Blaster worm behaviors once I loaded MSN Messenger 6.2

[Keith-Earl]

I have XP Pro SP2 installed. Shortly after I installed MSN Messenger 6.2 I
began to get the familiar "Services and Controller app" dialog that asks me
to send the report to MS. I do each time. As soon as I press "Send Report"
I get the "System Shutdown" dialog with the messgage
"The system is shutting down. Please save...<omit verbiage> initiated by NT
AUTHORITY\SYSTEM"

-and-

"The system process ...services.exe terminated unexpectedly with a return
code of -1."

What gives? I am patched for Blaster and direvitives and even ran
"BlasterFix.exe". It said all clear. There were no suspicious registry
entries.

This started after MSN Mgr 6.2 was added. I saw lots of posts but no
resolutions. Also, MSN Mgr 7 Beta was attacked as well.

Please advise.

 

[David H. Lipman]

| I have XP Pro SP2 installed. Shortly after I installed MSN Messenger 6.2 I
| began to get the familiar "Services and Controller app" dialog that asks me
| to send the report to MS. I do each time. As soon as I press "Send Report"
| I get the "System Shutdown" dialog with the messgage
| "The system is shutting down. Please save...<omit verbiage> initiated by NT
| AUTHORITY\SYSTEM"
|
| -and-
|
| "The system process ...services.exe terminated unexpectedly with a return
| code of -1."
|
| What gives? I am patched for Blaster and direvitives and even ran
| "BlasterFix.exe". It said all clear. There were no suspicious registry
| entries.
|
| This started after MSN Mgr 6.2 was added. I saw lots of posts but no
| resolutions. Also, MSN Mgr 7 Beta was attacked as well.
|
| Please advise.

A system shutown message is NOT always indicative of the Lovsan/Blaster and you have not
provided the information that makes it a RPC/RPCSS exploitation issue.

 

[Keith-Earl]

David,

Sorry, I do not understand this part
"you have not provided the information that makes it a RPC/RPCSS
exploitation issue."

What other info do you need? What should I do to debug this condition?

Thanks,

Keith

 

[David H. Lipman]

| David,
|
| Sorry, I do not understand this part
| "you have not provided the information that makes it a RPC/RPCSS
| exploitation issue."
|
| What other info do you need? What should I do to debug this condition?
|
| Thanks,
|
| Keith


Supply the EXACT words in the error message and/or shutdown window.