Topic: BO:writable BO:stack (McAfee 8.5 Patch 7)

[fish380]

We got hit by this yesterday. I found a link somewhere (perhaps this forum) to a McAfee document titled "Finding W32/Conficker.worm.  We recieved the BO Writeable BO Stack errors.  The nice thing about this document is Appendix A titled "Using Group Policies to stop W32/Conficker.worm from spreading.  I made the Group Policy changes last evening hoping this will prevent the spread. I have yet to confirm it's the conficker.worm but all symptoms appear to be the same.  If this "prevent" process works using Group Policy, then at least we can get a handle on those infected and clear them out without anyone else falling victim. Only problem I ran into this morning is it appears the Group Policy restrictions won't allow me to install XP Service Pack 3, which fails halfway through, causing a 20 minute rollback.  Our priority was to control the spread first, and then we can take the policy off and update those remaining to Service pack 3.  In the meantime, if we have this under control, we are using re-imaged drives with Service Pack 3 to get 2 of our 4 infections back online.  The other 2 seem to be OK after running Malwarebytes, Windows software removal tool and installation of Service Pack 3.

[Samker]

For me probably the best "way" is to first run Microsoft Removal Tool http://scforum.info/index.php/topic,4510.0.html

and after that manually apply MS08-067 : http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

After I'll do all other steps including SP3, AV Full Scans...

[jake2pointzero]

Samker is correct. One important tip, if the infected pc is connected to the network, disconnect it first before removing the worm. Scan it on a safe mode.

[dipak0969]

Thanks.

Is this MS08-067 works for windows 2000 also. if not what is it for windows 2000.

regards
 

[Samker]

Thanks.

Is this MS08-067 works for windows 2000 also. if not what is it for windows 2000.

regards
 

I think that this one is for Win 2000: http://www.microsoft.com/downloads/details.aspx?familyid=E22EB3AE-1295-4FE2-9775-6F43C5C2AED3&displaylang=en

Service Pack 4 is required.