Kim
December 6th 03, 01:41 PM
Cheyl, Kelly all other newbies
All of you out there experiencing your computers shutting
down automatically ..have been attacked by the
W32.Blaster.Worm. (also known as W32LovSan.worm) You need
to run a removal too. You can get it at www.Symantec.com
http://securityresponse.symantec.com/avcenter/venc/data/w3
2.blaster.worm.html
Also at Mcafee or sophos.
But if running XP. You must turn off system restore. Go
to my computer, right click on properties. Go to system
restore tab. Check the box that says
turn OFF system restore.
To make it easier ... disconnect from the network or pull
out your internet connection while you are doing this.
This will give and error and stop the TFTP and
msblast.exe goes idle.
After you get the thing removed, then you can appy the
microsoft patch MS03-026 (kb823980). You wont be able
too before because the worm has a denial of service
attack when you try to do the update.
You also can remae the file TFTP.exe for extra
protection. Rename to something like (tftp_exe.old).
This is not used for anything and is a very vunerable
file transfer protocol. Dont delte it though in case you
might have a future need for it .
Hope this helps
Kim
>-----Original Message-----
>when I start my maching using msn.com or at times not
>even getting on internet. computer gives me warning it
>will shut down in 60 seconds error message reads [TRD
>ww.C:\Windows\system 32\msbl] and is followed by a
screen
>saying {NT Athority System 32} help please.
>.
>
All of you out there experiencing your computers shutting
down automatically ..have been attacked by the
W32.Blaster.Worm. (also known as W32LovSan.worm) You need
to run a removal too. You can get it at www.Symantec.com
http://securityresponse.symantec.com/avcenter/venc/data/w3
2.blaster.worm.html
Also at Mcafee or sophos.
But if running XP. You must turn off system restore. Go
to my computer, right click on properties. Go to system
restore tab. Check the box that says
turn OFF system restore.
To make it easier ... disconnect from the network or pull
out your internet connection while you are doing this.
This will give and error and stop the TFTP and
msblast.exe goes idle.
After you get the thing removed, then you can appy the
microsoft patch MS03-026 (kb823980). You wont be able
too before because the worm has a denial of service
attack when you try to do the update.
You also can remae the file TFTP.exe for extra
protection. Rename to something like (tftp_exe.old).
This is not used for anything and is a very vunerable
file transfer protocol. Dont delte it though in case you
might have a future need for it .
Hope this helps
Kim
>-----Original Message-----
>when I start my maching using msn.com or at times not
>even getting on internet. computer gives me warning it
>will shut down in 60 seconds error message reads [TRD
>ww.C:\Windows\system 32\msbl] and is followed by a
screen
>saying {NT Athority System 32} help please.
>.
>