Win32 Blaster Worm is on the Rise

EvilNight writes "You know you've got it when a 60 second shutdown timer pops up on your screen. The virus uses the RPC vulnerability. It looks like it's reaching critical mass today. Luckily, it's an easy one to stop: Download this security update. Once you've installed that patch, go here and download the removal tool." Update: 08/12 19:19 GMT by M : Security bulletin URL corrected.

Comments

Wrong link

[JPelzer]

Shouldn't the "Removal Tool" link point to a Linux ISO download site or something? I mean, this is slashdot... :-)

The Rise

[mao che minh]

DOOM-DOOM-DOOM-DOOM DOOM *PANG*
DOOM-DOOM-DOOM-DOOM DOOM * PANG*

At 10:06 AM, August 12th, 2003, Skynet launched dah Win32 Blaster Wahm. It quickly seized contrahl of ahh computers on the Net and forced a mahndatory reboot.

OK this is getting old.....

Re:shutdown /a

[Pionar]

>Why he hadn't fixed it already is a mystery, especially since slashdot.org is his homepage.

You actually believe that reading /. makes you smart? Apparently, you never read comments below 5.

Virus

[Anonymous Coward]

If this thing wouldn't keep crashing computers, it would be spreading like greased wildfire.

Re:shutdown /a

[whiteranger99x]

Apparently, you never read comments below 5.

In some cases even THAT doesn't mean you'll see smart comments

(hell, look at MY 5 point comments sometime lol ;)

Re:Much better removal tool..

[Anonymous Coward]

I tried that and nothing happened ??

Microsoft(R) Windows DOS
(C)Copyright Microsoft Corp 1990-2001.

C:\>fdisk
'FDISK' is not recognized as an internal or external command,
operable program or batch file.

C:\>format
Required parameter missing -

C:\>install FreeBSD

C:\>WTF !!!

This thing hit our customers yesterday...

[Snarfangel]

I work at an ISP, and over half of our tech support calls yesterday were because of this worm. You wouldn't believe the number of people who thought we were somehow going into their computer and not only kicking them off the internet, but rebooting their computers. (Yes, sir, the tech support staff feels horribly underworked today, so we thought we'd make things more exciting and pi** off a few customers in the process.) I hope they find the person involved and perform medical experiments on him.

Just seen an ATM affected...

[mccalli]

Seriously. If you fancy a laugh, and you're working in the City of London, then go to the Halifax ATM between Canon Street and Poultry.

Then try, really, really hard to stop laughing...

Cheers,
Ian

Virus, not starring Jamie Lee Curtis.

[Channard]

Man, it's almost as bad as that Teddy Bear virus *cough*

Re:Windows Update slashdotted?

[javatips]

or maybe the machine reboots every 60s

Re:Good timing...

[irc.goatse.cx troll]

Something similer happened to me yesterday. A friend of mine immed me saying his computer kept saying it had 60 seconds to reboot, and something about rpc crashing. So I responded with a screenshot of dir c:\ running on his machine.
Moral of the story: I'm an asshole.
(For the record, I then told him where to get the patch, and how to cancle a running shutdown.)

I might not be speaking for everyone, but I say:

[burgburgburg]

I welcome our new Skynet Overlords.

Re:A sure fire method to solve this RPC exploit

[caluml]

I paddle my wife, but she still insists on using Windoze.

Threaten to not paddle her - that might make her change.
(She might be darker than you think!)

Re:60 second timer

[razberry636]

Of course, if you're getting hammered this isn't going to help much.

A nasty work is quickly spreading across the internet forcing about 90 percent of the connected computers to become inoperable. Thousands of phones are ringing at IT desks all over the world. On the other ends of those phones are screaming, panicky users crying because their computers won't work. Management is calling because now you're the bottleneck causing inefficiency in the team, and you might need to start looking for a new job if this isn't taken care of. And then you trip over a network cable.

I think getting hammered is the best thing to do right now.

Re:Echoes

[fishbert42]

'You'd think every hotmail account would get a message saying "Plug that hole" from whoever it is that runs hotmail.'

Actually, in my hotmail spam repository account I already do get tons of messages saying things like that. But, I don't think they're talking about computer security. =)

Re:shutdown /a

[MmmmJoel]

"Thought it was just Windows XP being retarded"

It is Windows XP being retarded. Don't second-guess yourself!

Re:shutdown /a

[ChiefArcher]

Supposively, if they don't fix it by this weekend, all the infected boxes are going to attack microsoft's website all at once.

So in my opinion.... Don't patch it :)

ChiefArcher

Re:There are several reasons...

[Surreal_Streaker]

How many of those Linux holes where in the core operating system (IE, kernel + GNU tools)?

IE is not a core part of the core Linux operating system no matter what you've heard.

Re:shutdown /a

[Zak3056]

You actually believe that reading /. makes you smart?

Yeah, what do you think this is, a Holiday Inn Express or something?

Re:shutdown /a

[RoLi]

I mean that's how you're supposed to setup any operating system. No net connection until you've got all the necessary patches installed and firewalls set up.

Exactly! It's pretty easy, actually:

• Unplug Internet connection
• Download patches from the Internet
• Set up firewall
• Plug in Internet connection

If that doesn't work, just send an email to support@microsoft.com

Re:shutdown /a

[Anonymous Coward]

your_girlfriend.exe

Re:Sad really

[RoLi]

Check daily for patches on your software, patch it, reboot, get back to work.

Too bad that this "check daily, patch, reboot" procedures never get mentioned in any MS-paid TCO-analysis.

Re:Honest question

[wfrp01]

What's a port?
Do I have any?
How can I check?

A place where ships are safe from storms. See also 'port of entry'.
You have an output port on your behind.
Do yoga.

Famous last words

[dtfinch]

From the Microsoft security bulletin on the vulnerability:

"This vulnerability only permits a denial of service attack and does not provide an attacker with the ability to modify or retrieve data on the remote machine."

Re:shutdown /a

[Geek of Tech]

That almost makes me want to infect my box. Oh well.

Re:Honest answer

[allism]

Monitoring slashdot...I need to remember that phrase if I ever get reprimanded for excessive internet activity...

seriously, though, I, for one, thank you on the behalf of all us little peon users for testing before patching. I swear, the next time the sysadmin comes around an installs something on my computer that means I have to spend hours fixing my computer before I can do any more of my real work, I'm gonna kick him in the shins...

Re:shutdown /a

[rworne]

(Score:2, Insightful) for a post recommending you download patches with your network cable unplugged. Wow, Slashdot is a haven for those with technical know-how, isn't it.

Perhaps he was meaning to suggest using a wireless access point. That way there is no physical medium for the virus to travel over.

Re:shutdown /a

[Anonymous Coward]

Unless the virus becomes airborne, in which case I'm covering my box with surgical masks and insulating blankets.

Looks like my computer is suffering from a high fever now. I'll give it plenty of fluids and some bedrest.

Re:Gimme A Chance!!

[dirtydiaper]

Don't worry I know your problem.. You put the wrong boot disk in.. The one you want is the CD that says LINUX not Microsoft Windows XP. If that doesnt work.. Open up you case and find the worm.. They are a brownish colour some are a couple inches long.. good luck!

Re:shutdown /a

[Nucleon500]

Does the worm work with Wine?

Re:shutdown /a

[inKubus]

Sorry to whore this out here, but has anyone actually looked at the patch? I mean, this affects a rather important part of the Windows operating system. RPC is used for interprocess communication, named pipes, etc. Couldn't the CIA or something put a bug in it that will forward everything you cut and paste, type, send, etc. to some other entity? And what better way to get the masses to install it than a little worm to exploit a hole they purposely left open?

Furthermore, Microsoft paid out $520M only yesterday due to patent infringement with a component in MSIE.

I mean, I'm all patched up, so I know I'm safe but.. oh shit.. the shutdown timer just popped up! Microsoft must be reading what I'm typing. If only I can do this thing quick enough. OH FUCK I have to wait 20 seconds from the time I hit the reply button til when I press submit and it's getting down near 1 nowwwww

Understanding Win2K Security Rating (mildly OT)

[Embedded Geek]

Jonathan Shapiro of the Johns Hopkins University Information Security Institute recently posted a commentary on the fact that Windows 2000 (with service pack 3) has been assigned a Common Criteria certification Evaluation Assurance Level (EAL) level of 4. In response to the question "What does this mean?", he replies:

Security experts have been saying for years that the security of the Windows family of products is hopelessly inadequate. Now there is a rigorous government certification confirming this.

(Originally taken from rec.humor.funny).

Re:shutdown /a

[1davo]

In a knee-jerk reaction, I quickly downloaded the patch from Redmond and fired it up...

Once I saw the messages saying "Pardon me while I inspect your system...

Then some dialog box popped up with some message about third party blah blah blah.

I came to my senses. Wait just a darn minute. I have not seen the effects of this worm/virus.

So I killed the process. Bring on the RPC crap - it has to be alot better than Bill drilling any deeper into my vanilla laptop used only for browsing the web.

Whew - dodged another one...

Windows & security - the double bind theory of computing.