Hello,

I moved your thread into the Windoze Security forum...

We saw this one at work too, and it was pounding our network to a point that people could not print.

If you have what we had (bling.exe, o.exe, bl[1].exe) and found the registry keys with the word 'psYko' inside them, then you will also suffer the spread of this bug via the network. We had to do the safemode thing, and repair them as local admins, and also do a registry edit to all machines to RestrictAnonymous=2 instead of the default 0.

Before you do such a sweeping change to the registry, you better test it vigerously first. Leaping before swimming is unwise.

Best way to get rid of it? Linux. I hate to admit it, but XP with SP 1 or SP 2 were more difficult to keep clean from this thing than W2K. To stop the insanity, you may want to bugsniff and see what port this puppy is firing on, and if your network staff can block those ports to isolate IP segments.

Christian

Thanks for moving it. I wasn't sure where to post.
I know that you say Linux is the way to get rid of it, but I am bound by a group of technicians that have to have Winderz.

Which keys did you edit? Just the ones that had the words psYko in them? Or... which ones?