Are These Sasser Worm Symptoms?

[Regina Litman]

I know what to do if I have the Sasser worm, and I also have plans afoot
to get a firewall in by the end of the week. I'm a home user of XP, but
I have XP Professional. My Internet connection is via a DSL line, so I
think (but I am not sure) that this means that I can get something
through my connection without knowing it, possibly even when I'm not
signed on to the Internet, and possibly even without the computer being
turned on.

Anyway, here are some things that have happened to my computer in the
past week or so. Have any of you had any of these problems, and if so,
do you know what caused it?

1. Norton Anti-Virus got corrupted to the point that the virus checking
was turned off. Plus LiveUpdate no longer works - I get a message that
says, "LU1848 Couldn't create callback object." I am aware that this is
a Microsoft help group, not a Symantec/Norton help group. I have already
found fixes for these on the Symantec site. I am only posting this item
to find out if others have had this problem, too.

2. Windows Media Player got uninstalled. Fortunately, I was able to get
it back by running Windows Update and downloading it as a suggested
Windows XP addition.

3. A left-side frame with Lycos in the name showed up on a Google search
results page. I was able to click in an "x" in a corner to get rid of
it. The next time I went to the desktop, I saw a new icon to start up
this Lycos item. I went into Add/Remove programs in the Control Panel
and found this item with a date of 5/5/04 (the day this happened). I
removed it, and so far it doesn't seem to have returned.

4. I am getting an inordinate number of pop-up ads. I've been remiss in
installing a pop-up blocker because the number I got, from such sites as
www.snopes.com, www.imdb.com, and www.espn.com that rely upon a
reasonable number of these, was manageable. I'm getting these at sites
that would almost certainly not have pop-ups, including ones run by the
U.S. Government. While a "solution" to this is to get a pop-up blocker,
I want to treat the problem itself, not the symptoms. Plus, some web
sites I visit use the same technology as pop-ups to display legitimate
information, so I don't want to close myself out of these.

5. The past two days, as I've tried to go to Symantec's site, a
full-screen page to order a different anti-virus product appears. I
don't know if this is a spoof or a legitimate page. The only way to get
rid of this page that I have found so far is to do Ctl-Alt-Del and then
End Task for this displayed page (which does not shut down Internet
Explorer totally, and once that page is gone, I can see Symatec's okay).

Thanks for any comments anyone has regarding these.

 

[MAP]

-----Original Message-----
I know what to do if I have the Sasser worm, and I also have plans afoot
to get a firewall in by the end of the week. I'm a home user of XP, but
I have XP Professional. My Internet connection is via a DSL line, so I
think (but I am not sure) that this means that I can get something
through my connection without knowing it, possibly even when I'm not
signed on to the Internet, and possibly even without the computer being
turned on.

Anyway, here are some things that have happened to my computer in the
past week or so. Have any of you had any of these problems, and if so,
do you know what caused it?

1. Norton Anti-Virus got corrupted to the point that the virus checking
was turned off. Plus LiveUpdate no longer works - I get a message that
says, "LU1848 Couldn't create callback object." I am aware that this is
a Microsoft help group, not a Symantec/Norton help group. I have already
found fixes for these on the Symantec site. I am only posting this item
to find out if others have had this problem, too.

2. Windows Media Player got uninstalled. Fortunately, I was able to get
it back by running Windows Update and downloading it as a suggested
Windows XP addition.

3. A left-side frame with Lycos in the name showed up on a Google search
results page. I was able to click in an "x" in a corner to get rid of
it. The next time I went to the desktop, I saw a new icon to start up
this Lycos item. I went into Add/Remove programs in the Control Panel
and found this item with a date of 5/5/04 (the day this happened). I
removed it, and so far it doesn't seem to have returned.

4. I am getting an inordinate number of pop-up ads. I've been remiss in
installing a pop-up blocker because the number I got, from such sites as
www.snopes.com, www.imdb.com, and www.espn.com that rely upon a
reasonable number of these, was manageable. I'm getting these at sites
that would almost certainly not have pop-ups, including ones run by the
U.S. Government. While a "solution" to this is to get a pop-up blocker,
I want to treat the problem itself, not the symptoms. Plus, some web
sites I visit use the same technology as pop-ups to display legitimate
information, so I don't want to close myself out of these.

5. The past two days, as I've tried to go to Symantec's site, a
full-screen page to order a different anti-virus product appears. I
don't know if this is a spoof or a legitimate page. The only way to get
rid of this page that I have found so far is to do Ctl- Alt-Del and then
End Task for this displayed page (which does not shut down Internet
Explorer totally, and once that page is gone, I can see Symatec's okay).

Thanks for any comments anyone has regarding these.
--
Please note my correct email address:

rslitman [at-sign] infionline [dot] net

.

Sounds more like spy/adware except for the part about
norton being disabled,that may? be a sign of a virus to
know for sure update its virus definitions and run a scan
while in "safe" mode.
No you will not be able to get a virus/trojan or worm
while you are not connected to the internet or if your
system is "off".
While your wating to get a firewall turn on the one that
comes with XP or download zone alarm from
www.zonelabs.com
This is a free firewall.I have never used it but many
people swear that it is a good one.
To check for spyware use these tools.

Spybot "Search and Destroy"
http://www.safer-networking.org/

Spywareblaster
http://www.javacoolsoftware.com/sbdownload.html

Spywareguard
http://www.javacoolsoftware.com/spywareguard.html

Ad-aware
http://www.lavasoft.de/

CWS Shedder,Hijackthis,BHO Demon
http://www.spywareinfo.com/~merijn/downloads.html

winpatrol
http://www.winpatrol.com/

CWShredder (Line 313) Home page lock (Line 63)
Hijack this (Line 116)
http://www.kellys-korner-xp.com/xp_tweaks.htm

http://www.spywareinfo.com/forums/

http://www.pestpatrol.com/PestInfo/

http://www.aumha.org/a/hjttutor.htm



The firewall should be your first priority!

 

[Crusty \(-: Old B@stard :-\)]

You can not get infected if your computer is turned off.

If you have an "always on" DSL connection, one that you don't have to
initiate prior to starting Internet Explorer or Outlook Express, then you
can become infected just by turning the computer on and booting into
Windows.

--
Regards:

Richard Urban

aka Crusty (-: Old B@stard

 

[Regina Litman]

Scroll down to the end for my comments. Usually, I delete the replied-to
text (in this case, my original message) when I reply in a newsgroup or
in email, but I don't know the protocol here. So, I'm leaving my
original message in here so people can follow along if they don't have
access to it elsewhere.

-----Original Message-----
I know what to do if I have the Sasser worm, and I also

have plans afoot

to get a firewall in by the end of the week. I'm a home

user of XP, but

I have XP Professional. My Internet connection is via a

DSL line, so I

think (but I am not sure) that this means that I can get
something

through my connection without knowing it, possibly even

when I'm not

signed on to the Internet, and possibly even without the

computer being

turned on.

Anyway, here are some things that have happened to my

computer in the

past week or so. Have any of you had any of these

problems, and if so,

do you know what caused it?

1. Norton Anti-Virus got corrupted to the point that the

virus checking

was turned off. Plus LiveUpdate no longer works - I get

a message that

says, "LU1848 Couldn't create callback object." I am

aware that this is

a Microsoft help group, not a Symantec/Norton help

group. I have already

found fixes for these on the Symantec site. I am only

posting this item

to find out if others have had this problem, too.

2. Windows Media Player got uninstalled. Fortunately, I

was able to get

it back by running Windows Update and downloading it as

a suggested

Windows XP addition.

3. A left-side frame with Lycos in the name showed up on

a Google search

results page. I was able to click in an "x" in a corner

to get rid of

it. The next time I went to the desktop, I saw a new

icon to start up

this Lycos item. I went into Add/Remove programs in the

Control Panel

and found this item with a date of 5/5/04 (the day this

happened). I

removed it, and so far it doesn't seem to have returned.

4. I am getting an inordinate number of pop-up ads. I've

been remiss in

installing a pop-up blocker because the number I got,

from such sites as

www.snopes.com, www.imdb.com, and www.espn.com that rely

upon a

reasonable number of these, was manageable. I'm getting

these at sites

that would almost certainly not have pop-ups, including

ones run by the

U.S. Government. While a "solution" to this is to get a

pop-up blocker,

I want to treat the problem itself, not the symptoms.

Plus, some web

sites I visit use the same technology as pop-ups to

display legitimate

information, so I don't want to close myself out of
these.

5. The past two days, as I've tried to go to Symantec's

site, a

full-screen page to order a different anti-virus product

appears. I

don't know if this is a spoof or a legitimate page. The

only way to get

rid of this page that I have found so far is to do Ctl-

Alt-Del and then

End Task for this displayed page (which does not shut

down Internet

Explorer totally, and once that page is gone, I can see

Symatec's okay).

Thanks for any comments anyone has regarding these.
--
Please note my correct email address:

rslitman [at-sign] infionline [dot] net

.

Sounds more like spy/adware except for the part about
norton being disabled,that may? be a sign of a virus to
know for sure update its virus definitions and run a scan
while in "safe" mode.
No you will not be able to get a virus/trojan or worm
while you are not connected to the internet or if your
system is "off".
While your wating to get a firewall turn on the one that
comes with XP or download zone alarm from
www.zonelabs.com
This is a free firewall.I have never used it but many
people swear that it is a good one.
To check for spyware use these tools.

Spybot "Search and Destroy"
http://www.safer-networking.org/

Spywareblaster
http://www.javacoolsoftware.com/sbdownload.html

Spywareguard
http://www.javacoolsoftware.com/spywareguard.html

Ad-aware
http://www.lavasoft.de/

CWS Shedder,Hijackthis,BHO Demon
http://www.spywareinfo.com/~merijn/downloads.html

winpatrol
http://www.winpatrol.com/

CWShredder (Line 313) Home page lock (Line 63)
Hijack this (Line 116)
http://www.kellys-korner-xp.com/xp_tweaks.htm

http://www.spywareinfo.com/forums/

http://www.pestpatrol.com/PestInfo/

http://www.aumha.org/a/hjttutor.htm



The firewall should be your first priority!

Thanks for your reply. I bought Norton Systemworks Twenty-oh-three in
tandem with Norton Personal Firewall Twenty-oh-three just about a year
ago. The Systemworks got installed then, but the Personal Firewall
didn't. We're going to need to reinstall Systemworks, and I have now
convinced the person in this household who usually does the major
installs that we need to install the Personal Firewall, too. Due to time
constraints, this might not get done until this weekend, and in
addition, if the weather is nice and sunny around here over the weekend,
we might not even get to it then, either. But I understand the need to
prioritze the firewall installation.

Regarding the firewall that came with XP (and bear in mind while
replying to this that I am a home user but have XP Professional
installed), can you either post some instructions here how to do it or a
direct link to a page within the Microsoft site that explains how to do it?

Thanks again for your help.

 

[Regina Litman]

You can not get infected if your computer is turned off.

If you have an "always on" DSL connection, one that you don't have to
initiate prior to starting Internet Explorer or Outlook Express, then you
can become infected just by turning the computer on and booting into
Windows.

I don't think my connection is what you refer to as an "always on" DSL
connection. When I boot up my computer, I still have to click on a
desktop icon to initiate my connection to the Internet. Only after I get
an indication that I have been connected do I then boot up Internet
Explorer and, for my email and newsgroups, Netscape (not Outlook).

Incidentally, I just discovered that another program of mine got
uninstalled - Tax Cut Twenty-oh-two.

 

[roger]

Hi regina,

[...]

2. Windows Media Player got uninstalled. Fortunately, I was able to get
it back by running Windows Update and downloading it as a suggested
Windows XP addition.

3. A left-side frame with Lycos in the name showed up on a Google search
results page. I was able to click in an "x" in a corner to get rid of
it. The next time I went to the desktop, I saw a new icon to start up
this Lycos item. I went into Add/Remove programs in the Control Panel
and found this item with a date of 5/5/04 (the day this happened). I
removed it, and so far it doesn't seem to have returned.

4. I am getting an inordinate number of pop-up ads. I've been remiss in
installing a pop-up blocker because the number I got, from such sites as
www.snopes.com, www.imdb.com, and www.espn.com that rely upon a
reasonable number of these, was manageable. I'm getting these at sites
that would almost certainly not have pop-ups, including ones run by the
U.S. Government. While a "solution" to this is to get a pop-up blocker,
I want to treat the problem itself, not the symptoms. Plus, some web
sites I visit use the same technology as pop-ups to display legitimate
information, so I don't want to close myself out of these.

5. The past two days, as I've tried to go to Symantec's site, a
full-screen page to order a different anti-virus product appears. I
don't know if this is a spoof or a legitimate page. The only way to get
rid of this page that I have found so far is to do Ctl-Alt-Del and then
End Task for this displayed page (which does not shut down Internet
Explorer totally, and once that page is gone, I can see Symatec's okay).

Thanks for any comments anyone has regarding these.

More info about parasites:
http://www.aumha.org/a/parasite.htm

Download the utility CWshredder:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip
Unzip - close *all* instances of IE & OE, hit the executable and
follow the prompts.

You can also download Hijack This from here:
http://www.mjc1.com/files/merijn/hijackthis.exe

Go here:
http://mjc1.com/mirror/hjt/

For instructions on how to use it; you have to post the log it
produces here:
http://www.spywareinfo.com/forums/
so experts tell you what is good and what is malware
HiJack This is a program that simply searches for programs that run
at boot time, and checks for browser plug-ins. The results this
program gives you are generally just informative. Most of the
programs it will come up with are valid programs that you actually
want running. You'll have to go through the results and tell the
program to delete unwanted programs. If you can't figure out what
some of the programs are, don't just delete them, research them
and/or post them so experts can let you know what the program does.
I generally will just type the program name into google which gets
a decent answer pretty quickly.

Try downloading, installing and updating the
spyware removers from the links below. Run both of them.

Ad-aware
http://www.lavasoftusa.com/support/download/

Spybot S&D
http://www.safer-networking.org/index.php?lang=en&page=download


If these don't correct the problem, then get yourself a copy of

BHODemon, available at
http://www.definitivesolutions.com/bhodemon.htm .
It does not need installing - simply unzip and run the EXE program.
It is easy to use. It will find the hijackware DLL files, and
give you the ability to disable them.

Hope this helps.

 

[Guest]

No, those don't sound like Sasser symptoms. More like a malicious trojan or adware. However, I'm not sure what they could be. Sasser doesn't cause damage like that, it only causes performance slowdowns

Nonetheless, reboot into safe mode and run Norton Antivirus. I'm pretty sure it will find a couple of malicious files

-Operator

 

[Regina Litman]

No, those don't sound like Sasser symptoms. More like a malicious trojan or adware. However, I'm not sure what they could be. Sasser doesn't cause damage like that, it only causes performance slowdowns.

Nonetheless, reboot into safe mode and run Norton Antivirus. I'm pretty sure it will find a couple of malicious files.

-Operator

Just wondering - what's the purpose of rebooting into safe mode? In
other words, what's the difference between running Norton Antivirus in
safe mode and, for lack of knowledge of a different proper name,
not-safe mode?

 

[anonymous]

Hi,

.........what's the purpose of rebooting into safe mode?

About 19 zillion files won't be in use when your antivirus is looking
around in there. Safe mode loads about the least number of files Windoze
will run with.

---==X={}=X==---


Jim Self
AVIATION ANIMATION, the internet's largest depository.
http://avanimation.avsupport.com

Your only internet source for spiral staircase plans.
http://jself.com/stair/Stair.htm

 

[joust in jest]

trojan or adware. However, I'm not sure what they could be. Sasser doesn't
cause damage like that, it only causes performance slowdowns.

Just wondering - what's the purpose of rebooting into safe mode? In
other words, what's the difference between running Norton Antivirus in
safe mode and, for lack of knowledge of a different proper name,
not-safe mode?

Safe Mode loads only the minimum files necessary to boot Windows. The virus
is also not loaded, so that it can not prevent Norton Antivirus from
loading. Note that NAV will also not be loaded in Safe Mode -- you will
have to start it manually.

steve

 

[Lance Joiner]

Scroll down to the end for my comments. Usually, I delete the replied-to
text (in this case, my original message) when I reply in a newsgroup or in
email, but I don't know the protocol here. So, I'm leaving my original
message in here so people can follow along if they don't have access to it
elsewhere.

-----Original Message-----
I know what to do if I have the Sasser worm, and I also

have plans afoot

to get a firewall in by the end of the week. I'm a home

user of XP, but

I have XP Professional. My Internet connection is via a

DSL line, so I

think (but I am not sure) that this means that I can get
something
through my connection without knowing it, possibly even

when I'm not

signed on to the Internet, and possibly even without the

computer being

turned on.

Anyway, here are some things that have happened to my

computer in the

past week or so. Have any of you had any of these

problems, and if so,

do you know what caused it?

1. Norton Anti-Virus got corrupted to the point that the

virus checking

was turned off. Plus LiveUpdate no longer works - I get

a message that

says, "LU1848 Couldn't create callback object." I am

aware that this is

a Microsoft help group, not a Symantec/Norton help

group. I have already

found fixes for these on the Symantec site. I am only

posting this item

to find out if others have had this problem, too.

2. Windows Media Player got uninstalled. Fortunately, I

was able to get

it back by running Windows Update and downloading it as

a suggested

Windows XP addition.

3. A left-side frame with Lycos in the name showed up on

a Google search

results page. I was able to click in an "x" in a corner

to get rid of

it. The next time I went to the desktop, I saw a new

icon to start up

this Lycos item. I went into Add/Remove programs in the

Control Panel

and found this item with a date of 5/5/04 (the day this

happened). I

removed it, and so far it doesn't seem to have returned.

4. I am getting an inordinate number of pop-up ads. I've

been remiss in

installing a pop-up blocker because the number I got,

from such sites as

www.snopes.com, www.imdb.com, and www.espn.com that rely

upon a

reasonable number of these, was manageable. I'm getting

these at sites

that would almost certainly not have pop-ups, including

ones run by the

U.S. Government. While a "solution" to this is to get a

pop-up blocker,

I want to treat the problem itself, not the symptoms.

Plus, some web

sites I visit use the same technology as pop-ups to

display legitimate

information, so I don't want to close myself out of
these.

5. The past two days, as I've tried to go to Symantec's

site, a

full-screen page to order a different anti-virus product

appears. I

don't know if this is a spoof or a legitimate page. The

only way to get

rid of this page that I have found so far is to do Ctl-

Alt-Del and then

End Task for this displayed page (which does not shut

down Internet

Explorer totally, and once that page is gone, I can see

Symatec's okay).

Thanks for any comments anyone has regarding these.
--
Please note my correct email address:

rslitman [at-sign] infionline [dot] net

.

Sounds more like spy/adware except for the part about norton being
disabled,that may? be a sign of a virus to know for sure update its virus
definitions and run a scan while in "safe" mode.
No you will not be able to get a virus/trojan or worm while you are not
connected to the internet or if your system is "off".
While your wating to get a firewall turn on the one that comes with XP or
download zone alarm from www.zonelabs.com
This is a free firewall.I have never used it but many people swear that
it is a good one.
To check for spyware use these tools.

Spybot "Search and Destroy"
http://www.safer-networking.org/

Spywareblaster
http://www.javacoolsoftware.com/sbdownload.html

Spywareguard
http://www.javacoolsoftware.com/spywareguard.html

Ad-aware
http://www.lavasoft.de/

CWS Shedder,Hijackthis,BHO Demon
http://www.spywareinfo.com/~merijn/downloads.html
winpatrol http://www.winpatrol.com/

CWShredder (Line 313) Home page lock (Line 63)
Hijack this (Line 116) http://www.kellys-korner-xp.com/xp_tweaks.htm

http://www.spywareinfo.com/forums/

http://www.pestpatrol.com/PestInfo/

http://www.aumha.org/a/hjttutor.htm



The firewall should be your first priority!

Thanks for your reply. I bought Norton Systemworks Twenty-oh-three in
tandem with Norton Personal Firewall Twenty-oh-three just about a year
ago. The Systemworks got installed then, but the Personal Firewall didn't.
We're going to need to reinstall Systemworks, and I have now convinced the
person in this household who usually does the major installs that we need
to install the Personal Firewall, too. Due to time constraints, this might
not get done until this weekend, and in addition, if the weather is nice
and sunny around here over the weekend, we might not even get to it then,
either. But I understand the need to prioritze the firewall installation.

Regarding the firewall that came with XP (and bear in mind while replying
to this that I am a home user but have XP Professional installed), can you
either post some instructions here how to do it or a direct link to a page
within the Microsoft site that explains how to do it?

Thanks again for your help.

 

[Lance Joiner]

Scroll down to the end for my comments. Usually, I delete the replied-to
text (in this case, my original message) when I reply in a newsgroup or in
email, but I don't know the protocol here. So, I'm leaving my original
message in here so people can follow along if they don't have access to it
elsewhere.

-----Original Message-----
I know what to do if I have the Sasser worm, and I also

have plans afoot

to get a firewall in by the end of the week. I'm a home

user of XP, but

I have XP Professional. My Internet connection is via a

DSL line, so I

think (but I am not sure) that this means that I can get
something
through my connection without knowing it, possibly even

when I'm not

signed on to the Internet, and possibly even without the

computer being

turned on.

Anyway, here are some things that have happened to my

computer in the

past week or so. Have any of you had any of these

problems, and if so,

do you know what caused it?

1. Norton Anti-Virus got corrupted to the point that the

virus checking

was turned off. Plus LiveUpdate no longer works - I get

a message that

says, "LU1848 Couldn't create callback object." I am

aware that this is

a Microsoft help group, not a Symantec/Norton help

group. I have already

found fixes for these on the Symantec site. I am only

posting this item

to find out if others have had this problem, too.

2. Windows Media Player got uninstalled. Fortunately, I

was able to get

it back by running Windows Update and downloading it as

a suggested

Windows XP addition.

3. A left-side frame with Lycos in the name showed up on

a Google search

results page. I was able to click in an "x" in a corner

to get rid of

it. The next time I went to the desktop, I saw a new

icon to start up

this Lycos item. I went into Add/Remove programs in the

Control Panel

and found this item with a date of 5/5/04 (the day this

happened). I

removed it, and so far it doesn't seem to have returned.

4. I am getting an inordinate number of pop-up ads. I've

been remiss in

installing a pop-up blocker because the number I got,

from such sites as

www.snopes.com, www.imdb.com, and www.espn.com that rely

upon a

reasonable number of these, was manageable. I'm getting

these at sites

that would almost certainly not have pop-ups, including

ones run by the

U.S. Government. While a "solution" to this is to get a

pop-up blocker,

I want to treat the problem itself, not the symptoms.

Plus, some web

sites I visit use the same technology as pop-ups to

display legitimate

information, so I don't want to close myself out of
these.

5. The past two days, as I've tried to go to Symantec's

site, a

full-screen page to order a different anti-virus product

appears. I

don't know if this is a spoof or a legitimate page. The

only way to get

rid of this page that I have found so far is to do Ctl-

Alt-Del and then

End Task for this displayed page (which does not shut

down Internet

Explorer totally, and once that page is gone, I can see

Symatec's okay).

Thanks for any comments anyone has regarding these.
--
Please note my correct email address:

rslitman [at-sign] infionline [dot] net

.

Sounds more like spy/adware except for the part about norton being
disabled,that may? be a sign of a virus to know for sure update its virus
definitions and run a scan while in "safe" mode.
No you will not be able to get a virus/trojan or worm while you are not
connected to the internet or if your system is "off".
While your wating to get a firewall turn on the one that comes with XP or
download zone alarm from www.zonelabs.com
This is a free firewall.I have never used it but many people swear that
it is a good one.
To check for spyware use these tools.

Spybot "Search and Destroy"
http://www.safer-networking.org/

Spywareblaster
http://www.javacoolsoftware.com/sbdownload.html

Spywareguard
http://www.javacoolsoftware.com/spywareguard.html

Ad-aware
http://www.lavasoft.de/

CWS Shedder,Hijackthis,BHO Demon
http://www.spywareinfo.com/~merijn/downloads.html
winpatrol http://www.winpatrol.com/

CWShredder (Line 313) Home page lock (Line 63)
Hijack this (Line 116) http://www.kellys-korner-xp.com/xp_tweaks.htm

http://www.spywareinfo.com/forums/

http://www.pestpatrol.com/PestInfo/

http://www.aumha.org/a/hjttutor.htm



The firewall should be your first priority!

Thanks for your reply. I bought Norton Systemworks Twenty-oh-three in
tandem with Norton Personal Firewall Twenty-oh-three just about a year
ago. The Systemworks got installed then, but the Personal Firewall didn't.
We're going to need to reinstall Systemworks, and I have now convinced the
person in this household who usually does the major installs that we need
to install the Personal Firewall, too. Due to time constraints, this might
not get done until this weekend, and in addition, if the weather is nice
and sunny around here over the weekend, we might not even get to it then,
either. But I understand the need to prioritze the firewall installation.

Regarding the firewall that came with XP (and bear in mind while replying
to this that I am a home user but have XP Professional installed), can you
either post some instructions here how to do it or a direct link to a page
within the Microsoft site that explains how to do it?

HOW TO: Enable or Disable Internet Connection Firewall in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;283673&Product=winxp