View My Guestbook Sign My Guestbook

Important Blaster Worm Info You are visitor Please check back at regular intervals because these pages are updated periodically.

updated 08/19/03

Below is an excerpt from
"Kim Komando's Weekly Newsletter"
dtd:
August 16, 2003
addressing the latest threat, the
"Blaster Worm"

updated 08/19/03

ON THE QT: COOL THINGS I PASS ALONG JUST FOR YOU

--> HOW I WHIPPED MSBLASTER IN A TITANIC STRUGGLE!
Maybe that title is a little overblown. But I spent a good 30 minutes
fighting this worm. In fact, I was kind of glad that I got the worm.
This way, I can help you!

MSBlaster is a really nasty worm that is infecting computers around
the world. It takes advantage of a flaw in Windows XP, 2000 and NT.
Windows 98 and ME users are unaffected. The worm infects computers
that have Port 135 (a communication channel in Windows) open. If you
are connected to the Internet, it simply comes into your computer and
sets up residence. Once there, it can grab control of the computer.

Authorities (and I) have been warning about this since mid-July.

Unfortunately, my mom had installed XP on one of my home computers
and had not downloaded the Microsoft patch that blocks MSBlaster.
I found the worm on the computer about 6 a.m. Tuesday.

I first attempted to follow instructions in the Washington Post for
cleaning the machine. It said to press Ctrl+Alt+Del, then click Task
Manager. Then, under Applications, I was supposed to highlight
msblast.exe and click End Task. But MSBlaster wouldn't let me open
Task Manager. The next step was to find the msblast.exe file in
Windows Explorer. The worm wouldn't let me open that, either.

I finally conquered it by downloading a Symantec tool. The worm would
only allow me to stay online 60 seconds, then it kicked me off. But
that was long enough for the download. The worm wouldn't let me go to
the Microsoft site. But after cleaning the computer with the Symantec
tool, I downloaded the patch from Microsoft. I installed a firewall on
that machine, too. That computer is now safe.

If your machine is infected, go to my site (http://www.komando.com/)
Next to my picture are several items, including a link to the removal
tool. Click it and download the tool. If the worm won't let you go
online, download the tool from a clean machine, perhaps one at work.
Save it to a floppy or CD, then run it in your machine.

Before cleaning your machine, disable System Restore. This feature
could maintain a copy of the worm, even after you clean the machine.
To disable System Restore, click Start and right-click Properties.
Click the System Restore tab. Check "Turn off System Restore." Click
Apply>OK.

After cleaning your system, follow the same procedure to enable
System Restore.

The patch from Microsoft is at the link below:
http://www.microsoft.com/security/security_bulletins/ms03-026.asp

Next, install a firewall. I use ZoneAlarm (http://www.zonelabs.com).
Install an anti-virus program and update it. If you have not been
installing Microsoft's updates, do so. See Rookie Rundown below
for an explanation of why updates are necessary.


These Operating systems are affected:


			Microsoft Windows NT® 4.0 
			Microsoft Windows 2000 
			Microsoft Windows XP 
			Microsoft Windows Server™ 2003 

If you are running any of these systems you need the patch.

You can subscribe to this newsletter by clicking on
the link on my home page (www.brothersky.net)

Just look for the
"Subscribe to Kim Komando's Weekly Newsletter"
link.

You can run a "free" scan to check to see if there is any
viruses on your computer by clicking on the link below
http://securityresponse.symantec.com/
Just scroll down and look on your right till you see the link "check for security risks"