blaster worm virus

Greenday · Post by **Greenday** » Wed Aug 13, 2003 11:32 am

If you have a decent firewall then you shouldn't get this virus in the first place.

Now I'm not one to say I told you so....

See i knew there would be a good example of why people needed one sooner or later

stephen T · Post by **stephen T** » Wed Aug 13, 2003 11:35 am

its been getting past ALOT of firewalls mind. i know alot of techies and a few hackers that have been infected themselves.

Alex LS · Post by **Alex LS** » Wed Aug 13, 2003 12:11 pm

Well firewalls aren't much use on their own. You need a decent firewall, a decent antivirus app with up to date profiles, and a bit of common sense.

We've only had a couple of infections and both of them on unprotected (by NAV) machines.

Greenday · Post by **Greenday** » Wed Aug 13, 2003 12:27 pm

A decent Fiewall will stop it as it infects machines by connecting to an open port, i've got a free firewall on my PC and that managed to block all 5 attempts the virus made to connect to the port on my machine

Post by **Lyndon** » Wed Aug 13, 2003 7:38 pm

same here a bit of common sense works wonders

(yes i know i had a bit of virus trouble around xmas but i was hungover so

)

nuttyslack · Post by **nuttyslack** » Wed Aug 13, 2003 7:43 pm

better than a software firewall, get a hardware one built into a router and close all the ports on it, you shouldnt ever get a virus again with any luck

CB · Post by CB » Wed Aug 13, 2003 9:01 pm

I've got this virus. Its doing my fcuking head in and I'm not a computer techie/nerd. In plain language wtf am I supposed to do please?

Cappy · Post by **Cappy** » Wed Aug 13, 2003 9:16 pm

PANIC!!!!

MattB · Post by **MattB** » Thu Aug 14, 2003 11:51 am

better than a software firewall, get a hardware one built into a router and close all the ports on it, you shouldnt ever get a virus again with any luck

True, but be wary about what router you get. I've had serious problems with Linksys routers that just don't do what they should in terms of port forwarding etc.

I use Smoothwall (http://www.smoothwall.org) which basically runs on an old box and is free software. It does mean that you need to have a flul network setup which most home users don't want.

As for personal firewalls, I really like the Sygate one. It's pretty nuobtrusive and does the job a treat from my experience.

MattB · Post by **MattB** » Thu Aug 14, 2003 11:58 am

FYI, a mate of mine got Blaster the ther day and I went to sort it out. Here's what seemed to work (on Win XP, should be same for 2k) to get the computer to a state which would let me download patches etc:

1. Physically disconnect the computer from the internet - tihs will stop the automatic shutdown notice.
2. Go into Control Panel -> Admin -> Services, choose the "Remote Procedure Call (RPC) entry, right click and choose Properties
3. Click on the "Recovery" tab. Choose "Take no Action" for the top 3 drop-down boxes
4. Go to task manager (press ctrl-alt-del ,click on Task Manager)
5. Go to the "processes" tab. If you find "msblast.exe" in the list, click on it and click "end process" at the bottom.
6. Delete c:winntsystem32msblast.exe (or c:windowssystem32msblast.exe)
7. Plug in internet, reboot

You can now get the update patch at:

http://www.microsoft.com/technet/treevi ... 03-026.asp

Also get a decent firewall so it doesn't happen again!

Note that although the virus is a pain, it doesn't damage any data on your hard disk, so panicing is not the thing to do!

Julia · Post by **Julia** » Thu Aug 14, 2003 12:18 pm

Also another BIG thanks to StephenT for helping me with this goddam virus!
After scanning pc it said it hadn't found anything but after Stephen mentioned about checking my hack attempts log it had actually got through.
Thanks mate for all your help with it! MUCH appreciated!
:blush-thx:

stephen T · Post by **stephen T** » Thu Aug 14, 2003 12:30 pm

can any1 help cb? the virus has diabled updates on norton as it did with me. i managed to get him up to speed with norton and we altered recovery settings so he can stay online

BUT

1. there is no blast file in system32
2. the removal tool wont run. it fails.

plus be warned i have heard today there are variations of this virus already which is to b expected really. so keep uptodate ever1 please.

Riss · Post by **Riss** » Thu Aug 14, 2003 1:26 pm

Wheres the hack attempts log?? Do I need to check that??? Argh this thing is scaring me!!

Post by **Lyndon** » Thu Aug 14, 2003 1:32 pm

i think it is getting a bit out of hand now myself, there's nothing to worry about riss as long as your up to date on your anti virus and have applied the xp patch

Riss · Post by **Riss** » Thu Aug 14, 2003 1:35 pm

Phew! Thanks Lyndon, will stop panicking now!! Cheers