Re: MS worm virus

From: Bruce Chambers (bchambers_at_nospamcableone.net)
Date: 10/17/03 

Date: Thu, 16 Oct 2003 19:47:23 -0600

Greetings --

    Installing the patch only prevents future infections; it does
nothing to remove the worm, once it's installed.

   If you connected the PC to the Internet without having first
enabling a firewall, without having first installed an antivirus
application with current virus definition files, and/or before
installing the KB824146 Hotfix, you're very likely to get infected
from any of the thousands of PCs on the Internet that are constantly
broadcasting the Blaster and/or Welchia worms. It only takes a few
seconds of exposure.

    To stay on-line long enough to get the necessary updates, patches,
and removal tools, click Start > Run, and enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut down. Also, make
sure you've enabled a firewall before starting, to preclude any more
intrusions while getting the updates/patches/tools.

Microsoft Security Bulletin MS03-39
http://support.microsoft.com/?kbid=824146

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm a.k.a. W32/Lovesan.Worm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Welchia.Worm Removal Tool
http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

McAfee AVERT Stinger
http://us.mcafee.com/virusInfo/default.asp?id=stinger

Bruce Chambers 

--
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html
You can have peace.  Or you can have freedom.  Don't ever count on
having both at once. -- RAH
"Salam" <anonymous@discussions.microsoft.com> wrote in message
news:03cc01c392ab$2d09dd70$a401280a@phx.gbl...
> my friends PC has a blast worm, it causes an RPC error
> which shuts down the computer, i installed the security
> patch on the computer but still the same. Any
> suggestions ? Cheers

Relevant Pages

  • Re: XP rebooting
    ... Problem with both of these fixes obviously - I CAN'T GET INTO WINDOWS. ... > and your computer has been infected by the Sasser worm, ... disconnect from the Internet: ... > Step 5: Enable a Firewall ...
    (microsoft.public.security.virus)
  • RE: XP rebooting
    ... sasser virus as sasser is more prevalent these days. ... take these steps to update your software, remove the worm, and help ... To avoid further problems, disconnect from the Internet: ... Step 5: Enable a Firewall ...
    (microsoft.public.security.virus)
  • Re: Windows XP Product Activation
    ... application with current virus definition files, and before installing ... sure you've enabled a firewall before starting, ... What You Should Know About the Blaster Worm ... W32.Blaster.Worm Removal Tool ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: system shutdown screen
    ... Before starting make sure you have a firewall active see step 3a: ... This stops the worm from running, so your system will not shutdown. ... and Internet Connections, then click Network Connections. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Anyone Have This Problem?
    ... I would install one or two antispyware programs. ... > on a CD, or a third party software firewall, and install that. ... > reduce the risk of worm infection when you connect to the internet. ...
    (comp.security.firewalls)