scvhost, VM leak and SP4

[Seb]

Hi all,

I'm running Win2000 at home and suddenly started getting
these scvhost errors popping up. At the same time, my
Norton Doc kept telling me that CPU usage was at 100% all
the time, even though no apps running. Anyway, I logs onto
internet to see if I can find a solution to this and most
usegroups explain that it could be this blast worm thing,
get the SP4! So I diligently follow this advice. Now
downloading SP4 is simply enough but nearly every time I
do it, half way through the screen goes blue, warns of a
physical memory dump and reboots...last night I thought I
nearly had success...but then noticed the virtual memory
slowly depleting until it ran out!! This is from something
like 138mb! Where do I go from here? None of the other
fixes I downloaded will work until I have at least SP2
installed.

Cheers
Seb

 

[Guest]

Go here
http://securityresponse1.symantec.com/sarc/sarc.nsf/html/w3
2.blaster.worm.removal.tool.html

See if you can remove the virus with the tool whilst not
connected to the internet .

 

[David H. Lipman]

Please go to one or more of the below online scanners and perform a scan of your platform
then report back your results.

Trend:
http://housecall.antivirus.com
http://housecall.trendmicro.com

McAfee:
http://www.mcafee.com/myapps/mfs/default.asp

Panda:
http://www.pandasoftware.com/activescan/

Symantec:
http://security.symantec.com/

Dave




| Hi all,
|
| I'm running Win2000 at home and suddenly started getting
| these scvhost errors popping up. At the same time, my
| Norton Doc kept telling me that CPU usage was at 100% all
| the time, even though no apps running. Anyway, I logs onto
| internet to see if I can find a solution to this and most
| usegroups explain that it could be this blast worm thing,
| get the SP4! So I diligently follow this advice. Now
| downloading SP4 is simply enough but nearly every time I
| do it, half way through the screen goes blue, warns of a
| physical memory dump and reboots...last night I thought I
| nearly had success...but then noticed the virtual memory
| slowly depleting until it ran out!! This is from something
| like 138mb! Where do I go from here? None of the other
| fixes I downloaded will work until I have at least SP2
| installed.
|
| Cheers
| Seb

 

[George Hester]

I don't think SP4 addresses msblaster. That requires the blaster hotfix and for that I believe you have to be at a minimum of SP3.

 

[David H. Lipman]

The HotFix is KB828741 and requires a minimum of Win2K SP2 and is found at URL:
http://www.microsoft.com/downloads/...36-D1D3-47A2-A5D5-6C8F27FDCC40&displaylang=en

Please note the following...
KB823980 was SUPERCEDED by the patch for the RPC/RPCSS Buffer Overflow Vulnerability that is
addressed by Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146 - KB824146

KB824146 has very recently been superceded by KB828741
http://support.microsoft.com/default.aspx?scid=kb;en-us;828741
http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx

So for Nachi/Welchia and Lovsan/Blaster worms, KB828741 is NOW needed to fix all RPC/RPCSS
DCOM Vulnerabilities.

Dave




I don't think SP4 addresses msblaster. That requires the blaster hotfix and for that I
believe you have to be at a minimum of SP3.

 

[Enkidu]

I don't think SP4 addresses msblaster. That requires
the blaster hotfix and for that I believe you have to be
at a minimum of SP3.

"Supported Operating Systems: Windows 2000, Windows 2000 Service Pack
2, Windows 2000 Service Pack 3"

Cheers,

Cliff

 

[David H. Lipman]

That's nice but...

WHAT patch/HotFix are you referring to by -- "Supported Operating Systems: Windows 2000,
Windows 2000 Service Pack
2, Windows 2000 Service Pack 3". Without the KB number its meaningless information.

Dave




| On Fri, 23 Apr 2004 19:24:53 -0400, "George Hester"
|
| >I don't think SP4 addresses msblaster. That requires
| >the blaster hotfix and for that I believe you have to be
| >at a minimum of SP3.
|
| "Supported Operating Systems: Windows 2000, Windows 2000 Service Pack
| 2, Windows 2000 Service Pack 3"
|
| Cheers,
|
| Cliff

 

[Enkidu]

I thought that it was clear that I was referring to the Blaster Fix,
David, but you are right I could have given a little more information,
such as the URL.

Cheers,

Cliff