Tools/ fixes for Blaster and manual removeal instructions -
Symantec's tool - be sure to print the instructions on this page - also
print the instructions for disabling System Restore on XP - the link is on
this page
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
Microsoft fix for XP
http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en
Microsoft fix for Win 2000
http://microsoft.com/downloads/details.aspx?FamilyId=C8B8A846-F541-4C15-8C9F-220354449117&displaylang=en
If you want you can try this if you have trouble with Symantec's tool -
Manual Removal-
Microsoft said XP users' first step should be to activate the firewall
included in their operating system (instructions at
http://support.microsoft.com/default.aspx?scid=kb;EN-US;283673), which will
block the worm's communication and give them time to patch and download
antivirus software that can eliminate the worm. Windows 2000 users could use
any personal firewall they may have to do the same job.
Antivirus software won't prevent infection from this particular worm because
it travels directly from the Internet into the operating system, never
triggering a virus scan. As such, all Windows users are urged to apply
Microsoft's patch, the only sure way to avoiding infection.
CERT/CC recommendations for infected users:
1. Physically disconnect the system from the network.
2. Check the system for signs of compromise. In most cases, an infection
will be indicated by the presence of the registry key
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows
auto update" with a value of msblast.exe. If this key is present, remove it
using a registry editor.
3. If your computer is infected, terminate the running copy of msblast.exe
using the Task Manager.
4. Take one of the following steps to protect against the compromise prior
to installing the Microsoft patch: Disable DCOM as described below Enabling
Microsoft's Internet Connection Filter, or another host-level packet
filtering program to block incoming connections for 135/tcp.
5. Reconnect the system to the network and apply the patches in the
recommended manner.
----- Original Message -----
From: "Anne Neighbors" <[log in to unmask]>
Sent: Wednesday, August 13, 2003 8:39 AM
Subject: The Blaster Virus
Can someone please tell me which files to access to see if the blaster virus
is in my software? Do I open My Documents and check my files?
Also, my Norton anti-virus is current as of August 11, 2003 and does not
indicate an update is needed. It would have been helpful if Norton had
posted a notice stating they had installed the patch for customers.
Anne Neighbors
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.509 / Virus Database: 306 - Release Date: 8/12/2003
The NOSPIN Group is now offering Free PC Tech
support at our newest website:
http://freepctech.com
|
