quick question about the worm

[mel]

Does the SP1 contain the patch for the blaster worm? I
was wondering because I installed the SP1 on Sunday, but
on Monday, I experienced the shutdown notices, but the
symantec removal tool informed me there was no virus. I
could have sworn I had my ICF on, but it wasn't and after
that I was able to stay on line. I have searched
everything and I still don't find anything. Thanks a
bunch.
..

 

[djs]

x-no-archive: yes

Does the SP1 contain the patch for the blaster worm?

No, SP-1 does not include the patch for MSBlast. And I wouldn't blindly
trust the removal tools. Several variants of MSBlast have come out, and
removal tools may not catch them all. Instead, I'd carefully follow the
manual removal instructions in addition to running the removal tools (in
Safe Mode).

 

[Doug Knox MS-MVP]

Additionally, its suspected that some of the RPC crashes were caused by
unsuccessful attempts to exploit the vulnerability on unpatched systems.

 

[mel]

Thanks for your feedback. I have been going nuts on this
thing, because I can't find anything anywhere - registry -
task manager - windows folders - nothing. Now if I can
only figure out how to install the patch on my friend's
computer. It keeps giving the message you have to have
admin priv. and she does. We even tried a new user as
admin and can't get it to load. Isn't this a mess?

 

[Doug Knox MS-MVP]

Are you downloading the patch from Windows Update, or the direct link?

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

 

[mel]

She downloaded it a week ago from the update (I think -
she is my econ prof.-you know how they are!), and never
took the time to install. She has not been infected, but
it has taken me for a loop as to how to get it to
finish. It runs the wizard, but then says at the end it
has to have admin. I can't understand when I added a new
user as admin, why it wouldn't let me go ahead.