Atn: Greg Rozelle

Not W32.Blaster.Worm but you might want to have a look instead at W32.Randex.E
(http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.e.html).
Now it appears that this one does include the Win 9x systems.
--
Mike Maltby MS-MVP
mcmaltby@hotmail.com

Heather
Wed Aug 13 18:26:53 CDT 2003

Mike........I was just informed (but I haven't verified it) by one of
your countrymen who dabbles in the virus stuff that they are now
discovering there is a trojan in Blaster......I will keep my eyes open,
but F-Prot is firing out warning like crazy. It seems there is already
a new variant.

Quote from the latest F-Prot alert......

This is a virus alert for W32/Msblast.C, a new RPC-worm first
detected on 13 August 2003.

I wonder if this is the trojan one. We shall see. The original one was
W32/Msblast.B.

Figgs
"Mike M" <No_Spam@Corned_Beef.Only> wrote in message
news:OVg%23LpdYDHA.388@TK2MSFTNGP10.phx.gbl...
> Greg,
>
> Could well be. I hope you don't mind me addressing that post to you
> specifically but I thought it only fair, given your persistence, to
let you
> know of the existence of a trojan that can apparently attack PCs
running Win
> Me and does exploit a DCOM vulnerability although not apparently that
> exploited by W32.Blaster.Worm. :-)
>
> Regards,
> --
> Mike Maltby
> mcmaltby@hotmail.com
>
>
> Greg P Rozelle <nosuchemail@dot.com> wrote:
>
> > I bet that what other people are getting and blaming it one the
> > msblast worm.
>
>

nosuchemail
Wed Aug 13 18:54:54 CDT 2003



>On Wed, 13 Aug 2003 21:33:29 +0100, "Mike M" <No_Spam@Corned_Beef.Only> wrote:

>Greg,
>
>Could well be. I hope you don't mind me addressing that post to you
>specifically but I thought it only fair, given your persistence, to let you
>know of the existence of a trojan that can apparently attack PCs running Win
>Me and does exploit a DCOM vulnerability although not apparently that
>exploited by W32.Blaster.Worm. :-)
>
>Regards,
>--
>Mike Maltby
>mcmaltby@hotmail.com
>
>
>Greg P Rozelle <nosuchemail@dot.com> wrote:
>
>> I bet that what other people are getting and blaming it one the
>> msblast worm.
>
>
Sorry Mike,
I was not trying to say you are wrong. I was getting confused with
rpcss.exe that is included with 98se & Me. I know it not the same.
Also Mow Green reply confused me even more.


Greg P Rozelle





Disclaimer
My advice is as-is. It could trash your system.

Mow
Wed Aug 13 19:16:40 CDT 2003

Greg,

I just put that " explanation " up so that maybe you could discern the
difference between the two. There is a very fine line between having RPC
INCLUDED with the OS and having it run all the time unless disabled by
the user and having it ADDED to the OS via a 3rd party software
installation ( as it is found in Win ME ). After rereading the post I
can see where the confusion stems from ... AND, after doing just so, it
occurred to me that some twit could write a trojan/worm that would
include ALL Windows versions ... and that's just what we're seeing today.

In short, it's friggin' confusing for everyone...

MowG.

Greg P Rozelle wrote:

>>On Wed, 13 Aug 2003 21:33:29 +0100, "Mike M" <No_Spam@Corned_Beef.Only> wrote:
>
>
>>Greg,
>>
>>Could well be. I hope you don't mind me addressing that post to you
>>specifically but I thought it only fair, given your persistence, to let you
>>know of the existence of a trojan that can apparently attack PCs running Win
>>Me and does exploit a DCOM vulnerability although not apparently that
>>exploited by W32.Blaster.Worm. :-)
>>
>>Regards,
>>--
>>Mike Maltby
>>mcmaltby@hotmail.com
>>
>>
>>Greg P Rozelle <nosuchemail@dot.com> wrote:
>>
>>
>>>I bet that what other people are getting and blaming it one the
>>>msblast worm.
>>
>>
> Sorry Mike,
> I was not trying to say you are wrong. I was getting confused with
> rpcss.exe that is included with 98se & Me. I know it not the same.
> Also Mow Green reply confused me even more.
>
>
> Greg P Rozelle
>
>
>
>
>
> Disclaimer
> My advice is as-is. It could trash your system.
>

Mike
Wed Aug 13 19:34:44 CDT 2003

No problem Greg and at least you were sufficiently interested to pursue the
point. As you will have seen Jerry Bryant has now posted confirming my
statements so lets hope a few people read his post. Jerry, BTW, is the
Security/Trustworthy Computing Community Program Manager at Microsoft.

What is more important though is that when this particular fuss has died down
people still remain vigilant, install the patches, update their AV programs
and the like. Many of this weeks problems are self-inflicted with users
attempting in a few hours to carry out the maintenance they should have been
doing on their systems for the last year or more.
--
Mike Maltby
mcmaltby@hotmail.com


Greg P Rozelle <nosuchemail@dot.com> wrote:

> Sorry Mike,
> I was not trying to say you are wrong. I was getting confused with
> rpcss.exe that is included with 98se & Me. I know it not the same.
> Also Mow Green reply confused me even more.

nosuchemail
Wed Aug 13 21:23:11 CDT 2003

>AND, after doing just so, it
>occurred to me that some twit could write a trojan/worm that would
>include ALL Windows versions ... and that's just what we're seeing today.
>
Moe,
You might want to link to your web page.
http://cexx.org/rpcss.htm

I renamed rpcss.exe to rpcss.ex$
For win98se
You can restart in msdos mode to rename
rpcss.ex$.

Windows 98se may recreate it.
Just restart in msdos mode again.
Then delete rpcss.exe.
Then it should go away

If you ever need it, you can always rename it back.

Windows Me do the same,
However, you will need to the boot disk for me,
To be able boot windows me in dos mode.


Greg P Rozelle


Disclaimer
My advice is as-is. It could trash your system.