Questions related to the new Worm.

[elkinm]

I am hearing a lot about this new windows 2000 worm and the IT at my company are doing virus and windows updates throughout the company.

I have Windows XP SP1 or later and am not to worried but I am wondering how and why the restarts occur.

From the screens on TV I se the automatic reboot message after a critical service has been stopped. I know Remote Procedure Call reboots the system but may be recovered but Plug and Play will force a reboot. There are others but I don't remember them at the moment.

By default the system shuts down in 1 minute. RPC has recovery options and I can change the time to 5 minutes or anything I want.
But there are no options for Plug and Play so I can't change the time. Is there any way to change the default time to reboot and have more time if it does happen for both windows 2000 and XP?

Also, what are the services that by default force a reboot when stopped?
And how would I remove the worm if it does appear?

Thanks

 

[Schadenfroh]

have Windows XP SP1

Why has your IT people not upgraded to SP2?

 

[elkinm]

We have some programs, (at least one) that according to the makers is incompatible with SP2 for one reason or another (maybe the limited connections or something). I do have on SP2 system that I am trying and it works fine I don't want to find any incompatibilities the hard way.

 

[Woody419]

Originally posted by: elkinm

And how would I remove the worm if it does appear?

Symantec removal tool

 

[spyordie007]

nevermind, just realized you are talking about the new win2k worm; I saw xp and thought you were talking about a worm for it.

 

[ss284]

Is there some other new worm floating around? Because our win2k server boxes are dying from the intermittent restarts. Fully updated symantec picks up nothing, and neither do the two esbot/zotob worm removal tools.

 

[spyordie007]

any chance you're looking at a new zotob variant? last I heard the count was up to 11 variants

 

[elkinm]

Are they restarting without information or do you get a message saying that some service has stopped and the system will restart in 60 seconds.

If it does give the message, can you post what service is stopping.

 

[imported_Kiwi]

(Regarding Zotob and its relatives.) Assuming access to systems other than W2K-based PC's, is Microsoft offering the specific patch needed as a download, rather than an interactive update? If so, what is the reference number for the download? Nothing I found on their list of patches for W2K sounded quite like any of those were fixes for the hole that the Zotob worm exploits.

{Answering myself! It's a while later --2:45 PM here in Texas, CDST. I have the URL, and I know why I didn't find it right away. Supposedly, the patch is only going to work if you have applied SP4, and I only go to SP3 on my W2K setups so far.}

http://www.microsoft.com/downloads/than...-47D2-82EF-0AC89905C88F&displayLang=en



:roll:

 

[stash]

It's MS05-039. There is not a 2000 SP3 version available to the general public. You need to have a premier contract and a custom support agreement to get patches for SP3, as it is out of support. I would highly suggest that unless you have a extremely pressing need to stay on SP3 that you upgrade to SP4 and apply ALL patches (not just 039) ASAP.

 

[imported_Kiwi]

Microsoft's download page is unable to keep the SP4 download running long enough not to have it disconnect when the receiver is on dialup. I tried maybe a half dozen times since it was released. The only time I thought I had the entire thing, it was corrupted. It's not that huge, I've gotten 6 and 7 hour d/l's from more stable sources.

I went through the same thing again recently with a new unstall of W2K, on a new PC, and had serious trouble even getting a fresh copy of SP3. I probably tried four times in two days and it died less than a half hour from finishing three of the four tries. I found out a long time ago not to try any large updates interactively. Those fail much more frequently.


:frown:

 

[stash]

Do you have a friend with broadband? Go there and download it to a USB key or burn it to a CD.

 

[stash]

 

[imported_Kiwi]

Originally posted by: STaSh
Do you have a friend with broadband? Go there and download it to a USB key or burn it to a CD.

None of my friends who do have PC's and Internet connections consider faster access important enough to pay the extra cost (most of us are retired on reduced, fixed incomes); I might pay "some" premium, if there was an option in between the high cable subscription fee and the dial up cost, but ASDL is not yet available in older neighborhoods like mine, and even that seems overpriced locally when it is offered. This isn't a highly competitive market for broadband!


:brokenheart:

 

[stash]

That's a tough situation. I believe you can still order SP4 on CD from Microsoft and you just need to pay for shipping. It will probably take 4-6 weeks though

 

[Brazen]

You might try getting a download manager. I would suggest the free and opensource TrueDownloader. Other download managers you either have to pay for, or they are full of spyware and/or adware. TrueDownloader should let you resume your download after a broken internet connection. TrueDownloader itself is only 2.5 MB, so it should not be any problem for you to download.

edit: fixed the link

 

[imported_Kiwi]

Originally posted by: Brazen
You might try getting a download manager. I would suggest the free and opensource TrueDownloader. Other download managers you either have to pay for, or they are full of spyware and/or adware. TrueDownloader should let you resume your download after a broken internet connection. TrueDownloader itself is only 2.5 MB, so it should not be any problem for you to download.

I've tried and discarded both DAP and GetRight. DAP for its spyware habits, GetRight for making systems unstable. I believe I remember seeing a caution from MS about its sites conflicting with download managers (haven't seen anything similar there lately).

If MS isn't including a warning anywhere on their site any more, they ought to do so. Their downloads certainly are invisible to "True Downloader", as it turned out. AND I do believe that earlier versions of Mozilla had some "resume" capabilities that the more recent ones do not have (Mozilla is my browser of choice, over FireFox). I don't think any version of FireFox ever had any such a capability.

I was looking for a good Shareware download Manager after I found a "Privateer" privately made game similar to Privateer I & II, but it's even bigger than any SP3 or SP4, and three tries at downloading that one (starting from after midnight and hoping it would run all night while I slept) all failed.

Thank you for the URL. I'll give it a try!

(Added in Edit: I followed the link, but there's a corrupted file, severals files perhaps, or something similar, cutting access to that instance of a True Download file off. I googled around and got *here* -- http://www.truedownloader.tk/ -- which eventually led to several Mirror sites. Anyone know what and/or where "tk" is? Korea?)

 

[imported_Kiwi]

I'm finally back to this. The way that MS implements their d/l's, there is never a block I can copy and paste into True Downloader, which doesn't integrate with Mozilla enough to know that Mozilla's downloader is active. I tried manually reading off the full, complicated URL that MS uses, a few characters at a time in the mini window Mozilla offers, and True told me there was no such thing.

The SP4 failed last night. It's been running 3 1/2 hours today and is still only half done. And since this version of Mozilla's downloader has no resume feature (I miss that), it's probably really close right now to the point that the connection fails again!


:disgust:

 

[mechBgon]

Kiwi, send me a PM with your mailing address and I'll burn you a CD with SP4 and the other resources needed to get your Win2000 patched up offline.

 

[imported_Kiwi]

Done.

I wasn't far off on how much longer it might run. The connection failed at almost a perfect four hours from inception.

Thank you.

 

[BuckNaked]

:thumbsup: for mechBgon

 

[firewall]

Originally posted by: Kiwi

Originally posted by: Brazen
You might try getting a download manager. I would suggest the free and opensource TrueDownloader. Other download managers you either have to pay for, or they are full of spyware and/or adware. TrueDownloader should let you resume your download after a broken internet connection. TrueDownloader itself is only 2.5 MB, so it should not be any problem for you to download.

I've tried and discarded both DAP and GetRight. DAP for its spyware habits, GetRight for making systems unstable. I believe I remember seeing a caution from MS about its sites conflicting with download managers (haven't seen anything similar there lately).

If MS isn't including a warning anywhere on their site any more, they ought to do so. Their downloads certainly are invisible to "True Downloader", as it turned out. AND I do believe that earlier versions of Mozilla had some "resume" capabilities that the more recent ones do not have (Mozilla is my browser of choice, over FireFox). I don't think any version of FireFox ever had any such a capability.

I was looking for a good Shareware download Manager after I found a "Privateer" privately made game similar to Privateer I & II, but it's even bigger than any SP3 or SP4, and three tries at downloading that one (starting from after midnight and hoping it would run all night while I slept) all failed.

Thank you for the URL. I'll give it a try!

(Added in Edit: I followed the link, but there's a corrupted file, severals files perhaps, or something similar, cutting access to that instance of a True Download file off. I googled around and got *here* -- http://www.truedownloader.tk/ -- which eventually led to several Mirror sites. Anyone know what and/or where "tk" is? Korea?)

You might like to try Flashget by Amazesoft. I have used it to download all windows XP updates and service packs from Microsoft's site. It has resume function too. It shows some ads and can be used without paying.

 

[firewall]

Originally posted by: Kiwi
I'm finally back to this. The way that MS implements their d/l's, there is never a block I can copy and paste into True Downloader, which doesn't integrate with Mozilla enough to know that Mozilla's downloader is active. I tried manually reading off the full, complicated URL that MS uses, a few characters at a time in the mini window Mozilla offers, and True told me there was no such thing.
:disgust:

Are you getting the link from the MS technet site?

 

[imported_Kiwi]

Technet? Am I supposed to already know about something with that name? I'm at that age where I can't be really sure if I did know about something once, but managed to forget it, and worse, to forget anything about it. I do remember a ton of useless stuff almost 30 years back. about DEC's pdp-11's, though!

I was on a MS site with this URL: //download.microsoft.com/download/e/6/a/e6a04295-d2a8-

(add another twenty characters or so past that).