Kim
December 5th 03, 12:12 PM
All of you out there experiencing your computers shutting
down automatically ..have been attacked by the
W32.Blaster.Worm. (also known as W32LovSan.worm) You need
to run a removal too. You can get it at www.Symantec.com
http://securityresponse.symantec.com/avcenter/venc/data/w3
2.blaster.worm.html
Also at Mcafee or sophos.
But if running XP. You must turn off system restore. Go
to my computer, right click on properties. Go to system
restore tab. uncheck the box that says
turn on system restore.
To make it easier ... disconnect from the network or pull
out your internet connection while you are doing this.
This will give and error and stop the TFTP and
msblast.exe goes idle.
After you get the thing removed, then you can appy the
microsoft patch MS03-026 (kb823980). You wont be able
too before because the worm has a denial of service
attack when you try to do the update.
Also as another safety measure you can rename the file
TFTP.exe to something else (like TFTP_exe.old) . This is
a very vunerable application and isnt really used for
anything. Dont delete it though in case you might have a
future use for it.
Hope this helps
Kim
down automatically ..have been attacked by the
W32.Blaster.Worm. (also known as W32LovSan.worm) You need
to run a removal too. You can get it at www.Symantec.com
http://securityresponse.symantec.com/avcenter/venc/data/w3
2.blaster.worm.html
Also at Mcafee or sophos.
But if running XP. You must turn off system restore. Go
to my computer, right click on properties. Go to system
restore tab. uncheck the box that says
turn on system restore.
To make it easier ... disconnect from the network or pull
out your internet connection while you are doing this.
This will give and error and stop the TFTP and
msblast.exe goes idle.
After you get the thing removed, then you can appy the
microsoft patch MS03-026 (kb823980). You wont be able
too before because the worm has a denial of service
attack when you try to do the update.
Also as another safety measure you can rename the file
TFTP.exe to something else (like TFTP_exe.old) . This is
a very vunerable application and isnt really used for
anything. Dont delete it though in case you might have a
future use for it.
Hope this helps
Kim