Hi,
The "Blaster Virus" is affecting the entire personal computer industry and
may impact any computer system running Microsoft Windows XP or Windows
2000.
The worm can exploit a security vulnerability on unprotected Microsoft
Windows XP or Windows 2000 computers.
There are multiple steps provided in this message. I recommend printing
these steps for your reference. You can also view this information (in
detail):
http://www.hp.com/cposupport/mixed/support_doc/c00035757.html
Use the following steps to prevent the computer from restarting, to remove
the virus, and to prevent the virus from re-infecting the computer. HP does
not guarantee the success of this procedure.
NOTE: The following steps require virus scanning software (Norton AntiVirus
or McAfee VirusScan) and that the person logged on have administrative
privileges.
1. Click Start, Run and then type: shutdown -a
This prevents the system from automatically restarting long enough for you
to download and install the Microsoft security update.
2. Click OK.
3. If the "shutdown -a" command fails to keep the computer from restarting,
use the following steps:
a. Click Start, Run, and then type: services.msc
A Services window appears.
b. Click OK.
c. Double-click Remote Procedure Call (RPC) and select the Recovery tab. Be
careful to not use the Remote Procedure Call (RPC) Locator item.
d. Set the First Failure, Second Failure, and Subsequent Failures items to
Take No Action.
e. Click OK to apply the settings.
4. Install the latest critical updates using Windows Update. For more
information, go to the following Web sites:
* Microsoft's Security Bulletin: MS03-039:
http://www.microsoft.com/security/security_bulletins/ms03-039.asp
* How to use Windows Update:
http://www.hp.com/cposupport/personal_computing/support_doc/bph07159.html
NOTE: We believe the worm is designed to increase the Web traffic to the
Microsoft Windows Update Web site. Some indications are that on August 16,
2003, the worm's impact on the
Windows Update site will increase dramatically. If an increase in Web
traffic does occur, this Web site may take a long time to display, or may
not display at all when you
try to access it. Please be patient and try to connect to the Microsoft
Windows Update site at another time.
5. Remove the worm using your antivirus software. Do this by attaining the
latest virus definitions and then performing a scan.
For more detailed information go to the following Web sites:
* McAfee's VirusScan Web page on the W32/Lovsan.worm virus:
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100547
* Symantec's Norton AntiVirus Web page on the 32.Blaster.Worm virus.
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.htm
l
6. If you used the "services.msc" command (as explained above in Step 3) to
prevent your computer from restarting, restore your RPC recovery settings to
their original state as follows:
a. Click Start, Run, and then type: services.msc
b. Click OK.
c. Double-click Remote Procedure Call (RPC) and select the Recovery tab. Be
careful to not use the Remote Procedure Call (RPC) Locator item.
d. Set the First Failure, Second Failure, and Subsequent Failures items to
Restart the Computer.
e. Click OK to apply the settings.
For more information on resolving and preventing viruses on your Computer,
go to the following HP Web site:
http://www.hp.com/cposupport/personal_computing/support_doc/bph07130.html
- kasvera [MCP]
ORT of say, 192.168.2.4:3389, but the cable head NAT may be mapping its external IP 12.72.126.58 port 3000, say, to your hidden IP of 192.168.2.4. The remote Expert opens your invitation and sees your local hidden IP , i.e., 192.168.2.4, and sends a connection request to you at 192.168.2.4:3389 (since Remote Assistance uses port 3389 in and outbound). This hits the cable head NAT and ends up missing you, since the cable NAT only routes incoming connections to you on 12.72.126.58:3000. In the reverse direction, i.e., with you as Expert, you get a public IP via invitation from the Novice and have no problem connecting to that publically valid IP on port 3389, since there is no address translation on the destination outbound (and your inbound in that case don't require a particular port number, using arbitrarily what is provided by the cable head NAT). This is confusing, I imagine--I'll be lucky if I described it correctly <grin>