Eliminating the RPC exploit for good?

[brvheart]

Hello,

Thanks all for addressing this RPC issue so well here at PCMech. I'd be lost without it.

I was able to address the problem I was having with the RPC message and rebooting by first downloading the Windows update addressing the RPC exploit, then installing a firewall trial from Sygate.

My question is how do I permanently erase the threat of this intrusion? I blocked the request for msblast, but it still comes up and gets blocked by the firewall. How do I permanently get rid of this? The MS update hasn't done it.

And also, does anyone know how to actually block port 135 on Sygate's firewall? And is this a good firewall to invest in? Right now I'm using a trial and am wondering if this is a decent program to buy.

[gonzo4904]

W32.Blaster.Worm VIRUS


It seems this is the little bugger causing all the havoc today.
if your system is about to shut down, you can cancel it by going to
start>run>cmd, then type "shutdown -a"

once you do that the shutdown will be cancelled. Hit ctrl-alt-delete, look for a process called msblast.exe, this is the worm.

kill that process.

then go to c:\windows\system32. look for the file msblast.exe, and rename it to something else, ex msblast.vir or something.

now got to c:\windows\prefetch and delete the file that has msblast.exe in its name.


also, you must remove an entry from your registry

start>run>regedit, enter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

find the key "windows auto update"="msblast.exe"
and delete it.

Also it looks like this only affects people(running XP) without windows XP SP1, if you do not have service pack 1 installed, i highly!!! reccomend it.
_________________
G

[pam123]

Any decent firewall should do it.
I almost missed this entirely since I use the free ZoneAlarm (after I heard about it I downloaded and installed the Windows' patch anyway) and Sygate's firewall is every bit as good.
What does not seem to work in the firewall in XP.

If it's still turning up gonzo's advice should do it or you need a visit to one of the on-line sites for checks and removals.
Try the advice first.

[brvheart]

Great information! Thanks.

I was just doing all the steps you mentioned Gonzo, but regedit won't stay open for more than about a second. Anyone know why?

[pam123]

That sounds like a viral rewrite.
Try safemode if you haven't already done so.

[Pounder]

are you using the run command, you need to use the command prompt, also in XP you use regedt32 I believe

[brvheart]

hmmm. still goes away after 1 second no matter how I open it.

[pam123]

Not good.
It's like not tracing malaria to the source, it won't do.

[KHT]

Check here