What to do about the new virus ??

Frank Parish · Post by **Frank Parish** » 12 Aug 2003 12:38 pm

I've heard bits and pieces about this new virus but haven't heard if there's a download available from Microsoft. I checked the website and didn't see anything there or didn't recognise it. Does any of the computer geeks here know of a download from Microsoft and how to find it on the web that'll counteract the virus?

Ron Page · Post by **Ron Page** » 12 Aug 2003 1:16 pm

Frank,

A local Cincinnati site had this and it includes links to both a Microsoft patch and a Norton tool.

I'm hoping that my auto-update brings me the MS patch (or maybe it already did the other day) and that my Norton Live Update installs the virus tool... Have to see when I get home.

Tom Mortensen · Post by **Tom Mortensen** » 12 Aug 2003 1:36 pm

Frank,
The fix has been available from Microsoft for over a month. http://windowsupdate.microsoft.com
I just tried to go there to find the name but the server is overloaded today.
[This message was edited by Tom Mortensen on 12 August 2003 at 02:37 PM.]

Douglas Hudson · Post by **Douglas Hudson** » 13 Aug 2003 12:47 pm

Well I just got blasted from the blast worm. Man this is a nasty one guys. Microsoft does have a remover and a patch for the system. So far it has worked for me. Has taken a lot of time to get it on though. I kept having trouble downloading the patch the normal way. The worm kept kicking my computer offline and restarting windows. So I went to the download accelerator website and downloaded the free program. It doesnt speed up your downloads but at least you have resume support for your downloads. I got through all the downloads and finally got rid of the worm. Just make sure you follow directions explicitly on microsofts website. I hope this helps, I have spent almost 4 hours of wasted time due to this worm.
Douglas Hudson

Ron Page · Post by **Ron Page** » 13 Aug 2003 1:05 pm

Scott, if all us PC owners had Macs there would soon be a lot of Mac attacks, pardon the pun. Macs aren't bulletproof, merely not high interest targets.

------------------
HagFan

Recluse · Post by **Recluse** » 13 Aug 2003 2:33 pm

To disable the worm so you can go to micro$oft to get a patch and then to $ymantech to get a removal, tool you must first shut off System Restore function. This will let you stay online till you finish your downloads
Do this on XP by :

1. Right click the My Computer icon on the Desktop and click on Properties.
2. Click on the System Restore tab.
3. Put a check mark next to 'Turn off System Restore on All Drives'.

Older windows call it "File System Restore and the steps are similar.
That will let you go to: http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-026.asp
to get the patch
If you are infected then go to:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
and use that to clean your machine.

GET A FIREWALL!! because most of them automatically block the ports that this virus requires.

Computers aren't fun any more.

Steve Bailey[This message was edited by Recluse on 13 August 2003 at 03:36 PM.][This message was edited by Recluse on 13 August 2003 at 03:37 PM.][This message was edited by Recluse on 13 August 2003 at 03:38 PM.][This message was edited by Recluse on 13 August 2003 at 03:44 PM.]

Fred Shannon · Post by **Fred Shannon** » 13 Aug 2003 3:33 pm

[This message was edited by Fred Shannon on 06 December 2004 at 01:54 AM.]

Gaylon Mathews · Post by **Gaylon Mathews** » 13 Aug 2003 4:29 pm

I'm sure that if I get the worm I'll know it. But how can you be sure? I've tried for a couple of days to download the patch and something always goes wrong.

------------------
Gaylon's Homepage
www.geocities.com/nashville/1064

Craig Collins & High Lonesome
www.craigcollinslive.com

Mark Ardito · Post by **Mark Ardito** » 13 Aug 2003 6:49 pm

Fred,

Hey thanks for the kind words.

Yeah, this virus really doesn't do "harm" to files, but it is more a pain in the "you know what".

The company where my wife works was hit real bad. They have it so bad that the virus reboots the machines every 30 seconds!

I have heard from many forum members that the virus is rebooting their machines. To buy you some more time before it reboots, you can also hit "CTRL+ALT+DEL" and then choose your "Task Manager". Then go to the application processes and find "msblaster.exe". Highlight it and then select "End Task". This will give you enough time to get the removal tool from your favorite antivirus company and install the tool.

If ANY of you guys need help with this...please email me and I will walk you through the removal.

I also stress this...The fix for this issue was available on the Microsoft website over 1 month ago. It was a "Critical Update". I can not stress this issue enough. Now besides being on top of updating our AntiVirus software, we must ALSO do our "Windows Updates" frequently.

Now you may ask, "Mark, how do I update my windows software?"...It is simple...you can open up Internet Explorer and then go to the TOOLS menu and then scroll down to "Windows Update" or you can visit http://www.microsoft.com/windowsupdate

Again, if ANY of you need help with removing this, please email me.

Thanks,
Mark

------------------
Sho~Bud Pro I, Fender D-8 (C6&E13) http://www.darkmagneto.com

[This message was edited by Mark Ardito on 13 August 2003 at 07:53 PM.]

Mike Dennis · Post by **Mike Dennis** » 13 Aug 2003 8:03 pm

NOTE:

Windows Millennium is not affected.
If your running windows millennium you wont have to download the security patch.

Find out more a microsoft.com[This message was edited by Mike Dennis on 13 August 2003 at 09:05 PM.]

Ron Page · Post by **Ron Page** » 14 Aug 2003 7:40 am

Two questions regarding a firewall.

1. Does a router add security by concealing the actual IP addresses of the locally connected computers?

2. Does the built-in Windows XP firewall block the ports that this worm attacks? If so, there must be a lot of systems that have the XP firewall disabled.

Ron

Chuck Halcomb · Post by **Chuck Halcomb** » 15 Aug 2003 9:18 am

Ron the answer to both of your questions is YES.

The router normally will assign 'local ip numbers' that do not directly access the web. Then anything looking for an open port only sees the router and your machine is effectivly invisible. An attack in this case would have to come in through e-mail or in an active way, while "blaster" gets into computers 'on its own' without any activity on the part of the user other than having his/her machine connected to the internet.

Ron Page · Post by **Ron Page** » 15 Aug 2003 12:09 pm

Thanks, Chuck.

Gosh, you're really making your way around this place.

Just read your intro/background on Events & Announcements.

------------------
HagFan

Ron Page · Post by **Ron Page** » 15 Aug 2003 6:56 pm

Steve,

Thanks for the details.

I didn't get "Blasted", but a college roommate of my daughters did and she can't keep the system up long enough to download--on a dial-up. I'm sending her back with a floppy with the patch and repair tool.

She should be able to rent it out when all the students get back and re-connect their computers to the internet.

------------------
HagFan

Joe Delaronde · Post by **Joe Delaronde** » 15 Aug 2003 8:24 pm

I was told Win 98 is safe from the blaster. Is this true? I got it using XP.
Joe

Mark Ardito · Post by **Mark Ardito** » 16 Aug 2003 4:45 am

Joe,

The MSBlaster virus only affects:

Microsoft Windows NT 4.0
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003

Mark

------------------
Sho~Bud Pro I, Fender D-8 (C6&E13) http://www.darkmagneto.com

Jon Light · Post by **Jon Light** » 16 Aug 2003 5:23 am

Is it a fair statement that if it doesn't show up in Task Manager then it isn't in the computer?

Bill Ford · Post by **Bill Ford** » 17 Aug 2003 4:15 pm

Jon,
It does not show in any of these locations,but it is still there somewhere cause it keeps shutting down and Norton shows it on a popup before it shuts down on mine.......

BF

------------------
Bill Ford