Worm Blaster

[Beach Hut]

I read somewhere that if your PC is affected by this it could could pear shaped at midnight tonight.

Can anyone back this up ?

Has anyone had problems with it ? I downloaded the patch from Microsoft.

 

[Beach Hut]

WWW. Microsoft. com - there is a link to the patch, you have XP ?

 

[Yorkie]

Patch

 

[Hilton]

I have spent this afternoon trying to clean someones computer who had it. Really hard to do as it shutdown everytime before the remover could work. Had to use quite a few tries to kill it, got there in the end though!

I managed to get mine protected before it was infected though.

 

[bigc]

no, it was supposed to attack microsoft at midnight yesterday(i think), specifically putting down the windowsupdate site meaning nobody would be able to download the patch

 

[Yorkie]

I had a firewall and also covered by Norton systemworks so wasn't affected at all.

I did a search just in case but all is clean

 

[marvin]

Except it was coded with the wrong url. It was just a url that microsoft use to forward people to the right site which means 2 things, all they had to do was stop the redirection url so no effect on their servers and 2. adds weight to the conspiracy theory.

 

[Beach Hut]

How do I check if I have it ?

As my PC doesn't keep re-booting I assume I am OK or is that a naiive question ?

 

[albiongirl]

I was given a hand out by PC World and instructions on what do do. I had to download the worm blaster tool twice and then download my Norton software. Pain in the arse and took me ages last night.So hopefully I will be alright.

 

[Eggmundo]

Not sure if it helps but here's the e-mail i got from NTL.
Cleared my mates yesterday,quite easy really (and i'm no IT wizard beleive me) but as i run 98 i'm OK........


Users of the following operating systems could be affected: Windows XP, Windows 2000, Windows 2003, Windows NT 4.0.

Customers using Windows 95, Windows 98 or Windows ME are not affected.

What is the name of the virus?

Microsoft refers to this virus as the "W32.Blaster.Worm", but it is also known as W32/Lovsan.worm, WORM_MSBLAST.A, Win32.Posa.Worm.

How do you I avoid getting the virus?

Firstly, you should ensure that you install a Firewall application and anti virus software on your computer. A Firewall prevents unauthorised access to your computer and will prevent attack from viruses. Anti-virus software will protect you from viruses as long as you keep it up to date with the latest updates. Microsoft XP comes equipped with a Firewall - or you can download and install a free Firewall from www.zonealarm.com.

Users of the operating systems listed above, in the section 'Which computer operating systems are affected?' should enhance their software with the latest update called a "patch". The patch that will address this issue is called MS03-026. Updating your computer with this patch will remove the vulnerability and prevent this type of virus affecting you.

Customers that have previously applied the security patch MS03-026 before today are protected and no further action is required.

How do you know if your computer has the virus?

The most common symptom of the virus is that your computer will restart every few minutes, without your input. You may also find that a file called msblast.exe has been created in your computer's WINDOWS SYSTEM32 directory.

How do you know if you have the virus?

To detect this virus, search for msblast.exe in the WINDOWS SYSTEM32 directory or download the latest anti-virus software signature from your anti-virus vendor and scan your machine.

A number of software vendors are working together to overcome this virus. Additional information on this virus is available from any of the following links:

Network Associates:
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100547

Trend Micro:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A

Symantec:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Computer Associates:
http://www3.ca.com/virusinfo/virus.aspx?ID=36265

Microsoft's Virus Information Alliance: http://www.microsoft.com/technet/security/virus/via.asp

If you get the Virus how do you remove it?

1. In order to remove this virus please follow these instructions:

Do a search for msblast.exe by using the find files or programmes command (usually found in system32 folder)
Delete it.
Click Start and select Run
Type msconfig & click OK
Select the start-up tab
Disable msblast
Reboot machine and enable your Firewall or anti-virus software. Refer to your software instructions provided to ensure that it is set up correctly.

Alternatively

Security specialists Symantec have released a tool which will remove the current infection from your computer. To download this tool, go to www.symantec.com and go to the security response section. Then click the W32.Blaster.Worm link in the latest virus threats section. This page offers more information regarding the worm, and a downloadable tool to remove it.

2. Once you have removed the virus, immediately select one of the links below to install the security patch needed to ensure no repeat infection occurs.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

If you are away from your machine or are unable to get on-line, then the above links will provide patches which are small enough to download from another PC on to a floppy disc, to install on your PC at a later date.

 

[Lady Bracknell]

If you are running XP you need to disable System Restore BEFORE running the fix tool. Then re-boot, check the virus has been zapped and enable System Restore. Otherwise there's a danger that the fix won't have fixed the problem.

 

[Raphael Meade]

i havent got the virus, but in the last few weeks my firewalls blocked about 15 'attacks' or someone/something trying to access my computer each day. They stopped completely about 2/3 days ago.

I've had a scout around and i'm clean

 

[Sam]

ive got it and its so annoying pc just keeps turing off and i cant do anythin about it!

 

[Hilton]

Go here and download the the tool(if you can do it and run it before you are shut down).

http://securityresponse1.symantec.com/sarc/sarc.nsf/html/w32.blaster.worm.removal.tool.html