OT - Ding Dong, the Wicked Worm is dead...

[Thermodyne]

Hm..Symantec link didn't work. Here it is in plain text.

http://securityresponse.symantec.com...r/FixBLast.exe

[Richard]

Yes that will fix this known issue, but I always advise my clients to rebuild. Why? Because almost every worm has other payloads attached to it that people don't find out for quite a bit later. Plus there are usually other exploits that sneak in the exploited system that are also not picked up until later.

It's up to you, but in my experience once a box is infected it's best to start over to be sure.

Just my 2 cents worth, from doing security consulting for some time now.

[narf poit chez BOOM]

Click this link and save the file to your desktop.

maybe you should make that more clear.

[General Woundwort]

The evil worm is slain (or so it appears so far).

I had to run the remover twice (I forgot to set the machine to safe mode the first time), but I got the sucker.

I also downloaded all the available security patches from Windows Update... while there was still time...

Tomorrow, I will get Norton AntiVirus, and an external CD-RW, so that I will have some beefier protection against this sort of nonsense, and some real back-up capacity.

I also downloaded DirectX9, in anticipation of Starfury...

[Baron Munchausen]

You won't need DX9. It works fine with 8.0a and 8.1 in our experience. (Good thing too... DX 9 is so HUGE!)

[Taz-in-Space]

&#1 Taz had worms!!! &#1

Yep! Taz HAD the BLaster Worm but after going to Doc. Microsoft he is OK now!!!

Seriously, this worm is aggravating - it shuts down your computer every 5 - 10 minutes. At least if you are Online.

To tell if you have it, check for a process running that is named msbLast.exe

The easiset way to do that on a Windows XP machine is to press: Control-Alt-Delete
This will bring up a screen showing the running applications.
Press the processes Tab.
Look for the msbLast process; if it is there highlight and press end process button.
Then either run the Symantic program mentioned before to remove the worm or do a complete search on all drives for msbLast.exe (I found mine in C:\windows\system32 folder)
Delete all occurances.

One thing I should mention is the System Restore function on Windows XP machines - this MIGHT bring the worm back in certain cases.

To prevent this...
Again on Windows XP machines:
Right click on My Computer
Click on properties
click on system restore tab
Select (check) the Turn Off System Restore box
click apply

This will erase all system restore points on the computer.

Then go back again and uncheck the Turn Off System Restore box
and Click apply

Now there is no way system restore can 'resurrect' the bLaster worm.

You have now killed the worm... now goto the microsoft update site and make sure no other ones crawl in!!!

P.S. I hope you have more than the 56K Modem that Taz has - It took me 2 (TWO) HOURS to download all patches (30 Meg download).

[Kamog]

Are you immune to this worm if you're using Windows 98?