OT - Ding Dong, the Wicked Worm is dead...

[narf poit chez BOOM]

Click this link and save the file to your desktop.

maybe you should make that more clear.

[minipol]

for this virus, you just need to install the microsoft patch, and preferably update your virus definitions. that's all case closed. no need to rebuilt the system.
you might want to install a firewall system as well for instance i use zonealarm. the basic Version is free.
next check once for spyware. 2 great free products: adaware and spybot.
next, relax and drink a beer

[Thermodyne]

Don't reload your system, the worm is easy to kill. First you kill it then you lock it out.

Here is how to kill it:



--------------------------------------------------------------------------------


If your system is continually rebooting (randomly powering off) please follow the steps outlined below

Please execute the following steps to start your system in safe mode:

Shut down your computer. Turn it back on again, and hold down the F8 key while your system starts.

When prompted, select Safe Mode and press enter (do not select Safe Mode With Networking)

If prompted, select the Operating System displayed (default Operating System should be highlighted).

Next, determine which operating system you are using. Since Microsoft has different patches to protect each operating system, you will need to know which one you have.

Click on the Start button, go up to Settings and select Control Panel. From there, double-click the System icon.

The window displayed will indicate which system is being used (Windows 2000, Windows XP, etc.)

Please execute the following steps to disable the worm from starting:

Click on the Start button and select Run

In the Run prompt, type regedit and press enter

Click on the plus sign (+) next to HKEY_LOCAL_MACHINE. Then, click on the plus sign next to Software. Click on the plus sign next to Microsoft. Again, click on the plus sign next to Windows. Click on the plus sign next to CurrentVersion. In the CurrentVersion list, click on the word Run.

Look for msbLast.exe, so that it is highlighted, and hit the delete key on your keyboard.

Select Yes to confirm deletion choice.

Exit the Registry editor (click the X in the upper right hand corner).

Restart your computer (but this time in "normal" mode - not Safe Mode).

Click this link and save the file to your desktop.

After the file has saved to your desktop, select Open on the Download Complete window. This will launch the Symantec W32.BLaster.Worm.Fix Tool

Click the Start button displayed on the Symantec W32.BLaster.Worm.Fix Tool. The tool will begin analyzing your files and folders for the worm and may take several minutes to complete.

When it has finished, you will be prompted with a window to install a patch that will protect your system from this and similar vulnerabilities. Click Yes to go to the Microsoft site directly.

Download the Microsoft patch

If not automatically redirected, please navigate to http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp"

Click on the link for your installed Operating System

Click download on the right side of the page

Choose Run from this location

Confirm security warning pop-up by clicking Yes

Follow pop-up instructions and reboot by clicking Finish

--------------------------------------------------------------------------------


If your system is not currently rebooting, however you believe you have the worm, please follow these steps:

First you need to determine which operating system you are using. Since Microsoft has different patches to protect each operating system, you will need to know which one you have.

Click on the Startbutton, go up to Settings and select Control Panel. From there, double-click the System icon.

The window displayed will indicate which system is being used (Windows 2000, Windows XP, etc.)

Next, you need to identify and terminate the worm running on your system. To do this,

Press and hold down the following keys: Control, Alt and Delete

Click the Task Manager button

Select the Processes tab

Click the Image Name column to sort the list in alphabetical order

Look for msbLast.exe under the Image Name column

Select the msbLast.exe file by clicking on itonce. Then, click the End Process button.

Now you can close the Windows Task Manager screen by clicking the X in the upper right hand corner.

Click this link and save the file to your desktop.

After the file has saved to your desktop, select Open on the Download Complete window. This will launch the Symantec W32.BLaster.Worm.Fix Tool

Click the Start button displayed on the Symantec W32.BLaster.Worm.Fix Tool. The tool will begin analyzing your files and folders for the worm and may take several minutes to complete.

When it has finished, you will be prompted with a window to install a patch that will protect your system from this and similar vulnerabilitys. Click Yes to go to the Microsoft site directly.

Download the Microsoft patch

If not automatically redirected, please Navigate to http://www.microsoft.com/technet/tre...n/MS03-026.asp

Click on the link for your installed Operating System

Click download on the right side of the page

Choose Run from this location

Confirm security warning pop-up by clicking Yes

Follow pop-up instructions and reboot by clicking Finish

Please note: Editing your system registry can cause problems with your Operating System if done incorrectly. While Comcast is providing this information to help repair the MSBLast Worm, Comcast is not responsible for any damage that the contents of this document may cause to your computer.

[Thermodyne]

Hm..Symantec link didn't work. Here it is in plain text.

http://securityresponse.symantec.com...r/FixBLast.exe

[General Woundwort]

The evil worm is slain (or so it appears so far).

I had to run the remover twice (I forgot to set the machine to safe mode the first time), but I got the sucker.

I also downloaded all the available security patches from Windows Update... while there was still time...

Tomorrow, I will get Norton AntiVirus, and an external CD-RW, so that I will have some beefier protection against this sort of nonsense, and some real back-up capacity.

I also downloaded DirectX9, in anticipation of Starfury...

[Baron Munchausen]

You won't need DX9. It works fine with 8.0a and 8.1 in our experience. (Good thing too... DX 9 is so HUGE!)

[Taz-in-Space]

&#1 Taz had worms!!! &#1

Yep! Taz HAD the BLaster Worm but after going to Doc. Microsoft he is OK now!!!

Seriously, this worm is aggravating - it shuts down your computer every 5 - 10 minutes. At least if you are Online.

To tell if you have it, check for a process running that is named msbLast.exe

The easiset way to do that on a Windows XP machine is to press: Control-Alt-Delete
This will bring up a screen showing the running applications.
Press the processes Tab.
Look for the msbLast process; if it is there highlight and press end process button.
Then either run the Symantic program mentioned before to remove the worm or do a complete search on all drives for msbLast.exe (I found mine in C:\windows\system32 folder)
Delete all occurances.

One thing I should mention is the System Restore function on Windows XP machines - this MIGHT bring the worm back in certain cases.

To prevent this...
Again on Windows XP machines:
Right click on My Computer
Click on properties
click on system restore tab
Select (check) the Turn Off System Restore box
click apply

This will erase all system restore points on the computer.

Then go back again and uncheck the Turn Off System Restore box
and Click apply

Now there is no way system restore can 'resurrect' the bLaster worm.

You have now killed the worm... now goto the microsoft update site and make sure no other ones crawl in!!!

P.S. I hope you have more than the 56K Modem that Taz has - It took me 2 (TWO) HOURS to download all patches (30 Meg download).

[Kamog]

Are you immune to this worm if you're using Windows 98?

[TerranC]

Originally posted by Kamog:
Are you immune to this worm if you're using Windows 98?

Not immune, rather uneffected.

[narf poit chez BOOM]

how about M.E.?