Win32 Blaster Worm is on the Rise

EvilNight writes "You know you've got it when a 60 second shutdown timer pops up on your screen. The virus uses the RPC vulnerability. It looks like it's reaching critical mass today. Luckily, it's an easy one to stop: Download this security update. Once you've installed that patch, go here and download the removal tool." Update: 08/12 19:19 GMT by M : Security bulletin URL corrected.

Comments

Wrong link

[JPelzer]

Shouldn't the "Removal Tool" link point to a Linux ISO download site or something? I mean, this is slashdot... :-)

The Rise

[mao che minh]

DOOM-DOOM-DOOM-DOOM DOOM *PANG*
DOOM-DOOM-DOOM-DOOM DOOM * PANG*

At 10:06 AM, August 12th, 2003, Skynet launched dah Win32 Blaster Wahm. It quickly seized contrahl of ahh computers on the Net and forced a mahndatory reboot.

OK this is getting old.....

Virus

[Anonymous Coward]

If this thing wouldn't keep crashing computers, it would be spreading like greased wildfire.

This thing hit our customers yesterday...

[Snarfangel]

I work at an ISP, and over half of our tech support calls yesterday were because of this worm. You wouldn't believe the number of people who thought we were somehow going into their computer and not only kicking them off the internet, but rebooting their computers. (Yes, sir, the tech support staff feels horribly underworked today, so we thought we'd make things more exciting and pi** off a few customers in the process.) I hope they find the person involved and perform medical experiments on him.

Just seen an ATM affected...

[mccalli]

Seriously. If you fancy a laugh, and you're working in the City of London, then go to the Halifax ATM between Canon Street and Poultry.

Then try, really, really hard to stop laughing...

Cheers,
Ian

I might not be speaking for everyone, but I say:

[burgburgburg]

I welcome our new Skynet Overlords.

Re:Echoes

[fishbert42]

'You'd think every hotmail account would get a message saying "Plug that hole" from whoever it is that runs hotmail.'

Actually, in my hotmail spam repository account I already do get tons of messages saying things like that. But, I don't think they're talking about computer security. =)

Re:shutdown /a

[ChiefArcher]

Supposively, if they don't fix it by this weekend, all the infected boxes are going to attack microsoft's website all at once.

So in my opinion.... Don't patch it :)

ChiefArcher

Re:shutdown /a

[RoLi]

I mean that's how you're supposed to setup any operating system. No net connection until you've got all the necessary patches installed and firewalls set up.

Exactly! It's pretty easy, actually:

• Unplug Internet connection
• Download patches from the Internet
• Set up firewall
• Plug in Internet connection

If that doesn't work, just send an email to support@microsoft.com

Re:shutdown /a

[Geek of Tech]

That almost makes me want to infect my box. Oh well.

Re:shutdown /a

[Nucleon500]

Does the worm work with Wine?

Re:shutdown /a

[inKubus]

Sorry to whore this out here, but has anyone actually looked at the patch? I mean, this affects a rather important part of the Windows operating system. RPC is used for interprocess communication, named pipes, etc. Couldn't the CIA or something put a bug in it that will forward everything you cut and paste, type, send, etc. to some other entity? And what better way to get the masses to install it than a little worm to exploit a hole they purposely left open?

Furthermore, Microsoft paid out $520M only yesterday due to patent infringement with a component in MSIE.

I mean, I'm all patched up, so I know I'm safe but.. oh shit.. the shutdown timer just popped up! Microsoft must be reading what I'm typing. If only I can do this thing quick enough. OH FUCK I have to wait 20 seconds from the time I hit the reply button til when I press submit and it's getting down near 1 nowwwww