my case)
Title: MSBlast - virus warning
Post by: diamondgeezer on August 13, 2003, 01:29:15 am
AVG has an update for the bug. Whether it works or not remains to be seen. BTW, I'm no expert on these matters - will my router help protect me against this thing?
Title: MSBlast - virus warning
Post by: Fury on August 13, 2003, 03:00:16 am
Quote
Originally posted by diamondgeezer
will my router help protect me against this thing?

No unless it's a router with firewall. And it's configured to block port 135.
Title: MSBlast - virus warning
Post by: diamondgeezer on August 13, 2003, 03:10:39 am
Just emailed everyone I know about the bug, linkingto the BBC website. Here's my uncle's reply (he's working in China):


Quote
Thanks for the warning, me old fruit, but since this is China the Beeb website has been choppered by the thought police. Never mind, working on the principle that exposure to an infection produces antibodies, thereby bolstering resistance, I should have the hardiest computer on the planet. Since most viruses emanate in China I'm surrounded by them constantly. Most of my neighbours sit up through the night in their undercrackers germinating worms, it's the national sport.

And another thing. Since I'm now receiving more than a hundred e-mails a day for dick pills and wonder-money at my lineone address I've decided to migrate to censored In the three years I've been running this address I haven't had a single spam. If I start getting them now you're a dead man!
Title: MSBlast - virus warning
Post by: Admiral LSD on August 13, 2003, 03:20:00 am
Quote
Originally posted by TheVirtu
*hugs Windows 98*

I'mm immmmune...immmune!

Windows 95/98/ME arent affected by MSBlaster.


That still doesn't mean 9x is a decent OS platform :p

Viruses are the least of it's problems...

I installed the patch on the two machines here that run XP most of the time. When I can be bothered, I'll install it on this one too (as this machine hardly ever boots into XP these days it's hardly a priority).
Title: MSBlast - virus warning
Post by: Darkage on August 13, 2003, 04:01:39 am
I downloaded the pacth and removed the virsus witht the removeal tool and then blocked the port on my router.  Works fine so far:D
Title: MSBlast - virus warning
Post by: Ashrak on August 13, 2003, 04:18:30 am
"got" nav 2003 and killed the worm :D
Title: MSBlast - virus warning
Post by: Darkage on August 13, 2003, 04:24:01 am
Hehe, and i updated windows. That took the longest:D
Title: MSBlast - virus warning
Post by: Warlock on August 13, 2003, 04:57:03 am
Quote
Originally posted by Liberator
The son-of-a-@#$@$ got on my dad's laptop.  The only symptom was a failure of the RPC service when you were connected to the Internet.  I DLed Norton's fix and IT DIDN'T WORK.  So I did a search for files named *blaster*.*.  Bingo, there it was MSBLASTER.EXE  and an associated file.  I looked in the task manager and turned it off and then deleted both files.  Problem solved.  My dad thinks it's my fault anytime anything #@$@s up on his comp because I have installed a few programs and he doesn't know what's going on half the time when I show him anyway.


Did you follow the instructions?  Their site says it may not remove all files the first time...if that happens reboot into Safe mode and run the program again.

If you merely deleted the file ,..you've still got the registry entry the virus created.
Title: MSBlast - virus warning
Post by: RandomTiger on August 13, 2003, 07:05:02 am
I got rid of the virus manually.
Searched for MSBlast.exe on my harddisc and deleted it.
Then I discovered it was running in my task list and terminated it.
Then reset my machine to make sure, then went online to get the fixes etc.

Also its worth noting that XP has a built in firewall you can setup by checking one box.
Title: MSBlast - virus warning
Post by: Odyssey on August 13, 2003, 07:46:20 am
Quote
Originally posted by RandomTiger
Also its worth noting that XP has a built in firewall you can setup by checking one box.

Unfortunately, the behaviour of people means it isn't a viable option. Think about it. If every single person uses the exact same firewall, then what firewall will all the virus programmers aim to get past? And since it's Microsoft, it probably has plenty of holes to get through.
I'm going to follow TheVirtu's example and hug Win98. Out-of-date stuff is generally less vulnerable, since it's a minority :)
Title: MSBlast - virus warning
Post by: Taristin on August 13, 2003, 09:05:13 am
Quote
Originally posted by diamondgeezer's uncle
Thanks for the warning, me old fruit, but since this is China the Beeb website has been choppered by the thought police. Never mind, working on the principle that exposure to an infection produces antibodies, thereby bolstering resistance, I should have the hardiest computer on the planet. Since most viruses emanate in China I'm surrounded by them constantly. Most of my neighbours sit up through the night in their undercrackers germinating worms, it's the national sport.

And another thing. Since I'm now receiving more than a hundred e-mails a day for dick pills and wonder-money at my lineone address I've decided to migrate to censored In the three years I've been running this address I haven't had a single spam. If I start getting them now you're a dead man!
 


ROFLMAO!

They get him for those pills too!
Title: MSBlast - virus warning
Post by: Sandwich on August 13, 2003, 10:44:07 am
[q]Hidden inside the worm are two messages. One.... The other is more cryptic and says: "I just want to say LOVE YOU SAN!"[/q]


*feels all warm and cuddly inside*
Title: MSBlast - virus warning
Post by: RandomTiger on August 13, 2003, 12:09:38 pm
Quote
Originally posted by Odyssey

Unfortunately, the behaviour of people means it isn't a viable option. Think about it. If every single person uses the exact same firewall, then what firewall will all the virus programmers aim to get past? And since it's Microsoft, it probably has plenty of holes to get through.


The firewall seems to be protecting me from getting it back.
Thats all im interested in at the moment.
Title: MSBlast - virus warning
Post by: Woolie Wool on August 13, 2003, 03:11:37 pm
Quote
Originally posted by TheVirtu
*hugs Windows 98*

I'mm immmmune...immmune!

Windows 95/98/ME arent affected by MSBlaster.


*is a proud Win98 user*:nod::yes::cool:
Title: MSBlast - virus warning
Post by: Warlock on August 13, 2003, 05:47:10 pm
Quote
Originally posted by RandomTiger
I got rid of the virus manually.
Searched for MSBlast.exe on my harddisc and deleted it.
Then I discovered it was running in my task list and terminated it.
Then reset my machine to make sure, then went online to get the fixes etc.

Also its worth noting that XP has a built in firewall you can setup by checking one box.


A friend at work told me he deleted the entire file system for the msblast he got,...but it resurfaced each time he went online (then booted him offline again)

Still be a good idea to run the removal tool and download the windows patch fix though. Oddly enough they are paid to do that sort of thing ;)