Blaster Worm & Firewall

[Kat]

Yesterday I downloaded Microsoft XP Service Pack One onto
my satelitte 2400 laptop. Now everytime I start my
computer I receive an error message stating the computer
will close itself down in 1 minute. I see someone else had
the same problem yesterday, so I followed the
instructions; Start, Run, type CMD, enter, the type
shutdown -a. That solved the timing problem. But when I
tried to turn on the firewall it tells me the connection
is disconnected (even though I can use the internet) and
when I click properties it says an "unexpected error
occured". I also tried going into task manager and
deleting MSblast.exe - but it did not appear as an option.
Your help would be greatly appreciated.
Thanks
Kat

 

[Kelly]

Hi Kat,

To stop the reboots: Go to Start/Run and type in: services.msc. Scroll down
to Remote Procedure Call (RPC)/Recovery/First Failure/Restart the Service.

Close Windows Explorer, run the edit on line 257 which includes the prompt
for the patch once your system has been cleaned.

This script removes all variants of the W32.Blaster.Worm (original, B, C, D,
E and F) and will inform you whether or not the patch is already installed.
http://www.kellys-korner-xp.com/xp_tweaks.htm. Direct download:
http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

More information here:
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

MS Blaster Tool: http://tinyurl.com/3h8kw

 

[Guest]

Thanks for the response Kelly,

Unfortunately I don't know that much about the technical
side of computers and don't quite understand. When I run
services.msc I can not find anything about recovery, first
failure, or restart the service. After typing services, I
clicked on the tab standard and found two options for the
RPC. What do you mean run the edit on line 257? Sorry to
be a pain.

 

[Kelly]

Hi,

Scroll down to Remote Procedure Call (the first one) then click on the
Recovery Tab (top). To the left of the first drop box it will read: First
failure, click on the arrow where it reads Take No Action in the drop
box and select Restart the Service.

As per line 257, click here:
http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

/xp_u.htm#xp_util


Thanks for the response Kelly,

Unfortunately I don't know that much about the technical
side of computers and don't quite understand. When I run
services.msc I can not find anything about recovery, first
failure, or restart the service. After typing services, I
clicked on the tab standard and found two options for the
RPC. What do you mean run the edit on line 257? Sorry to
be a pain.

 

[Guest]

Your computer is now infected with the W32.Blaster.Worm or
one of its variants. This happened because you have not
been using an internet connection firewall and have
apparently neglected to install the critical updates
available at the Windows Update website.
-----------------------------------------------------------
-------
If your computer is constantly attempting to shutdown
or reboot, quickly go to:

Start > Run and type: CMD , and hit enter.
This opens the Command Prompt window.

Then type: shutdown -a , and hit enter.

This should halt the rebooting problem.
-----------------------------------------------------------
-------
Then immediately turn-on Windows XP's built-in Firewall:
http://www.microsoft.com/security/protect/
(To enable the built-in firewall, go to:
Control Panel, double-click Networking and Internet
Connections, then click Network Connections. Right-click
your connection, then
Click Properties, and on the Advanced tab, click the option
"Protect my computer and network..." Note: the built in
firewall only monitors incoming traffic not outgoing (ie
spyware, trojans, etc.. you may have on your system).)

What You Should Know About the Blaster Worm and Its
Variants
http://www.microsoft.com/security/incident/blast.asp

A tool is available to remove Blaster worm and Nachi worm
infections from computers
that are running Windows 2000 or Windows XP
http://support.microsoft.com/?kbid=833330

A security issue has been identified that could allow an
attacker to
remotely compromise a computer running Microsoft Windows
and
gain complete control over it. You can help protect your
computer
by installing this update from Microsoft.
http://www.microsoft.com/downloads/details.aspx?
FamilyId=2354406C-C5B6-44AC-9532-
3DE40F69C074&displaylang=en

Above courtesy of MVP Carey
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

***Install a good firewall. ZoneAlarm is a free one you
can install.
Install a good anti-virus program making sure you keep
it's definitions up to date! ***
- - - - - - - - - - - - -
Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

Protect Your PC
http://www.microsoft.com/security/protect/default.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm
..html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm
..removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32
..welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm
..removal.tool.html

 

[kat]

Thanks for the info.

Unfortunately I am still having problems. I can not turn
on the internal firewall because I receive an error
message stating "an unexpected error has occured". - It
also states that the internet connection is disconnected
(even though I am able to use the internet) and I do not
have an Internet icon in the bottom right corner of my
task bar. Kelly suggested that I go through services,
under Run, but when I click on properties nothing happens
and I do not have any bars at the top saying recovery or
first failure.
Sorry to be a pain.

kat