Sip Posted August 16, 2003 Report Share Posted August 16, 2003 EDIT: was previouslly titled: "How To Remove Msblast Worm From Your Pc" but seems like more of these RPC hole worms are popping up. A lot of people seem to have this stupid worm these days. If you haven't updated your windows recently (using windows update) you are at risk since this exploits a pretty huge security hole in windows. this article at cnet will tell you how to get rid of msblast if you have it. Quote Link to comment Share on other sites More sharing options...
Harut Posted August 16, 2003 Report Share Posted August 16, 2003 is this the one that reboots the system? Quote Link to comment Share on other sites More sharing options...
Sip Posted August 16, 2003 Author Report Share Posted August 16, 2003 Not exactly sure what it does ... all I know is that I think this one exploits the buffer overflow problem with windows RPC (remote procedure call) that can be used to run any program on any pc! So basically, it can be used to do anything. From what I have heard, this thing also then uses your PC as part of a big denial of service (DoS) attack against microsoft servers. Quote Link to comment Share on other sites More sharing options...
Accelerated Posted August 21, 2003 Report Share Posted August 21, 2003 Hey guys, I got this worm, used the procedure as outlined in the link posted by Sip (thanks Sip). Found and deleted the exe file etc. But now when I connect to the internet (via 56K modem), my machine keeps uploading (ie. sending data out, maybe to the MS server). I've closed Kazaa, so wtf is going on!? Quote Link to comment Share on other sites More sharing options...
Sip Posted August 21, 2003 Author Report Share Posted August 21, 2003 Not sure what it could be bud ... One way to find out what's happening is to use windump. It's very easy to download and run that program ... just get the exe file and there is a pcap dll file that you should also download and put in the same directory as the exe file I think (just follow their instructions on their download page). Then, when you run windump, it will print out all the incoming and outgoing packets in your PC. From there, we can tell what address the data is going to. Quote Link to comment Share on other sites More sharing options...
Accelerated Posted August 21, 2003 Report Share Posted August 21, 2003 Thanks champ, will give a try.... Quote Link to comment Share on other sites More sharing options...
Sip Posted August 21, 2003 Author Report Share Posted August 21, 2003 Forgot about this ... If you haven't already done so, definitely get and run spybot and adaware. Make sure you update spybot to the latest version and then check. These programs will go through and find spyware or advertising crap that's on your PC ... often installed without your knowledge and remove them. Quote Link to comment Share on other sites More sharing options...
Sip Posted August 30, 2003 Author Report Share Posted August 30, 2003 I am giving this thread a bump for those who might have missed it. As it turns out, I got this stupid thing on my laptop. I hadn't used it for a couple of months and forgot to update it before leaving home (it's behind a firewall at home). I was at a cheap motel while traveling and happened to plug it into an unprotected internet dialup connection (yes, I know, I was pretty amuzed with the symbolisms myself) ... and before you know it ... BHAM ... within a matter of seconds I got hit with this piece of SH!T worm Oh and to make matters worse, while I was trying to fix MSBlast, I got hit with W32.Welchia ... it's another Mother-Father piece of crap worm that spreads like msblast I think. So check your PCs ... if you havent ... you probably have it Quote Link to comment Share on other sites More sharing options...
Accelerated Posted September 1, 2003 Report Share Posted September 1, 2003 Yeah Sip, I think I got rid of Blaster (Welchia prob did it for me - LOL). How did you get rid of Welchia. I got latest Norton Antivirus update, doesnt want to so it Quote Link to comment Share on other sites More sharing options...
Sip Posted September 1, 2003 Author Report Share Posted September 1, 2003 First you may have to kill the "DLLHOST" process (control-alt-delete, task manager, and look under processes) Then take a look at this site: Symantec W32.Welchia.Worm Removal Tool Basically this tool http://www.symantec.com/avcenter/FixWelch.exe can help you get rid of welchia. Hope this helps! Quote Link to comment Share on other sites More sharing options...
Accelerated Posted September 1, 2003 Report Share Posted September 1, 2003 Thanks buddy, got rid of it, and the constant uploading is gone.... Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.