Comments on: Help us with a windows XP problem, please!

By: Tim Roberts

Tim Roberts — Thu, 01 Jan 1970 00:00:00 +0000

You have been infected by an exploit of the “DCOM RPC Overflow”. The vulnerability has been known for some months, and a fix was made available via Windows Update, but not everyone lets Windows Update run automatically.

http://www.cert.org/advisories/CA-2003-19.html
http://www.kb.cert.org/vuls/id/326746

To my knowledge, there is no way to repair this, short of a reformat and reinstall.

By: Jake Squid

Jake Squid — Thu, 01 Jan 1970 00:00:00 +0000

Be sure to follow the steps for recovery for all other PCs on your network. You don’t want ‘em all going down.

By: PinkDreamPoppies

PinkDreamPoppies — Thu, 01 Jan 1970 00:00:00 +0000

Do you know how to reformat and reinstall?

By: Ampersand

Ampersand — Thu, 01 Jan 1970 00:00:00 +0000

Is that the same thing as wiping the hard drive and starting over?

One problem is that we don’t have a Windows XP CD-Rom. (I know, the dealer who sold Bean her computer should have given her that - but he didn’t).

By: PinkDreamPoppies

PinkDreamPoppies — Thu, 01 Jan 1970 00:00:00 +0000

Yes, it’s the same thing as wiping the harddrive and starting over. Unfortunately, that’s pretty damn hard to do without an XP CD-ROM. Do you know anyone who has an XP CD that you could use? Actually, it would be best if you got in touch with her dealer and saw if you could get one from him/her.

By: Morrigan25

Morrigan25 — Thu, 01 Jan 1970 00:00:00 +0000

Amp, yes formatting and reinstalling is “wipeing the hard drive and starting over”. If you can’t locate a WinXP cd, let me know and we’ll mail you one.

But I don’t see how doing this is going to fix her problem.

here is a link from MS with the patch

http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

and you should get yourselves a firewall (personally I’d recommend zone alarm).

By: PinkDreamPoppies

PinkDreamPoppies — Thu, 01 Jan 1970 00:00:00 +0000

Morrigan,

As I understood it, the patch wouldn’t help once the computer had been infected, if only for the logistical problem of downloading and installing the update patch in the few minutes before the computer crashed.

However, feel free to correct me if I’m wrong.

By: Jake Squid

Jake Squid — Thu, 01 Jan 1970 00:00:00 +0000

If, indeed, you can get the patch downloaded & installed before it crashes, you may be fixed. You can also, if time before crash (now known as TBC) allows, follow the instructions on the Cert page and shut down access over the offending ports. Once you’ve done that you should be OK. Unless you’ve got an infection on your PC (as opposed to some obnoxious hacker just overloading you from outside). Which is likely. So, you also need to do a virus scan to locate and remove the offending software.

Yeah, you really need a firewall. I’m using ZoneAlarm. People I know like Black Ice. My dad is partial to Grisoft. They’re all free for home use. And damned useful they are. I think it’s worthwhile to have anti-virus software. I also recommend Spybot Search & Destroy (which locates & deletes known spybots from your system) which is also free.

But what the hell do I know? I’m just some poor schmoe wandering the internet with no clear idea of where I am or where I want to go.

By: bean

bean — Thu, 01 Jan 1970 00:00:00 +0000

FTR — when I bought my PC, I did so because my last computer had totally died. I demanded an install CD. The people at the store (Best Buy) told me that everything was on the computer and I didn’t need the install disk. I told them that that was stupid — if my computer crashes, I can’t very well get to any of the information on the computer. They insisted that there wasn’t an install disk. I got really pissed, yelled a bit, and they kept insisting that.

So, I went home, hooked up the new computer and did some on-line checking. I went back to the store and demanded the install disk that should have come with the computer. They tried to pull the same thing. I demanded to speak to the manager. Finally, he said yes, there should have been an install disk, but now that I had bought the computer there was nothing he could do about it. He couldn’t take an install disk from another computer because then he wouldn’t be able to sell it (to which I retorted “obviously you’ve done it before”).

Anyway, suffice it to say, I do not have a disk, and other than borrowing one (thanks Morrigan!!) there’s nothing I can do about that.

By: PinkDreamPoppies

PinkDreamPoppies — Thu, 01 Jan 1970 00:00:00 +0000

Okay, Amp, before you guys do anything drastic like reformatting and reinstalling, I think this may work… (I’m working off a Mac right now, so I can’t be 100% certain, just so you know what you’re getting yourself into).

Disconnect bean’s computer from the network/internet. (I’m assuming that she’s connected to an ethernet or DSL of some kind. If it’s not, then you have an infection on the computer itself that’s exploiting the error.)

On another computer download this file: the patch.

When it’s downloaded, put it on a 3.1/2″ floppy.

Put the floppy in bean’s computer. Run the program off the floppy. (You should be able to do this by going to the Start Menu and clicking on “Run.” In the box that pops up type “a:/WindowsXP-KB823980-x86-ENU.exe” sans quotes.)

Follow the onscreen instructions.

Reboot the computer, reconnect it to the network/internet and see if things aren’t any better.

Final step: curse Microsoft for making such a crappy product.

By: PinkDreamPoppies

PinkDreamPoppies — Thu, 01 Jan 1970 00:00:00 +0000

(This has nothing to do with the current error, but I’m curious.)

bean,

What do you do when you install a new program that requires the XP CD?

By: bean

bean — Thu, 01 Jan 1970 00:00:00 +0000

PDP — I’ve never had to do that.

By: JR

JR — Thu, 01 Jan 1970 00:00:00 +0000

Check the following URL. Could be this worm virus exploiting the vulnerability:

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Cheers from a Spanish Ampersand reader ;-)

By: Jake Squid

Jake Squid — Thu, 01 Jan 1970 00:00:00 +0000

Also, if you can wait until tomorrow evening (which, I’ve been told, has been renamed in my honor - as has every Tues eve at your place - woohoo!), I’ll be there and I can take a look. We can boot in safe mode and see what happens & if we can fix it that way so that we don’t need to reformat/reload.

By: bean

bean — Thu, 01 Jan 1970 00:00:00 +0000

Cool Jake! Actually, after whining to Amp, my first question was “can we call Jake?” :p But, Amp, being his typical passive-aggressive self thought, “why not just post it on the board — that way, Jake might offer to do it, and I don’t have to feel like I asked for help.” :p :p

By: Jake Squid

Jake Squid — Thu, 01 Jan 1970 00:00:00 +0000

Oh, like I didn’t guess. But, you know, I want to appear generous and sympathetic and crap like that. Of course this way I can also demand that Amp locate the computers on which the scripts for Granny Applethorpe’s Hour of yadayadayada may reside. And there’s always the possibility that I will have no clue and will wind up just shrugging my shoulders. In any case, get it the hell off the network/net for now.

By: bean

bean — Thu, 01 Jan 1970 00:00:00 +0000

GASP!! There’s no way I’ll survive with no internet until tomorrow night. No way at all. Not only because I like to read blogs and boards — but because I’m desperately searching for a job. I can’t possibly put that off. I’m already at the “borrowing money for cigarettes” stage.

By: Ampersand

Ampersand — Thu, 01 Jan 1970 00:00:00 +0000

But she did download and install Zone-Alarm. And being paranoid, I installed every security update Microsoft had available….

By: clonal_antibody

clonal_antibody — Thu, 01 Jan 1970 00:00:00 +0000

Here is a quote from
http://it.ucdavis.edu/whatsnew/text/news2.cfm?id=527

We are also aware of some unconfirmed reports that this installation of the patch may still leave your computer with vulnerability. Other possible methods to reduce this vulnerability include disabling COM Internet Services on your computer or using hardware or software firewalls to:

* Block TCP and UDP ports 135 (Remote Procedure Call)
* Block TCP ports 139 and 445 (NetBIOS)
* Block TCP port 593 (RPC-over-HTTP)

Also here is another link
http://www.cert.org/advisories/CA-2003-16.html

Also a solution to your problem can be found here.
You may not have to reinstall!!!!

http://www.blackviper.com/AskBV/tech10.htm

By: PinkDreamPoppies

PinkDreamPoppies — Thu, 01 Jan 1970 00:00:00 +0000

Oh, good, I’m happy to hear that Jake can actually physically take a look at the computer. Like I said, I’m on my Mac and so can’t give the best of instructions. Hope things get fixed okay!