Did Microsoft send me a virus in my upgrade ?

[JohnP725]

A very strange thing happened while I was updating my
Windows XP Home system after just having had to reload it.

My machine had a Virus which Commandcom detection had not
caught (the virus changed and commandeered my Internet
Homepage) and I had to clean the disk and reload the
entire system.

I reloaded Windows during the night of 11/11/2003 and
then was using Windows Update to get the system up to
date. I had loaded successfully the
update "f25c5481655b15f5ea6f3e4187bfa64a" (creation time
Tuesday, November 11, 2003, 5:08:46 AM) and started
loading "45975d5efc3ef49c53f2c37479222d16" (creation time
Tuesday, November 11, 2003, 6:34:32 AM). It appears
that, at the start of 45975d5efc3ef49c53f2c37479222d16,
something infected my system again and loaded and
modified a version of DLLHOST.EXE(and perhaps
SVCHOST.EXE) in the WINDOWS\SYSTEM32\WINS\ directory.

Details of the DLLHOST.EXE are:
Description: DLLHOST.EXE (note the uppercase filename)
(Copyright: no information)
Size: 10,240 bytes
Size on disk 12,288 bytes
Created: Tuesday, November 11, 2003, 6:33:21 AM
Modified: Tuesday, November 11, 2003, 6:33:40 AM

Details of the SVCHOST.EXE are:
Description: TCP/IP Trivial file transfer daemon
Version 5.0.2134.1
Copyright (C) Microsoft Corp. 1981-1999
Size: 19,728 bytes
Size on disk 24,080 bytes
Created: Tuesday, November 11, 2003, 6:32:12 AM
Modified: Tuesday, November 11, 2003, 6:33:22 AM

There are other versions of dllhost.exe (lowercase
filenames), one in the WINDOWS\SYSTEM32 directory
(Description COM Surrogate Version 5.1.2600, Copyright (C)
Microsoft Corp., Size: 4,608 bytes) and one in the
WINDOWS\OPTIONS\CABS\WIN98_45.CAB Folder.

I mentioned SVCHOST.EXE because it too had an uppercase
filename and, also, it was modified one minute after
having been created - and a millisecond after DLLHOST.EXE
was Created - too much of a coincidence.

According to Commandcom (which I didn't reload until
AFTER all this had happened), the DLLHOST.EXE loaded into
the WINDOWS/SYSTEM32/WINS/ directory is infected with
the "W32.NACHI.A" virus, but SVCHOST.EXE is virus free.

Can I do anything to avoid reloading the whole system yet
again ?? What other action should I take (apart from
reloading the Virus detection system BEFORE anything else
after the basic Windows XP load !)?

 

[David Jones]

http://www.microsoft.com/security/antivirus/nachi.asp

 

[Guest]

The start of all your problems was spyware NOT a virus
and you caught the virus "after" reloading windows and
installing your anti-virus.I believe that you caught this
out of stupidity!!

 

[Jeremy]

were you running a firewall when doing your initial updates? Because it
only takes seconds for a unpatched machine to get infected with blaster,
nacia, welchia etc... That is why reloading is a art form in itself how to
reload and get patched with out getting hacked or infected.

 

[Bruce Chambers]

Greetings --

If you connected the PC to the Internet without having first
installed the KB824146 Hotfix, without having first installed an
antivirus application with current virus definition files, and before
enabling a firewall, you're very likely to get infected from any of
the thousands of PCs on the Internet that are constantly broadcasting
the Blaster and/or Welchia worms. It only takes a few seconds of
exposure.

To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH