Virus Battle.

Originally posted by LivingLegend
It's oke now! (I hope)

I've red the warning as well, now what exactly do you have to download to prevent it from reaching your computer?

Olav

Originally posted by kyngj
Echoing Rwingett -

[b] now what exactly do you have to download to prevent it from reaching your computer?

buy a Mac ;-)[/b]

Originally posted by Phlabibit
I hate Mac.... But now I hate my computer at home.

Do you find there are programs your computer won't run? I need my 3d games and 3dMax and other programs I hear don't run on a Mac...

Is there times when you would like to get a program but it won't run on your Mac?? Keep me posted.

Phla-

Urhh, what a bastard of a virus. I was typing a message to Zach, mentioning how glad I was to get rid of the bloody thing when it reset my computer again LOL. I actually spent an hour of fiddling with my ram, and then out of frustration reformatted, before I realized it was a man made problem (silly me). It carried across when I wiped my HD because I saved a few things (music, bookmarks, porn), GRRRRRRRRRRR.

No doubt someone has posted this stuff earlier in the thread, but no harm in posting again (too tired to read the thread now).


Firstly you may want to read through this link to get an idea of wat to do.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Here's the fix, you may want to run your virus scanner (update it first) before and after you run the program, just to make sure.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

And here is the patch that SHOULD prevent it from infecting again. I read about the flaw this virus takes advantage of a week ago, but didn't bother with the patch until now 😳.

http://support.microsoft.com/default.aspx?scid=kb;en-us;823980

Originally posted by rwingett
Hmmm...interesting statement. You start off by claiming to hate Mac, and then reveal that you know very little about Macs.

Many programs (especially games) are released with only a Windows version, but this is a limitation of the software, not the hardware. A Mac will run whatever you need.

Originally posted by dyl
Urhh, what a bastard of a virus. I was typing a message to Zach, mentioning how glad I was to get rid of the bloody thing when it reset my computer again LOL. I actually spent an hour of fiddling with my ram, and then out of frustration reformatted, before I realized it was a man made problem (silly me). It carried across when I wiped my HD because I saved a few ...[text shortened]... with the patch until now 😳.

http://support.microsoft.com/default.aspx?scid=kb;en-us;823980

There are a couple of other things you should do, if you don't have a firewall, if you find yourself with the virus. Those sites people have listed above are definitely where you should go to find information, but here is a quick way to fix it without wading through the techie stuff.

1) Go to My Computer/Control Panel/My Network Places. Here you must choose your local connection, double click, go to properties, go to advanced and "CHECK" the firewall option for now. Keep it checked until we do the update.

2) Now go download this file from Microsoft.com: http://microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=2354406C-C5B6-44AC

3) Now that you have downloaded this, double click and initiate setup. Be sure that the patch you download is in the same language as your Windows Language!

4) After setup,go to the place in step 1 again with the firewall checked(My computer/control panel.....). Now this time "UNCHECK" the firewall option.

5) Make sure you delete the "msblast.exe" entry both from the registry HKEY_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Run, restart the computer, and then delete the actual file from C:\windows\system32. This way the worm won't restart itself every time you reboot.

Note that a firewall will block it as long as you do not have the RPC ports open. This particular one comes over TCP/135.

I hope this information is helpful.

One other note on this. A virus scanner won't pick up exploitable vulnerabilities in an operating system. You can scan as many times as you want, and each time you may just pick up more viruses and trojans, but you'll never find the actual cause, which is the buffer overflow exploit in the RPC service.

Crikey! This is the problem I was having yesterday...I fixed it by changing the properties of some of the files accessed by svchost.exe. Can someone tell me exactly what the "Generic Host Service" is though?

royalchicken, what you have done is simply a band-aid fix. You NEED to download and install the security patch given above, otherwise your computer will still be vulnerable.

Generic Host Services, the short answer: It is a catch-all transport for DNS queries.

Generic Host Services, the long answer: Prior to Windows 2000, some services shared their processes with other, unrelated, services and some even ran in their own process. Windows 2000 introduced the generic service host process, Svchost.exe. The goal was to reduce system resources by consolidating the various processes hosting built-in operating system services into a single process. It can permit the system administrator to configure the system to run certain services in their own processes, which would prevent one service from corrupting the private memory of other unrelated services.

Make sense? 😀

EDIT: Doing a google/msdn search just now, and revising my answer above, I see that there is a lot of potentially confusing information out there. Private mail me if you have any, relatively simple, questions.

Thank you much. I will download the update, and have just updated virus definitions etc.

Originally posted by Montagues
No offence meant none taken
I don't support the virus or the virus author. My point was ,play with fire, risk getting burned. I am sure that all of the software/music you have downloaded is legal. You have just been unlucky with this virus
regards

"My Virus update..."


My machine was still not shutting down right... I will record the text if it comes up this time.

EDIT I am still getting a message saying "Sharedprem.exe" is still running and info will be lost.

Now I am just going to wait for the "count-down" of doom.

Phla-

Phlabibit:

Let me know if this works.

1) Use the task manager to stop the program from running. You'll likely find it under the Processes tab. Then delete the file (just use Find to locate it).

2) You must also remove the file from your registry. So Start--->Run then type "regedit." Use the directory tree to navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and then delete the value "sharedprem"="%System%\sharedprem.exe"

3) Restart your machine

Originally posted by Capulets
Sorry.Juliet