Blaster worm behaviors once I loaded MSN Messenger 6.2

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I have XP Pro SP2 installed. Shortly after I installed MSN Messenger 6.2 I
began to get the familiar "Services and Controller app" dialog that asks me
to send the report to MS. I do each time. As soon as I press "Send Report"
I get the "System Shutdown" dialog with the messgage
"The system is shutting down. Please save...<omit verbiage> initiated by NT
AUTHORITY\SYSTEM"

-and-

"The system process ...services.exe terminated unexpectedly with a return
code of -1."

What gives? I am patched for Blaster and direvitives and even ran
"BlasterFix.exe". It said all clear. There were no suspicious registry
entries.

This started after MSN Mgr 6.2 was added. I saw lots of posts but no
resolutions. Also, MSN Mgr 7 Beta was attacked as well.

Please advise.

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"Keith-Earl" <keith_NO_SPAM_HERE_rowe79@hotmail.com> wrote in message
news:OmJZHM1HFHA.4032@TK2MSFTNGP12.phx.gbl
| I have XP Pro SP2 installed. Shortly after I installed MSN Messenger 6.2 I
| began to get the familiar "Services and Controller app" dialog that asks me
| to send the report to MS. I do each time. As soon as I press "Send Report"
| I get the "System Shutdown" dialog with the messgage
| "The system is shutting down. Please save...<omit verbiage> initiated by NT
| AUTHORITY\SYSTEM"
|
| -and-
|
| "The system process ...services.exe terminated unexpectedly with a return
| code of -1."
|
| What gives? I am patched for Blaster and direvitives and even ran
| "BlasterFix.exe". It said all clear. There were no suspicious registry
| entries.
|
| This started after MSN Mgr 6.2 was added. I saw lots of posts but no
| resolutions. Also, MSN Mgr 7 Beta was attacked as well.
|
| Please advise.

A system shutown message is NOT always indicative of the Lovsan/Blaster and you have not
provided the information that makes it a RPC/RPCSS exploitation issue.

--
Dave

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

David,

Sorry, I do not understand this part
"you have not provided the information that makes it a RPC/RPCSS
exploitation issue."

What other info do you need? What should I do to debug this condition?

Thanks,

Keith



"Keith-Earl" <keith_NO_SPAM_HERE_rowe79@hotmail.com> wrote in message
news:OmJZHM1HFHA.4032@TK2MSFTNGP12.phx.gbl...
>I have XP Pro SP2 installed. Shortly after I installed MSN Messenger 6.2 I
>began to get the familiar "Services and Controller app" dialog that asks me
>to send the report to MS. I do each time. As soon as I press "Send
>Report" I get the "System Shutdown" dialog with the messgage
> "The system is shutting down. Please save...<omit verbiage> initiated by
> NT AUTHORITY\SYSTEM"
>
> -and-
>
> "The system process ...services.exe terminated unexpectedly with a return
> code of -1."
>
> What gives? I am patched for Blaster and direvitives and even ran
> "BlasterFix.exe". It said all clear. There were no suspicious registry
> entries.
>
> This started after MSN Mgr 6.2 was added. I saw lots of posts but no
> resolutions. Also, MSN Mgr 7 Beta was attacked as well.
>
> Please advise.
>

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"Keith-Earl" <k@k.com> wrote in message news:uEb%233YBIFHA.3076@tk2msftngp13.phx.gbl
| David,
|
| Sorry, I do not understand this part
| "you have not provided the information that makes it a RPC/RPCSS
| exploitation issue."
|
| What other info do you need? What should I do to debug this condition?
|
| Thanks,
|
| Keith


Supply the EXACT words in the error message and/or shutdown window.

--
Dave