tftp2036...what is this file?

[rocky d.]

Can anyone tell me what tftp is? I have been getting
errors that is causing my Windows XP to reboot on its
own, then on startup, it asks me to identify "tftp2036".
I am concerned it might be necessary, but think it's a
virus. Any know what's up?

Rocky D.

[John E. Carty]

You have been infected with the MSBLAST worm. See the following for
patch/removal details:

http://support.microsoft.com/?kbid=823980

http://vil.nai.com/vil/content/v_100547.htm

"rocky d." > wrote in message
...
> Can anyone tell me what tftp is? I have been getting
> errors that is causing my Windows XP to reboot on its
> own, then on startup, it asks me to identify "tftp2036".
> I am concerned it might be necessary, but think it's a
> virus. Any know what's up?
>
> Rocky D.

[Kent W. England [MVP]]

This is a symptom of the RPC/DCOM exploit as described in Microsoft
security bulletin MS03-026. Go to
http://www.microsoft.com/security/security_bulletins/ms03-026.asp to
read about this vulnerability.

You need to download the Windows critical update patch 823980 and enable
or install a personal firewall to block TCP and UDP ports 135, 139, and
445. The built-in XP firewall will block these ports by default.

Once you download what you need, disconnect from the network, install
your patch, install your firewall and clean the worm from your system.
For msblast.exe removal instructions, read
http://www.bigblackglasses.com/Article.aspx?Article=342.

Once you are sure your system is clean, you can reconnect to the
Internet. It is very important to address this quickly and to disconnect
as soon as possible. Your system is very vulnerable to further exploits
while the worm is present and you do not want your system involved in
the massive denial-of-service attacks that are coming in the next few
days from the masses of compromised systems.

Download, disconnect, patch, firewall, and clean. Then inspect. When
sure, reconnect.

--
Kent W. England, Microsoft MVP for Windows



"rocky d." > wrote in
message ...

> Can anyone tell me what tftp is? I have been getting
> errors that is causing my Windows XP to reboot on its
> own, then on startup, it asks me to identify "tftp2036".
> I am concerned it might be necessary, but think it's a
> virus. Any know what's up?
>
> Rocky D.