New Virus ALERT for XP,2000 and NT Users.

[Sal UK]

ntlhome customers may currently be experiencing problems with their PC arising from a Windows vulnerability.

This looks to be related to a new internet virus/worm discovered today.

For detailed info and ways to restore service please see the following links.

The following link will direct you to a Microsoft page with instructions on how to install a patch which will restore service :-

http://www.microsoft.com/technet/tre...n/MS03-026.asp


This was posted News from my ISP.

Thought I would let you all know.

For More Information Check it out here...
http://www.ntl-isp.ntl.com/lookup/default.asp

[Hellfighter]

Not Affected Software:

Microsoft Windows Millennium Edition

some ways i glade i have not upgraded to xp

[Sal UK]

Yep I didnt like XP so I went back to my WinME ages ago.

[A TIN OF SOUP]

I have XP and yesterday I got the worm...

It took less than 2 mins to install the security fix and remove the worm, Never lost a thing!

XP ROCKS!!!!!!!

[Scott]

How did you know you had the worm?

[A TIN OF SOUP]

Most of my squad and some family members all got it between 6.30 and 10.00 last night.

The worm causes an error box to appear which counts down from 60 seconds then re-starts ur PC.... This only happens when connected to the net. This is all this worm does and is verry easy to get rid of.

It also only affects people with WIn NT XP or 200o. That did not run a firewall.
More info here click here

[Scott]

I went through 2 formats, then went out and bought a new network card & modem last night cause everytime I went online I got the stupid countdown. I figured it out that it did it everytime I was connected but I thought it might have just not been able to communicate to the modem or somthing like that... Got home after all this trying to get online long enough to download a patch that someone suggested and finally got it installed. no more errors. That fudgeing pisses me off. And I cant return the modem or card...

[Scott]

Moved to main news so not everyone does what I did....

[A TIN OF SOUP]

jeesh dude that sucks!

It was on CNN.com and other news sites,,,

Hell If ud checked the A TIN OF forum ud have saved urself a packet!

[Steve]

i heard about it
so updated nortons virus definitions
then the virus sativead and shut me down lol

[Sal UK]

Originally posted by A TIN OF SOUP
jeesh dude that sucks!

It was on CNN.com and other news sites,,,

Hell If ud checked the A TIN OF forum ud have saved urself a packet!

This looks like what happend to you m8, You had the virus already then tried to patch it the virus stopped it from patching.

According to symantec:
"The worm also attempts to perform a Denial of Service (DoS) on Windows Update. This is an attempt to prevent you from applying a patch on your computer against the DCOM RPC vulnerability."

[Sal UK]

[B]ooOOOPs WAS meant to Quote StevieB.

[Hayzee]

I've had a nightmare with it... not quite to Panther's extreme... finally got rid of it this eve !!!

HayZee

[Ice Cannon]

Yeh the worm looks pretty nasty, I do windows update regularly and double checked it so I hope that'll protect me...

Symantec has an easy utility to remove the worm:
http://securityresponse.symantec.com...r/FixBlast.exe

everyone should make sure they have all the latest windows updates from:
http://windowsupdate.microsoft.com/

On August 16 every computer infected with the worm will perform a DoS attack on Microsofts windows update.

Heres a news article and info on the worm:
http://zdnet.com.com/2100-1105_2-5062477.html

"The worm attacks Windows computers via a flaw in a component of the operating system that allows other computers to ask Windows systems to perform an action or service. Microsoft warned about the flaw July 16. The component, known as the remote procedure call (RPC) process, facilitates activities such as sharing files and allowing others to use a computer's printer. By sending too much data to the RPC process, an attacker can cause the system to grant full access to its resources. " - Sounds nasty!

[Sal UK]

Well I have WinME but still had to protect the file in question that it attacks.

I used the Symantec Tool also.So WinME users may as well
protect themselves just in case it aint just XP,2000,NT.

[BLADE =GH=]

I read this on OGN where you don't need a patch or such, worth a look guys. Show how to find it and disinfect it.
http://forums.ogn.com.au/showthread....&threadid=8423

[Hellfighter]

here more info on the patch
Link:
http://www.microsoft.com/technet/tre...n/MS03-026.asp

[Hellfighter]

Originally posted by BLADE =GH=
I read this on OGN where you don't need a patch or such, worth a look guys. Show how to find it and disinfect it.
http://forums.ogn.com.au/showthread....&threadid=8423

i like the info on the ports listing there i added them to my fire wall i using windows me but if that hacker or person who made that worm dose a bet of update those ports are now blocked. thanks

[Stu]

Just like to say its on BT open world aswell, norton will fix thoe.

[Hellfighter]

W32.Sobig.E@mm has been updated to W32.Sobig.F@mm
Discovered on: August 18, 2003
Last Updated on: August 21, 2003 01:26:18 PM

Due to the number of submissions received from customers, Symantec Security Response has upgraded this threat to a Category 4 from a Category 3 threat as of August 21, 2003.

W32.Sobig.F@mm is a mass-mailing, network-aware worm that sends itself to all the email addresses it finds in the files that have the following extensions:


.dbx
.eml
.hlp
.htm
.html
.mht
.wab
.txt

The worm uses its own SMTP engine to propagate and attempts to create a copy of itself on accessible network shares, but fails due to bugs in the code.
more info link:
[url]http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html[/b]