Worm Affect Network Accessibility?

[Neil Ginsberg]

Yesterday I was hit with the protoride worm, which I've since removed. But,
at the same time, the two PCs on my home network ceased being able to access
each other. It seems likely the protoride somehow affected my network, since
it modifies the registry and other settings.

The network is a two-PC network, one wired, one wireless, connected through
a wireless router. Both OSs are Win XP Home SP2. The computers sometimes see
the other one in the workgroup, sometimes not. But, even when they do see
the other PC, I get the message that it's not accessible, and I might not
have permissions to view the other PC, when I try to access it.

This network has been set up for some time now and nothing has changed. Even
the SP2 upgrade was a few weeks ago, so I'm sure that's not it. I've tried
it with firewalls disabled (though I don't think it's an issue with the
firewall anyway). Somehow something must have gotten modified by the worm.

Any ideas as to what to check/modify would be greatly appreciated.

Thanks,

Neil

 

[Malke]

Yesterday I was hit with the protoride worm, which I've since removed.
But, at the same time, the two PCs on my home network ceased being
able to access each other. It seems likely the protoride somehow
affected my network, since it modifies the registry and other
settings.

The network is a two-PC network, one wired, one wireless, connected
through a wireless router. Both OSs are Win XP Home SP2. The computers
sometimes see the other one in the workgroup, sometimes not. But, even
when they do see the other PC, I get the message that it's not
accessible, and I might not have permissions to view the other PC,
when I try to access it.

This network has been set up for some time now and nothing has
changed. Even the SP2 upgrade was a few weeks ago, so I'm sure that's
not it. I've tried it with firewalls disabled (though I don't think
it's an issue with the firewall anyway). Somehow something must have
gotten modified by the worm.

According to Symantec, protoride is a network-aware worm. Other
computers on the network are probably infected now, too. Take down the
network, completely disconnecting all machines. Thoroughly clean each
one. Do not bring the network up again until you are 100% sure all
machines are virus-free.

http://securityresponse.symantec.com/avcenter/venc/data/w32.protoride.worm.html

Malke

 

[Steve Winograd [MVP]]

Yesterday I was hit with the protoride worm, which I've since removed. But,
at the same time, the two PCs on my home network ceased being able to access
each other. It seems likely the protoride somehow affected my network, since
it modifies the registry and other settings.

The network is a two-PC network, one wired, one wireless, connected through
a wireless router. Both OSs are Win XP Home SP2. The computers sometimes see
the other one in the workgroup, sometimes not. But, even when they do see
the other PC, I get the message that it's not accessible, and I might not
have permissions to view the other PC, when I try to access it.

This network has been set up for some time now and nothing has changed. Even
the SP2 upgrade was a few weeks ago, so I'm sure that's not it. I've tried
it with firewalls disabled (though I don't think it's an issue with the
firewall anyway). Somehow something must have gotten modified by the worm.

Any ideas as to what to check/modify would be greatly appreciated.

Thanks,

Neil

One possible solution is to use System Restore on each computer to go
back to a time before the worm appeared.

If that works, temporarily disable System Restore (which will remove
any restore points that contain the worm) and then re-enable System
Restore.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

 

[Neil Ginsberg]

Thanks for the idea; but I had to disable system restore to get rid of the
worm. Now there's no going back.

Neil

 

[Guest]

orvoI am having the same issues as the result of the korvo worm. Are there
any ways to set permissions in xp home additions?

 

[Guest]

Sounds like you might have a corupted TCP/IP Try using this program to
debug it
http://cexx.org/lspfix.htm