patch 4 autoshutdown worm in win 2003 server

Status
Not open for further replies.
T

taken

Journeyman
hi,

i have recently loaded windows 2003 standerd edition on my server machine and it has been affected by this

"... will shutdown in 60 seconds... win NT/Authority .." XXX worm.

i got a fix only for win XP pro and windows 2000 server. i have tried with windows 2000 server patch on this OS but it say that the OS is not of proper version. pls suggest me the patch URL. i desperately need it.

reg
taken
 
D

digen

Youngling
Afaik Win2003 is one amonst the few OS's which doesnt get infected by sasser/blaster worm.But I maybe wrong.

Can you please post the exact error message you are recieving? A screenshot would be of great help.
 
R

rajas

In the zone
Sasser Worm will affect WinNT, 2000, XP, Windows Server 2003, Microsoft NetMeeting. (All Versions).


@taken: Check the link for the download patch for WIN Server 2003. Also, it includes the update for all versions of Windows.

*www.microsoft.com/technet/security/bulletin/MS04-011.mspx
 
OP
T

taken

Journeyman
well well,

i have downloaded the patch but it still exists. is there any remedy or other ways to get this problem out???

regs
 
R

rajas

In the zone
Try scanning with Stinger
Stinger is a stand-alone utility used to detect and remove specific viruses
*vil.nai.com/vil/stinger/

OR
Microsoft® Windows® Malicious Software Removal Tool
*www.microsoft.com/downloads/detail...E0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

Both the utilities can clean the computer for Sasser or Blaster Worm/Virus. Try both and post the result.
 
OP
T

taken

Journeyman
so thnsk of ur prompt re:

well, i have downloaded the S/w both stinger and Microsoft one. Ran both of them and could just get nothing:

here is the report of stinger:
----------------
McAfee AVERT Stinger Version 2.5.3 built on Mar 1 2005

Copyright (C) 2005 Networks Associates Technology, Inc. All Rights Reserved.

Virus data file v1000 created on Mar 1 2005.

Ready to scan for 53 viruses, trojans and variants.



Scan initiated on Wed Apr 20 17:23:41 2005

Number of clean files: 17916



Scan initiated on Wed Apr 20 17:27:42 2005

Number of clean files: 17918
--------------------

to say, i have first just intititated the scan and in it, repair was on. later again i scanned with "report" option enabled.

so, i dont find anything sugesting here.

well, reg the other, it just ran and showed that nothing is corrupted or infected.

so, i think when the scan was on progress, it might have cured the virus. i will have to test the system now again as such.

well, is it that at any point of time this worm reenters the system after the scan??? if then i think i will have to scan each and every time i start the PC. isn't it

pls suggest the feedback
taken
 
R

rajas

In the zone
@taken:

The worm hits the RPC services. so, when u clean the traces of the infection and apply the patch, there is no point that it would come back.
If you still get the error of "NT Authority...", its better to reformat. Apply the patch of Sasser/Blaster immediatly B4 u do anything. may be Worm messed-up the RPC Services.
 
Status
Not open for further replies.
Top Bottom