worm blaster

[Kathy]

Hi, My home computer shutdown because of the virus. I
turned on the ICF in my computer. I then downloaded the
patch for WindowsXP. Thought I was safe. Next day the
worm was detected by my Norton Antivirus but no fix
available. Do you have a fix yet for this awful virus?
There should be huge consequences for persons who do
this. Thank you for any help you can give.

 

[Jeff Brown[MSFT]]

Kathy,

Try the following:

To clean the blaster worm from your system do the following:

For Windows XP

1. First, click Start, Run and type: shutdown -a

This prevents the system from automatically restarting long enough for you to download and install the Microsoft security
update.

Click OK.

If the "shutdown -a" command fails to keep the computer from restarting, use the following steps:
Click Start, Run, and type: services.msc

a. A Services window appears.
b. Click OK.
c. Double-click Remote Procedure Call (RPC) and select the Recovery tab. Be careful to not use the Remote Procedure
Call (RPC) Locator item.
d. Set the First Failure, Second Failure, and Subsequent Failures items to Take No Action.
e. Click OK to apply the settings.

2. Second, install the built in firewall such as
Internet Connection Firewall (ICF) in Windows XP:
http://support.microsoft.com/?id=283673

--In Control Panel, double-click "Networking and Internet Connections", and then click "Network Connections".
--Right-click the connection on which you would like to enable ICF, and then click "Properties".
--On the Advanced tab, click the box to select the option to "Protect my computer or network".

3. Third, download the MS03-026 security patch from Microsoft:
Windows XP (32 bit)
http://download.microsoft.com/downl...58f-aaee-b7a52a983f01/WindowsXP-KB823980-x86-
ENU.exe

4. Install or update your antivirus signature software

5. Finally, download the worm removal tool from your antivirus vendor. Or http://vil.nai.com/vil/stinger/
http://www.trendmicro.com/download/tsc.asp

6. If you used the "services.msc" command (as explained above in Step 1) to prevent your computer from restarting,
restore your RPC recovery settings to their original state as follows:

a. Click Start, Run, and type: services.msc
b. Click OK.
c. Double-click Remote Procedure Call (RPC) and select the Recovery tab. Be careful to not use the Remote Procedure
Call (RPC) Locator item.
d. Set the First Failure, Second Failure, and Subsequent Failures items to Restart the Computer.
e. Click OK to apply the settings.

Thanks,
__
Jeff Brown
Microsoft Support Professional
MCSE

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!
--------------------