OT: New Virus?

John Hanson said:

Anyone hear about a new virus that acts like the blaster worm but none
of the current fixes will work? It will shutdown RPC or perhaps some
other service and then a dialog box pops up saying that windows will
restart because of it in 60 seconds. I have a customer that got hit
with one like it and so did a friend of mine. The customer got hit a
week ago Saturday and the friend this past Saturday.

Dunno, but something does seem to be going around. I've seen a few
pif files showing up on some yahoo groups lately.

-----------
Proton Soup

"And all this peace has been deceiving,
I need some wind to get me sailing"

On Mon, 11 Apr 2005 23:32:58 -0500, Proton Soup <[email hidden]>
wrote in misc.fitness.weights:

Quoted message said:

John Hanson said:

Anyone hear about a new virus that acts like the blaster worm but none
of the current fixes will work? It will shutdown RPC or perhaps some
other service and then a dialog box pops up saying that windows will
restart because of it in 60 seconds. I have a customer that got hit
with one like it and so did a friend of mine. The customer got hit a
week ago Saturday and the friend this past Saturday.

Dunno, but something does seem to be going around. I've seen a few
pif files showing up on some yahoo groups lately.

The customer that I have that I think is infected has a system that
has never been patched or updated since it was installed back in 2003.
It sits on a VLAN and they didn't think that it was accessible from
the outside world as they couldn't surf the net from any of those
machines. I worked until 9:00 last night with 3 different people in
their IT department and we still couldn't fix the damned thing. It
seemed the more we tried to fix it (antivirus and spyware software as
well as patches), the worse if functioned.

"John Hanson" <[email hidden]> wrote

Quoted message said:

The customer that I have that I think is infected has a system that
has never been patched or updated since it was installed back in 2003.
It sits on a VLAN and they didn't think that it was accessible from
the outside world as they couldn't surf the net from any of those
machines. I worked until 9:00 last night with 3 different people in
their IT department and we still couldn't fix the damned thing. It
seemed the more we tried to fix it (antivirus and spyware software as
well as patches), the worse if functioned.

I know the feeling.

I got some crapon my computers and a number of client's computers 2-3 months
back. There was no fix. No matter what we tried. And they all were
different problems too.

We ended up replacing half of the machines and doing a total hard drive
format on everything else. Had to update/replace some software too. Big
expense all around. There just was no way to fix them. It was a week plus
of hell working about twenty hours a day.

I get sleepy thinking about it.

John Hanson said:

On Mon, 11 Apr 2005 23:32:58 -0500, Proton Soup <[email hidden]>
wrote in misc.fitness.weights:

Quoted message said:

John Hanson said:

Anyone hear about a new virus that acts like the blaster worm but
none of the current fixes will work? It will shutdown RPC or
perhaps some other service and then a dialog box pops up saying
that windows will restart because of it in 60 seconds. I have a
customer that got hit with one like it and so did a friend of mine.
The customer got hit a week ago Saturday and the friend this past
Saturday.

Dunno, but something does seem to be going around. I've seen a few
pif files showing up on some yahoo groups lately.

The customer that I have that I think is infected has a system that
has never been patched or updated since it was installed back in 2003.
It sits on a VLAN and they didn't think that it was accessible from
the outside world as they couldn't surf the net from any of those
machines. I worked until 9:00 last night with 3 different people in
their IT department and we still couldn't fix the damned thing. It
seemed the more we tried to fix it (antivirus and spyware software as
well as patches), the worse if functioned.

Stinger work?

From: "John Hanson" <[email hidden]>

| The customer that I have that I think is infected has a system that
| has never been patched or updated since it was installed back in 2003.
| It sits on a VLAN and they didn't think that it was accessible from
| the outside world as they couldn't surf the net from any of those
| machines. I worked until 9:00 last night with 3 different people in
| their IT department and we still couldn't fix the damned thing. It
| seemed the more we tried to fix it (antivirus and spyware software as
| well as patches), the worse if functioned.
|

You will have to supply facts about what you are experiencing, what anti virus software (and
their versions) and all tools used to find or fix the problem.

Please -- Describe your problems fully.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

John Hanson said:

On Mon, 11 Apr 2005 23:32:58 -0500, Proton Soup <[email hidden]>
wrote in misc.fitness.weights:

Quoted message said:

John Hanson said:

Anyone hear about a new virus that acts like the blaster worm but none
of the current fixes will work? It will shutdown RPC or perhaps some
other service and then a dialog box pops up saying that windows will
restart because of it in 60 seconds. I have a customer that got hit
with one like it and so did a friend of mine. The customer got hit a
week ago Saturday and the friend this past Saturday.

Dunno, but something does seem to be going around. I've seen a few
pif files showing up on some yahoo groups lately.

The customer that I have that I think is infected has a system that
has never been patched or updated since it was installed back in 2003.
It sits on a VLAN and they didn't think that it was accessible from
the outside world as they couldn't surf the net from any of those
machines. I worked until 9:00 last night with 3 different people in
their IT department and we still couldn't fix the damned thing. It
seemed the more we tried to fix it (antivirus and spyware software as
well as patches), the worse if functioned.

I'm not sure web access means much. Lots of ports could still be
open, and probably were considering the way companies like to maintain
remote access to machines for monitoring, etc. And well, you did say
it shuts down RPC, which is what, "Remote Procedure Call"?

If the virus has invaded the boot sector of the HD, I don't think
there's any way you're going to be able to fix it without booting from
another disk, like maybe a CD. Of course, the easiest way to fix it
is to reformat.

-----------
Proton Soup

"And all this peace has been deceiving,
I need some wind to get me sailing"

Proton Soup said:

John Hanson said:

On Mon, 11 Apr 2005 23:32:58 -0500, Proton Soup <[email hidden]>
wrote in misc.fitness.weights:

Quoted message said:

On Mon, 11 Apr 2005 21:44:35 -0500, John Hanson
<[email hidden]> wrote:

>Anyone hear about a new virus that acts like the blaster worm but

none

Quoted message said:

Quoted message said:

Quoted message said:

>of the current fixes will work? It will shutdown RPC or perhaps

some

Quoted message said:

Quoted message said:

Quoted message said:

>other service and then a dialog box pops up saying that windows

will

Quoted message said:

Quoted message said:

Quoted message said:

>restart because of it in 60 seconds. I have a customer that got

hit

Quoted message said:

Quoted message said:

Quoted message said:

>with one like it and so did a friend of mine. The customer got

hit a

Quoted message said:

Quoted message said:

Quoted message said:

>week ago Saturday and the friend this past Saturday.

Dunno, but something does seem to be going around. I've seen a few
pif files showing up on some yahoo groups lately.

The customer that I have that I think is infected has a system that
has never been patched or updated since it was installed back in

2003.

Quoted message said:

Quoted message said:

It sits on a VLAN and they didn't think that it was accessible from
the outside world as they couldn't surf the net from any of those
machines. I worked until 9:00 last night with 3 different people in
their IT department and we still couldn't fix the damned thing. It
seemed the more we tried to fix it (antivirus and spyware software

as

Quoted message said:

Quoted message said:

well as patches), the worse if functioned.

I'm not sure web access means much. Lots of ports could still be
open, and probably were considering the way companies like to

maintain

Quoted message said:

remote access to machines for monitoring, etc. And well, you did say
it shuts down RPC, which is what, "Remote Procedure Call"?

If the virus has invaded the boot sector of the HD, I don't think
there's any way you're going to be able to fix it without booting

from

Quoted message said:

another disk, like maybe a CD. Of course, the easiest way to fix it
is to reformat.

We're reformatting as I type.

On Tue, 12 Apr 2005 13:41:57 GMT, "Jay" <[email hidden]> wrote in
misc.fitness.weights:

Quoted message said:

John Hanson said:

On Mon, 11 Apr 2005 23:32:58 -0500, Proton Soup <[email hidden]>
wrote in misc.fitness.weights:

Quoted message said:

On Mon, 11 Apr 2005 21:44:35 -0500, John Hanson
<[email hidden]> wrote:

> Anyone hear about a new virus that acts like the blaster worm but
> none of the current fixes will work? It will shutdown RPC or
> perhaps some other service and then a dialog box pops up saying
> that windows will restart because of it in 60 seconds. I have a
> customer that got hit with one like it and so did a friend of mine.
> The customer got hit a week ago Saturday and the friend this past
> Saturday.

Dunno, but something does seem to be going around. I've seen a few
pif files showing up on some yahoo groups lately.

The customer that I have that I think is infected has a system that
has never been patched or updated since it was installed back in 2003.
It sits on a VLAN and they didn't think that it was accessible from
the outside world as they couldn't surf the net from any of those
machines. I worked until 9:00 last night with 3 different people in
their IT department and we still couldn't fix the damned thing. It
seemed the more we tried to fix it (antivirus and spyware software as
well as patches), the worse if functioned.

Stinger work?

No

John Hanson said:

Anyone hear about a new virus that acts like the blaster worm but none
of the current fixes will work? It will shutdown RPC or perhaps some
other service and then a dialog box pops up saying that windows will
restart because of it in 60 seconds. I have a customer that got hit
with one like it and so did a friend of mine. The customer got hit a
week ago Saturday and the friend this past Saturday.

Computer-fixing isn't my thing so my question might sound naive.
(I go to experts-exchange.com when I get in trouble.)

If your customer had System Restore or Norton GoBack or something like
these programs, couldn't you (or s/he) fix any type of virus problem?
I guess you might also have to disable these programs to run a virus
scan on a Restore folder where an infected file could be stored as a
backup file. If I'm correct about this, why not advise all your
customers to get this kind of program? Sure s/he might have to update
and reinstall stuff, but it would be far less drastic than formatting.

John Hanson said:

On Wed, 20 Apr 2005 22:22:41 GMT, [email hidden] wrote in
misc.fitness.weights:

Quoted message said:

John Hanson said:

Anyone hear about a new virus that acts like the blaster worm but none
of the current fixes will work? It will shutdown RPC or perhaps some
other service and then a dialog box pops up saying that windows will
restart because of it in 60 seconds. I have a customer that got hit
with one like it and so did a friend of mine. The customer got hit a
week ago Saturday and the friend this past Saturday.

Computer-fixing isn't my thing so my question might sound naive.
(I go to experts-exchange.com when I get in trouble.)

If your customer had System Restore or Norton GoBack or something like
these programs, couldn't you (or s/he) fix any type of virus problem?
I guess you might also have to disable these programs to run a virus
scan on a Restore folder where an infected file could be stored as a
backup file. If I'm correct about this, why not advise all your
customers to get this kind of program? Sure s/he might have to update
and reinstall stuff, but it would be far less drastic than formatting.

Three of their IT people couldn't fix it (I'm pretty sure it trashed
the registry). They are not a contract customer so they get very
little input from us. They only call when things are broke and the
"front end" is only a small part of what we service.

Our contract customers get all updates installed by us plus we make
complete images of their servers on a weekly or monthly basis as well
as nightly backups of their databases. We make images of their client
stations on an occasional basis or when they get updated. Sounds like
they are going to be a contract customer soon:-)

This server that was hit doesn't have access to the Internet but does
have access to another network (the customer didn't know this) that
does. I think that is where it came from. As it was, reformatting
and reloading wasn't much of a problem. We saved the SQL database and
other pertinent files. BTW, dual 2.4 Xeon processors rock for loading
software.

Sounds like your contract customers are well-protected.

Was this the problem and the way to fix it?
http://www.mvps.org/marksxp/WindowsXP/rpc.php

Well, if you numbnutz idiots don't know about S&D's "SD resident"
program, those kind of things will happen to you.

On Thu, 21 Apr 2005 11:16:10 GMT, [email hidden] wrote in
misc.fitness.weights:

Quoted message said:

John Hanson said:

On Wed, 20 Apr 2005 22:22:41 GMT, [email hidden] wrote in
misc.fitness.weights:

Quoted message said:

On Mon, 11 Apr 2005 21:44:35 -0500, John Hanson
<[email hidden]> wrote:

>Anyone hear about a new virus that acts like the blaster worm but none
>of the current fixes will work? It will shutdown RPC or perhaps some
>other service and then a dialog box pops up saying that windows will
>restart because of it in 60 seconds. I have a customer that got hit
>with one like it and so did a friend of mine. The customer got hit a
>week ago Saturday and the friend this past Saturday.

Computer-fixing isn't my thing so my question might sound naive.
(I go to experts-exchange.com when I get in trouble.)

If your customer had System Restore or Norton GoBack or something like
these programs, couldn't you (or s/he) fix any type of virus problem?
I guess you might also have to disable these programs to run a virus
scan on a Restore folder where an infected file could be stored as a
backup file. If I'm correct about this, why not advise all your
customers to get this kind of program? Sure s/he might have to update
and reinstall stuff, but it would be far less drastic than formatting.

Three of their IT people couldn't fix it (I'm pretty sure it trashed
the registry). They are not a contract customer so they get very
little input from us. They only call when things are broke and the
"front end" is only a small part of what we service.

Our contract customers get all updates installed by us plus we make
complete images of their servers on a weekly or monthly basis as well
as nightly backups of their databases. We make images of their client
stations on an occasional basis or when they get updated. Sounds like
they are going to be a contract customer soon:-)

This server that was hit doesn't have access to the Internet but does
have access to another network (the customer didn't know this) that
does. I think that is where it came from. As it was, reformatting
and reloading wasn't much of a problem. We saved the SQL database and
other pertinent files. BTW, dual 2.4 Xeon processors rock for loading
software.

Sounds like your contract customers are well-protected.

Was this the problem and the way to fix it?
http://www.mvps.org/marksxp/WindowsXP/rpc.php

That was one of them. Thanks for that.