W32.Blaster.Worm ?!!?!?

  • Thread starter Thread starter Lucy
  • Start date Start date
L

Lucy

I have followed the instructions to remove the worm as
suggested by the Symantec site but it hasn't seemed to
work. I've run the removal tool the second time and it's
not found anything. The virus is obviously still there as
it is shutting my XP machine down.

Any further suggestions!?!??!

Thanks
 
Lucy said:
I have followed the instructions to remove the worm as
suggested by the Symantec site but it hasn't seemed to
work. I've run the removal tool the second time and it's
not found anything. The virus is obviously still there as
it is shutting my XP machine down.

Any further suggestions!?!??!

Thanks
Click to expand...

Did you also apply the patch from Microsoft to prevent re-infection?
 
"> I have followed the instructions to remove the worm as
suggested by the Symantec site but it hasn't seemed to
work. I've run the removal tool the second time and it's
not found anything. The virus is obviously still there as
it is shutting my XP machine down.

Any further suggestions!?!??!

Thanks
Click to expand...

It is critical that you apply the patch. Not only does it prevent re-infection, but I've spent 12 hrs today fighting this worm on our W2K domain, and I've found that after removal, all the PCs still had the symptoms of the virus. Only after installing the patch did the symptoms disappear. Don't ask me why or how, but it's true.

A tired sysadmin..................
 
make sure you are logged in as administrator when you install patch

--
Jerry
mailto:[email protected]
(e-mail address removed)
(e-mail address removed)

Love is never having to say you're sorry.
Marriage is never having a chance to say
anything.

Donald Ross said:
suggested by the Symantec site but it hasn't seemed to
work. I've run the removal tool the second time and it's
not found anything. The virus is obviously still there as
it is shutting my XP machine down.

Any further suggestions!?!??!

Thanks
Click to expand...

It is critical that you apply the patch. Not only does it prevent re-infection, but I've spent 12 hrs today fighting this worm on our W2K domain, and I've found that after removal, all the PCs still had the symptoms of the virus. Only after installing the patch did the symptoms disappear. Don't ask me why or how, but it's true.

A tired sysadmin..................
 
"> I have followed the instructions to remove the worm as

It is critical that you apply the patch. Not only does it
prevent re-infection, but I've spent 12 hrs today fighting this
worm on our W2K domain, and I've found that after removal, all
the PCs still had the symptoms of the virus. Only after
installing the patch did the symptoms disappear. Don't ask me
why or how, but it's true.

A tired sysadmin..................
Click to expand...

Not one customer (myself included) with the symptoms had any sign
of an infection (they all use firewalls and upto date AV programs).

You don't need to be infected to have the problem. An attack on an
"unpatched" system will cause the service to "unexpectedly"
shutdown and re-boot the computer.

I'm guessing that because my firewall prevented TFTP.exe from
accessing the internet, the attacker had no way of finishing the
job. An unprotected system would have allowed the worm to be
uploaded.

Nick Goetz
 
Back
Top