Virus Alert

[Alrowan]

Guys there is a new Virus going arround that causes systems to shut down. Already two clan mates have had it get to them. Here is some info on it and how tocheck and then remove it from your system

Info on Virus and how to clean it (http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A)

[baz]

thnx alro .. http://www.totalwar.org/forum/non-cgi/emoticons/smile.gif

[tootee]

its a bit too late for me http://www.totalwar.org/forum/non-cgi/emoticons/frown.gif

[t1master]

me too... thanx for the link.

did yer mates have any trouble gettin rid of it?

[SpiderFromMars]

Thx a LOT for that link, saved my rockstar-ry a$$ http://www.totalwar.org/forum/non-cgi/emoticons/pat.gif

Luckily I managed to download the files before, a few seconds actually, the computer locked down again...

This one was nasty http://www.totalwar.org/forum/non-cgi/emoticons/eek.gif

[GoldenKnightX2]

Thanks for the link http://www.totalwar.org/forum/non-cgi/emoticons/wave.gif

[LordUxbridge]

phew, what a bugger, i was seriously beginning to freak when my comp kept shutting down...cheers for that info mate, saved my ass. I just managed to get the download in before it shut down also. Just a question, the log file after the scan says it detected 3 virus's totally, and deleted one infected file...am i still infected? any idea how this was picked up?

THANX SO MUCH

[Puzz3D]

LordUxbridge,

This poses a problem for Total War games because you didn't have to do anything other than have your machine on the internet to get infected. The vulnetability exploited was to simply send so much data into a certain port that it caused a buffer overflow which somehow makes the machine turn on file sharing. If you put up a firewall to prevent infection from an internet worm like this, you can not host Total War games. Increasingly it's becoming necessary to run with a firewall in place all the time. I certainly can't do that and host games the way I do now.

[Louis de la Ferte Ste Colombe]

Being able to host with a firewall would be a nice improvement...

I have a firewall in, and I am certainly not going to put it down. I can't host MP games, which is very detrimental, since I have no option left other than joining Yuuki's game http://www.totalwar.org/forum/non-cgi/emoticons/pat.gif http://www.totalwar.org/forum/non-cgi/emoticons/wink.gif ...


Louis the Simurgh,

PS; seriously, being able to host witha firewall would really be helpfull...

[Dimeola]

There is a security patch from Microsoft that is supposed to solve this vulnerability.
Dimeolas

[Alrowan]

you can host with a firewall, it just requires you to configure it so the correct ports that MTW uses are open

[Nigel]

so how do I configure the firewall for MTW ?

I am using the one that comes with Windows XP.

[Puzz3D]

Nigel,

I don't have WinXP, but here is a post that gives the ports that have to be opened: Hosting behind a firewall (http://www.totalwar.org/cgi-bin/forum/ikonboard.cgi?act=ST;f=2;t=1864;hl=18321)

Alrowan,

That is true for a software firewall. I was thinking of a hardware firewall which not only closes ports but also hides your ip address. You can't make your ip address visible on most hardware firewalls, and therefore your hosted game won't be visible in the foyer. Being an EE I tend to think in terms of hardware and often forget about the software solution. http://www.totalwar.org/forum/non-cgi/emoticons/smile.gif

[Papewaio]

If you are in Aus and call 13 20 58 you can talk to MS about the virus... just listen to the male voice (mine http://www.totalwar.org/forum/non-cgi/emoticons/biggrin.gif) and you can then talk to a tech.

[Papewaio]

How to Recover a Computer Affected by the Blaster Worm Virus

Follow these steps if your computer has been affected by the Blaster virus and you are unable to connect to the Internet to download the patches.

Step 1 - Manually Disable DCOM On Your Computer:

For Windows XP

1. Click “Start” then click “Run”
2. In the “Open” box type Dcomcnfg.exe and Click “OK”
3. Under "Console Root", double click on "Component Services".
4. Under “Component Services” double click on "Computers".
5. Right-click "My Computer", and then click "Properties".
6. Click the "Default Properties" tab.
7. Uncheck the "Enable Distributed COM on this Computer" check box.
8. Click "OK" to apply the changes.
9. Close the “Component Services” window.
10. Shut down and restart the computer.

For Windows 2000

1. To manually disable DCOM for a computer:
2. Click “Start” then click “Run”
3. In the “Open” box type Dcomcnfg.exe and Click “OK
4. Click the "Default Properties" tab.
5. Uncheck the "Enable Distributed COM on this Computer" check box.
6. Click "OK" to apply the changes.
7. Close the “Distributed Com Configuration Properties” window.
8. Shut down and restart the Computer.

Step 2 – Protect Your Computer From Further Infection

Now you need to download and install the security update for this issue. The security update is available from http://www.microsoft.com.au/blasterhelp. Please download the fix for your version of Windows.

To do this
1. Scroll down to Step 2.
2. Click on the name of the Windows version you are using (this will generally be one of the 32bit versions).
3. When the download dialogue box appears, click Open.
4. When the file finishes downloading it will start to run and you need to follow the wizard prompts to install the patch on your computer.
5. Choose to restart the computer when the installation completes.
6. Now go on to Step 3.

Step 3 – Re-enable DCOM

For Windows XP

1. Click “Start” then click “Run”
2. In the “Open” box type Dcomcnfg.exe and Click “OK”
3. Under "Console Root", double click on "Component Services".
4. Under “Component Services” double click on "Computers".
5. Right-click "My Computer", and then click "Properties".
6. Click the "Default Properties" tab.
7. Check the "Enable Distributed COM on this Computer" check box.
8. Click "OK" to apply the changes.
9. Close the “Component Services” window.
10. Shut down and restart the computer.

For Windows 2000

1. Click “Start” then click “Run”
2. In the “Open” box type Dcomcnfg.exe and Click “OK
3. Click the "Default Properties" tab.
4. Check the "Enable Distributed COM on this Computer" check box.
5. Click "OK" to apply the changes.
6. Close the “Distributed Com Configuration Properties” window.
7. Shut down and restart the Computer.

Step 4 – Remove the Virus

Use antivirus software to remove the Blaster virus from your computer. For further assistance with virus removal contact your antivirus software provider.


It was slightly modified last night... so if you send a blank email to rpc@mss.com.au you should get an auto response email on how to fix it.