John Colby
jcolby at colbyconsulting.com
Wed Aug 13 07:51:14 CDT 2003
Windows has a little client program that sits in the toolbar, loaded when windows loads. It checks for updates automatically and offers a choice of "install automatically", "Ask before install", and "jump off a bridge". It works very well. I have all my systems set up to download and then ask before install. Not sure why I do that as I always just install them anyway. At any rate, my computers are always up to date. John W. Colby www.colbyconsulting.com -----Original Message----- From: accessd-bounces at databaseadvisors.com [mailto:accessd-bounces at databaseadvisors.com]On Behalf Of William Hindman Sent: Wednesday, August 13, 2003 12:06 AM To: Access Developers discussion and problem solving Subject: Re: [AccessD] martin's problem - SOLUTON ...some follow-up comments ...the MS Win Update site was heavily loaded all day long ...dls were much slower than normal at every client site ...and as for what you were seeing, the worm exploits a buffer overrun to get into your system, then dls the msblast.exe from a dynamically changing list of IPs and ports ...so even if you wipe msblast, it just reloads the next time you connect ...you have to have the ms patch installed to prevent it from using the buffer overrun to reload itself again and again ...then the virus cleaning will work ...only positive was that it was an excellent client object lesson in keeping Win updates current ...safest thing is to dl them automatically every night and then apply selectively ...that way you at least have them dl'd before everyone starts hitting on the ms site ...I'm really pretty surprised that it worked as well as it did. William Hindman So, then, to every man his chance -- to every man, regardless of his birth, his shining golden opportunity -- to every man his right to live, to work, to be himself, to become whatever his manhood and his vision can combine to make him -- this, seeker, is the promise of America. -- Thomas Wolfe ----- Original Message ----- From: "Steven W. Erbach" <serbach at new.rr.com> To: "Access Developers discussion and problem solving" <accessd at databaseadvisors.com> Sent: Tuesday, August 12, 2003 5:57 PM Subject: Re: [AccessD] martin's problem - SOLUTON > Dear Group, > > >> This link point's to Symnatec's fix for the worm. Look for "Removal using > the W32.Blaster.Worm Removal Tool" to locate the link to the fix file. << > > For what it's worth, I went to a client's site to eradicate the Blaster > Worm. SHEESH! It's a Win XP Home system that has not been updated to the > most recent Windows update since they bought it about two years ago. It has > Norton AntiVirus 2003 on it, but, of course, the last time they did a virus > update was last week. They have no firewall. > > I was able to download the Symantec "fix" while in normal Windows, but I had > to run the program in Safe Mode since the RPC error / Shutdown message > appeared every time I tried to run the fix. So far so good. > > I thought that I'd try to go to the Windows Update site. It showed that this > PC, of course, hadn't ever been updated, so there were 34 critical updates > to make. Started the first one...RPC error / Shutdown. > > Okay, lets update Norton AntiVirus. Did that, but I still got the RPC error. > Shutdown. > > Started up in Safe Mode and ran a full Norton AV System Scan. 114,000 files > later there were no viruses present. > > Restarted in normal Windows and went to the Windows Update site. Norton > displayed its W32.Blaster.Worm detection screen and said that it had been > deleted...but a minute or two later the RPC error appeared again anyway and > I had to shut the system down and restart. > > I tried this Windows Update thingy a few more times. There were a couple of > times after the Norton AV message appeared indicating that, once again, it > had deleted Blaster.Worm, a Windows message appeared indicating that the > Generic Host Process for Win32 Services had encountered a problem and needed > to close. Right after that the RPC / Shutdown error appeared. Restart. > > I finally got wise that Windows REALLY needed to have the MS KB823980 patch > applied. I hadn't tried that right away because I thought that Windows had > to be updated to the most recent level first. I tried to run the file from > the Microsoft site rather than saving to disk and got both the Generic Host > Process error and the RPC error. Shutdown and restart. > > I got even MORE wise and restarted in Safe Mode With Network capability. I > downloaded the patch all right...but instead of applying it I thought I'd > try the Windows update again. RPC. Shutdown. > > Restarted in Safe Mode with Network. Started the patch. RPC / Shutdown. > > Restared in Safe Mode WITHOUT the network. Ran the patch. COMPLETED! > > Restarted in Safe Mode WITH Networking to try Windows Update again. Finally > the PC began downloading the huge number of pieces that it needed to upgrade > Win XP to the current revision. I left my client's office about 4 hours > after I'd arrived, giving them instructions to call when the downloads were > completed. I should be able to walk them through the Windows Update process > tonight. > > They have DSL but it was god-awful slow. 95 MB download estimated at about > 200 minutes...more than 10 times slower than my cable service would take. > > So, the upshot is, if the PC hasn't been updated to the most recent version > of XP lately (or at all) make sure that you download and run everything in > Safe Mode...and make sure to run the MS patch in Safe Mode WITHOUT > networking. I must have seen that RPC shutdown thing two dozen times or > more, and the General Host Process error 8 or 9 times. > > It's now looking good, but we're not finished upgrading Windows XP yet. I'm > crossing my fingers that the guy on the other end of the phone is somewhat > proficient. Crossing my fingers. > > Steve Erbach > Scientific Marketing > Neenah, WI > > "Eventually, socialists run out of other people's money." > -- Lady Margaret Thatcher > > > _______________________________________________ > AccessD mailing list > AccessD at databaseadvisors.com > http://databaseadvisors.com/mailman/listinfo/accessd > Website: http://www.databaseadvisors.com > _______________________________________________ AccessD mailing list AccessD at databaseadvisors.com http://databaseadvisors.com/mailman/listinfo/accessd Website: http://www.databaseadvisors.com