'Blaster' Virus Alert - Genuine AFAIK
 

I'm not normally given to 'virus panic' but there does seem to be a real one
called 'Blaster' (and summat else) floating about that is a bit interesting.

Users of NT/W2K/XP should vist
http://microsoft.com/technet/treevie.../security/bull
etin/MS03-026.asp and download the relevant patch before Aug 15th as this
little bugger will apparently prevent you accessing this site from that
date. (See halfway down the page - rated 'critical' by MS!!????)

If it's a hoax or somewhat exaggerated don't come back at me - I have
overriden my usual caution/indifference as we have had this virus and one of
its manifestations is to keep giving you a 30" countdown before it shuts
your machine down!

'Blaster' Virus Alert - Genuine AFAIK
 

"Keith G" wrote in message
...
I'm not normally given to 'virus panic' but there does seem to be a real
one
called 'Blaster' (and summat else) floating about that is a bit
interesting.

Users of NT/W2K/XP should vist

http://microsoft.com/technet/treevie.../security/bull
etin/MS03-026.asp and download the relevant patch before Aug 15th as this
little bugger will apparently prevent you accessing this site from that
date. (See halfway down the page - rated 'critical' by MS!!????)

If it's a hoax or somewhat exaggerated don't come back at me - I have
overriden my usual caution/indifference as we have had this virus and one
of
its manifestations is to keep giving you a 30" countdown before it shuts
your machine down!



Just received - this URL

http://msn.com.com/4520-6600_16-5062...s&tag=msn_home

by way of explanation..........

'Blaster' Virus Alert - Genuine AFAIK
 

On Wed, 13 Aug 2003 13:36:11 +0100, Julian Fowler
wrote:

Yep, this one's genuine. You're more likely to be vulnerable if you
are on broadband (or otherwise have a 24/7 connection to the 'net).
You *should* be OK if you've kept your OS and anti-virus s/w up to
date, and/or run behind a firewall. If not, consider doing so ASAP
(the 'Blaster' worm is, as Keith says, *nasty*). Symantec have a worm
removal tool (free) on their website.

However, the Symantec removal tool is only likely to be effective if the
machine is patched first, using the downloadble patch available at:

http://www.microsoft.com/technet/sec...n/MS03-026.asp

The Symantec security response document including a link to the
downloadable detection and removal tool is available at:

http://securityresponse.symantec.com...ster.worm.html

This is somewhat unusual (needing to patch the infected machine
concerned before detection and removal of the worm) and owners of
infected Windows XP machines should pay particular attention to the
instructions in the Symantec security response document, specifically
the section "1. Disabling System Restore (Windows XP)".

--
Anthony Edwards

'Blaster' Virus Alert - Genuine AFAIK
 

"Anthony Edwards" wrote in message

On Wed, 13 Aug 2003 13:36:11 +0100, Julian Fowler
wrote:

Yep, this one's genuine. You're more likely to be vulnerable if you
are on broadband (or otherwise have a 24/7 connection to the 'net).
You *should* be OK if you've kept your OS and anti-virus s/w up to
date, and/or run behind a firewall. If not, consider doing so ASAP
(the 'Blaster' worm is, as Keith says, *nasty*). Symantec have a
worm removal tool (free) on their website.

However, the Symantec removal tool is only likely to be effective if
the machine is patched first, using the downloadable patch available
at:

http://www.microsoft.com/technet/sec...n/MS03-026.asp

I have a report of someone's machine getting infected 3 times while trying
to download the MS patch.


The Symantec security response document including a link to the
downloadable detection and removal tool is available at:


http://securityresponse.symantec.com...aster.worm.htm
l

This is somewhat unusual (needing to patch the infected machine
concerned before detection and removal of the worm) and owners of
infected Windows XP machines should pay particular attention to the
instructions in the Symantec security response document, specifically
the section "1. Disabling System Restore (Windows XP)".

A short answer for disabling this virus a

(0) remove any network or modem cables attached to the machine.
(1) Bring your machine up in "Safe Mode" by pressing F5 while re-booting.
The virus will give you ample opportunities to do this!
(2) Go to My Computer
(3) Open up your "C" drive
(4) Open up the "Windows" folder
(5) Open up the "System32" folder in the "Windows" folder
(6) Delete the MSBLAST.EXE file.

You can avoid reinfection the next time you go online by downloading and
applying the (now) well-known fix from MS. The obvious challenge is getting
the fix before you get re-infected.