Were you hit by the Blaster Worm?

Aug 19, 2003, 05:50 AM

I am surprised that thsi hasnt made the poll on the front page... oh well...

I just realised i had the blaster worm... so i got the tool and i ran it, no more worm. Anyway, it made me wonder how many people have actually been hit!

scobywhru · Aug 19, 2003, 06:01 AM

I have yet to be hit by anything

virus worm or otherwise i guess I am doing something right

ztride · Aug 19, 2003, 06:21 AM

well, one of my computers go hit, not my main one though.

Dyre Straits · Aug 19, 2003, 06:45 AM

My XP machine got it. I tried a 'possible solution' posted here last Monday night that caused all kinds of trouble. Had to reformat the drive and reinstall everything.

**MIG-31** · Aug 19, 2003, 07:27 AM

nope i certainly havn't.

BWX · Aug 19, 2003, 07:51 AM

I didn't, but my mom who lives about 200 miles away got it and about 3 other worms/trojan horses/viruses. I fixed all of them on here machine acting like "tech support" over the phone (we both have cable connection)- she had W32Randx.E, W32.Spybot.worm, the blaster thing, and a couple others- She didn't keep her machine updated as I told her to- Now she does!

I walked her through fixing the registry, deleting the correct files, and updating windows. I keep my windows up to date, therefore, no attacks.

DriveEuro · Aug 19, 2003, 09:02 AM

HELL no i aint been hit!

hohum · Aug 19, 2003, 12:06 PM

Nope I never got it, but a fair few people I know did. I make a point of checking the windows update site every few days, and getting any critical updates that are available... and as such I had the patch installed a few weeks before the blaster worm came out. Maybe the people who were affected will make more of an effort in the future

Al_Vampyre · Aug 19, 2003, 12:47 PM

I am certified Blaster free!

krazy1 · Aug 19, 2003, 12:59 PM

Nope never got it........ Gotta love a good firewall and not to mention installing the patch when MS told me to do so....

I actually listened to MS for once.... go figure......

What kills me about this whole blaster thing is how much computer shops are charging to remove that little bug. Here at work we had 7 laptops get infected and we cleaned each one up in about 10 min. A friend of my wife's got the worm and called several computer shops about removing it. Most shops told her it would cost her 2 days labor to remove the worm since they had to completely erase the hard drive and re-do her system....... can you say SCAM......

Well I did my Boy Scout duty and fixed her computer in 10 min..... charge free.......

dipstick · Aug 19, 2003, 01:22 PM

None of the PCs at home have gotten it yet, but I would like to be pointed to the MS patch if possible. I can't seem to find anything on it.
Thx

Zardon · Aug 19, 2003, 01:23 PM

Quote:

Originally posted by kakarot
None of the PCs at home have gotten it yet, but I would like to be pointed to the MS patch if possible. I can't seem to find anything on it.
Thx

Network Associates:
http://us.mcafee.com/virusInfo/defau...virus_k=100547

Trend Micro:
http://www.trendmicro.com/vinfo/viru...WORM_MSBLAST.A

Symantec:
http://securityresponse.symantec.com...ster.worm.html

Computer Associates:
http://www3.ca.com/virusinfo/virus.aspx?ID=36265

Microsoft's Virus Information Alliance: http://www.microsoft.com/technet/security/virus/via.asp

If you get the Virus how do you remove it?

1. In order to remove this virus please follow these instructions:

Do a search for msblast.exe by using the find files or programmes command (usually found in system32 folder)
Delete it.
Click Start and select Run
Type msconfig & click OK
Select the start-up tab
Disable msblast
Reboot machine and enable your Firewall or anti-virus software. Refer to your software instructions provided to ensure
that it is set up correctly.

Alternatively

Security specialists Symantec have released a tool which will remove the current infection from your computer. To
download this tool, go to www.symantec.com and go to the security response section. Then click the W32.Blaster.Worm link
in the latest virus threats section. This page offers more information regarding the worm, and a downloadable tool to
remove it.

2. Once you have removed the virus, immediately select one of the links below to install the security patch needed to
ensure no repeat infection occurs.

http://securityresponse.symantec.com...ster.worm.html

http://microsoft.com/technet/treevie...n/MS03-026.asp

patje · Aug 19, 2003, 01:30 PM

my home rig is safe and well behind a FW, but at work ...

... we had about 2500 Pc's running wink2k SP1 without a patch (on our Site). I'm not going to explain why they weren't patched, believe me it would take to long. So don't ask questions about "how the hell is that possible..."

after being hit by the blaster worm, measures were taken to update those PC's to SP2 with latest patch.

but with the network almost down it was rather impossible, now if that wasen't enough, a new variant poped up --> mothafu**ing Nachi (pardon my language)

I took down almost the entire site on Monday. I worked from 7.00 am till 4.00 am along with a team to find out what went wrong and what to do the day after.

now is the day after, and were making progress, so by the end of the week we hope to have patched it all!

so yes, we have be hit!

dipstick · Aug 19, 2003, 01:38 PM

Quote:

Originally posted by Zardon
Network Associates:
http://us.mcafee.com/virusInfo/defau...virus_k=100547

Trend Micro:
http://www.trendmicro.com/vinfo/viru...WORM_MSBLAST.A

Symantec:
http://securityresponse.symantec.com...ster.worm.html

Computer Associates:
http://www3.ca.com/virusinfo/virus.aspx?ID=36265

Microsoft's Virus Information Alliance: http://www.microsoft.com/technet/security/virus/via.asp

If you get the Virus how do you remove it?

1. In order to remove this virus please follow these instructions:

Do a search for msblast.exe by using the find files or programmes command (usually found in system32 folder)
Delete it.
Click Start and select Run
Type msconfig & click OK
Select the start-up tab
Disable msblast
Reboot machine and enable your Firewall or anti-virus software. Refer to your software instructions provided to ensure
that it is set up correctly.

Alternatively

Security specialists Symantec have released a tool which will remove the current infection from your computer. To
download this tool, go to www.symantec.com and go to the security response section. Then click the W32.Blaster.Worm link
in the latest virus threats section. This page offers more information regarding the worm, and a downloadable tool to
remove it.

2. Once you have removed the virus, immediately select one of the links below to install the security patch needed to
ensure no repeat infection occurs.

http://securityresponse.symantec.com...ster.worm.html

http://microsoft.com/technet/treevie...n/MS03-026.asp

Excellent post bud, thx alot.

Stormy · Aug 19, 2003, 04:15 PM

actually, Nachi is a viglantie anti-virus. It doesn't do anything bad and it self deletes on Janurary 1st, 2004. According to McAfee. They said only remove it if you didn't have Blaster. Because what it does is this: Once it's on the system, it searches for msblast.exe and deletes it. It then downloads the secuirty update to keep Blaster and variants from coming back. So it's the vigilante anti-virus essentially.

The_Neon_Cowboy · Aug 19, 2003, 06:49 PM

i am running the latest xp sp2 no issues here....

when i tryed ms patch it say it ment only for users with out even sp1 installed

so it looks like anyone with sp1 or above might be safe....

also i have herd that the patch contains what is deteacted as "spyware" by some spyware removeal tools

so i'd take this all with a grain o salt

**MIG-31** · Aug 19, 2003, 07:02 PM

Quote:

Originally posted by The_Neon_Cowboy
i am running the latest xp sp2 no issues here....

when i tryed ms patch it say it ment only for users with out even sp1 installed so it looks like anyone with sp1 or above might be safe....

also i have herd that the patch contains what is deteacted as "spyware" by some spyware removeal tools

so i'd take this all with a grain o salt

i installed the patch for it ok and i had sp1a ?

patje · Aug 19, 2003, 09:53 PM

Quote:

Originally posted by Stormy
actually, Nachi is a viglantie anti-virus. It doesn't do anything bad and it self deletes on Janurary 1st, 2004. According to McAfee. They said only remove it if you didn't have Blaster. Because what it does is this: Once it's on the system, it searches for msblast.exe and deletes it. It then downloads the secuirty update to keep Blaster and variants from coming back. So it's the vigilante anti-virus essentially.

Ok, so putting an entire network down with over 4000 users is not bad??? the company i work for lost a lot of money today i can tell you that!
but you are right, it is an anti-virus, but consider this:

1-imaging 1000 infected PC's in a network all trying to download a microsoft patch at the same time?? --> not good
2-imaging 1000 infected PC's in a network trying to spread themselves to other pc's generating en enormous amaount of data causing most routers to reach their limit --> even worse.

the intention of nachi was good, but the reality showed us different. allas

~~craig588~~ · Aug 19, 2003, 10:01 PM

I had one of my computers get infected with it, so I disconnected it from my network untill I removed it. I was able to remove it manually, before they came out with the automatic removal tool. Then I reconnected that computer and nothing happened to it or my other computers after that. I installed the patch as soon as it was released.

krazy1 · Aug 19, 2003, 10:17 PM

Quote:

Originally posted by patje
Ok, so putting an entire network down with over 4000 users is not bad??? the company i work for lost a lot of money today i can tell you that!
but you are right, it is an anti-virus, but consider this:

1-imaging 1000 infected PC's in a network all trying to download a microsoft patch at the same time?? --> not good
2-imaging 1000 infected PC's in a network trying to spread themselves to other pc's generating en enormous amaount of data causing most routers to reach their limit --> even worse.

the intention of nachi was good, but the reality showed us different. allas

I guess the only question I have is why is there no firewall where you work? Or if there is one why were the critical ports open? I am not trying to be an a$$... Just curious.....

brc64 · Aug 19, 2003, 10:18 PM

Quote:

Originally posted by patje
... we had about 2500 Pc's running wink2k SP1 without a patch (on our Site). I'm not going to explain why they weren't patched, believe me it would take to long. So don't ask questions about "how the hell is that possible..."

after being hit by the blaster worm, measures were taken to update those PC's to SP2 with latest patch.

I'm confused.. the systems at work were SP1 because it would take to long to update them, but now you're taking measures to update them to SP2? Am I reading that right? If so, why not go all out and update them to SP3 (is SP4 out yet or still beta?)? Aren't the service packs.. oh.. what's the word.. include every service pack before it?

Just wondering..

BTW, as far as the poll goes, my router protected me.

- Me

tek · Aug 19, 2003, 10:43 PM

I got the Blaster virii 3 times today, all in 3 hours time, but I removed every one of them

Judas · Aug 19, 2003, 11:09 PM

never got touched..not by either one of my computers..lucky me....

BavonWW · Aug 20, 2003, 12:02 AM

Nope, not yet but looking around I've just noticed a few odd processes etc so will investigate............

What is dpnsvr (255,255,255,255,6073) 6073 UDP ?

Is it harmless?

Davidgt · Aug 20, 2003, 01:10 AM

thats not a valid ip address is the network your own subneted?

brc64 · Aug 20, 2003, 01:16 AM

Quote:

Originally posted by BavonWW
Nope, not yet but looking around I've just noticed a few odd processes etc so will investigate............

What is dpnsvr (255,255,255,255,6073) 6073 UDP ?

Is it harmless?

It's apparently a DirectX 8.1 program related to running game servers? If I understand what I read correctly.

http://msdn.microsoft.com/archive/de...pplication.asp

Run "DPNSVR /K" from a command prompt to shut it down.

- Me

WildChild · Aug 20, 2003, 01:25 AM

a worm /virus is still a worm/virus no matter what it does

scobywhru · Aug 20, 2003, 01:56 AM

Quote:

Originally posted by BavonWW
Nope, not yet but looking around I've just noticed a few odd processes etc so will investigate............

What is dpnsvr (255,255,255,255,6073) 6073 UDP ?

Is it harmless?

Quote:

Originally posted by Davidgt
thats not a valid ip address is the network your own subneted?

Actually thats a broadcast IP address, means its sending out info to any one thats listening, but its blocked at the nearest router, just local

patje · Aug 20, 2003, 09:42 AM

Quote:

Originally posted by brc64
I'm confused.. the systems at work were SP1 because it would take to long to update them, but now you're taking measures to update them to SP2? Am I reading that right? If so, why not go all out and update them to SP3 (is SP4 out yet or still beta?)? Aren't the service packs.. oh.. what's the word.. include every service pack before it?

Just wondering..

BTW, as far as the poll goes, my router protected me.

- Me

Well that is because a lot critical applications need to be tested before SP2 can be applied, and they were to late with the testing. You can't just download the latest SP4 and install it on 4000 Pc's and see what happens, if somehting goes wrong then were screwed. Next step will be SP3 .... i know it doesn't makes sense and it's hard for me to explain but if you would be here you'd understand. trust me one this one.

Quote:

Originally posted by krazy1
I guess the only question I have is why is there no firewall where you work? Or if there is one why were the critical ports open? I am not trying to be an a$$... Just curious.....

We do have firewalls but that does not mean an contractor takes his "personal" (infected without knowing) laptop with him to work, and all he has to to is plug it in the network and it starts spreading. Closing down ports sound good but as said before we have a lot of critical cient-server applications running over TCP-IP and if would close ports some of them might not work any more. We did disabled ICMP so now we can't ping anymore but the worm can't spread anymore also.

will take some time to get everything back operational, but hey thats out job

Dyre Straits · Aug 20, 2003, 10:51 AM

Quote:

Originally posted by patje
Well that is because a lot critical applications need to be tested before SP2 can be applied, and they were to late with the testing. You can't just download the latest SP4 and install it on 4000 Pc's and see what happens, if somehting goes wrong then were screwed. Next step will be SP3 .... i know it doesn't makes sense and it's hard for me to explain but if you would be here you'd understand. trust me one this one.

We do have firewalls but that does not mean an contractor takes his "personal" (infected without knowing) laptop with him to work, and all he has to to is plug it in the network and it starts spreading. Closing down ports sound good but as said before we have a lot of critical cient-server applications running over TCP-IP and if would close ports some of them might not work any more. We did disabled ICMP so now we can't ping anymore but the worm can't spread anymore also.

will take some time to get everything back operational, but hey thats out job

This happened at the university where my son is enrolled. Someone took a laptop that was infected and plugged it into the school's network. The whole university system became infected in short time.

Aug 19, 2003, 05:50 AM	#1
generalstupid Guest Posts: n/a	Were you hit by the Blaster Worm? I am surprised that thsi hasnt made the poll on the front page... oh well... I just realised i had the blaster worm... so i got the tool and i ran it, no more worm. Anyway, it made me wonder how many people have actually been hit!

Aug 19, 2003, 06:01 AM	#2
scobywhru DriverHeaven Senile Member Join Date: Nov 2002 Location: Penthouse Basement Posts: 619 Rep Power: 0	I have yet to be hit by anything virus worm or otherwise i guess I am doing something right __________________

Aug 19, 2003, 07:27 AM	#5
MIG-31 HardwareHeaven News Mod Join Date: Dec 2002 Location: Nottingham,UK Posts: 56,821 Rep Power: 471 System Specs	nope i certainly havn't. __________________ Please Post Your News Submissions Here

Aug 19, 2003, 07:51 AM	#6
BWX unplugged Join Date: Nov 2002 Location: USNY Posts: 19,669 Rep Power: 110 System Specs	I didn't, but my mom who lives about 200 miles away got it and about 3 other worms/trojan horses/viruses. I fixed all of them on here machine acting like "tech support" over the phone (we both have cable connection)- she had W32Randx.E, W32.Spybot.worm, the blaster thing, and a couple others- She didn't keep her machine updated as I told her to- Now she does! I walked her through fixing the registry, deleting the correct files, and updating windows. I keep my windows up to date, therefore, no attacks. __________________

Aug 19, 2003, 09:02 AM	#7
DriveEuro HardwareHeaven Extreme Member Join Date: Jul 2002 Location: Gurnee Illinois Posts: 4,677 Rep Power: 0	HELL no i aint been hit! __________________ [color=orange]ASUS P4P800 Deluxe [color=black]-[/color] 2.4C --> 3300mhz [color=black]-[/color] Mushkin PC3200 at 220 5-2-2-2 (cpu limited) [color=black]-[/color] BBAti 9800Pro at 430/375 [/color] [color=black]3[/color][color=gray]D[/color]M[color=black]a[/color][color=gray]r[/color]k[color=yellow]01[/color] [color=black]3[/color][color=gray]D[/color]M[color=black]a[/color][color=gray]r[/color]k[color=yellow]03[/color] 16001200 12801024

Aug 19, 2003, 06:21 AM	#3
ztride DriverHeaven Junior Member Join Date: Jun 2002 Posts: 80 Rep Power: 0	well, one of my computers go hit, not my main one though.

Aug 19, 2003, 12:06 PM	#8
hohum HardwareHeaven Addict Join Date: Apr 2003 Location: UK Posts: 298 Rep Power: 0	Nope I never got it, but a fair few people I know did. I make a point of checking the windows update site every few days, and getting any critical updates that are available... and as such I had the patch installed a few weeks before the blaster worm came out. Maybe the people who were affected will make more of an effort in the future

Aug 19, 2003, 12:47 PM	#9
Al_Vampyre HardwareHeaven Senior Member Join Date: Jan 2003 Location: Scotland Posts: 1,532 Rep Power: 72 System Specs	I am certified Blaster free! __________________ "Knowledge is knowing that a tomato is a fruit; wisdom is knowing not to put it in a fruit salad" - Brian O'Driscoll - Ireland Rugby Team 2009 Grand Slam winning Captain.

Aug 19, 2003, 12:59 PM	#10
krazy1 Live from the Dungeon Join Date: May 2003 Location: Between the SubWoofers Posts: 1,395 Rep Power: 0	Nope never got it........ Gotta love a good firewall and not to mention installing the patch when MS told me to do so.... I actually listened to MS for once.... go figure...... What kills me about this whole blaster thing is how much computer shops are charging to remove that little bug. Here at work we had 7 laptops get infected and we cleaned each one up in about 10 min. A friend of my wife's got the worm and called several computer shops about removing it. Most shops told her it would cost her 2 days labor to remove the worm since they had to completely erase the hard drive and re-do her system....... can you say SCAM...... Well I did my Boy Scout duty and fixed her computer in 10 min..... charge free....... __________________

Aug 19, 2003, 01:22 PM	#11
dipstick HardwareHeaven Extreme Member Join Date: May 2002 Location: USA Posts: 3,609 Rep Power: 71 System Specs	None of the PCs at home have gotten it yet, but I would like to be pointed to the MS patch if possible. I can't seem to find anything on it. Thx

Aug 19, 2003, 01:30 PM	#13
patje Former Mobility Modman Join Date: Oct 2002 Location: Belgium / Antwerp Posts: 1,475 Rep Power: 66	my home rig is safe and well behind a FW, but at work ... ... we had about 2500 Pc's running wink2k SP1 without a patch (on our Site). I'm not going to explain why they weren't patched, believe me it would take to long. So don't ask questions about "how the hell is that possible..." after being hit by the blaster worm, measures were taken to update those PC's to SP2 with latest patch. but with the network almost down it was rather impossible, now if that wasen't enough, a new variant poped up --> mothafu**ing Nachi (pardon my language) I took down almost the entire site on Monday. I worked from 7.00 am till 4.00 am along with a team to find out what went wrong and what to do the day after. now is the day after, and were making progress, so by the end of the week we hope to have patched it all! so yes, we have be hit! __________________

Aug 19, 2003, 04:15 PM	#15
Stormy DH Mafia Don Join Date: Jun 2003 Location: DH Mafia Manor Posts: 296 Rep Power: 0	actually, Nachi is a viglantie anti-virus. It doesn't do anything bad and it self deletes on Janurary 1st, 2004. According to McAfee. They said only remove it if you didn't have Blaster. Because what it does is this: Once it's on the system, it searches for msblast.exe and deletes it. It then downloads the secuirty update to keep Blaster and variants from coming back. So it's the vigilante anti-virus essentially. __________________ AMD Barton 2500+ Gigabyte 7NNXP ATI All-In-Wonder Radeon 8500DV 64mB w/ Catalyst 4.10 Windows XP Home Service Pack 2 Onboard Nvidia Audio Toshiba 16x DVD-ROM 32x10x40x CD-RW Drive 2x 512mb DDR Sticks

Aug 19, 2003, 06:49 PM	#16
The_Neon_Cowboy HardwareHeaven Extreme Member Join Date: Dec 2002 Location: U.S.A. Posts: 16,009 Rep Power: 92 System Specs	i am running the latest xp sp2 no issues here.... when i tryed ms patch it say it ment only for users with out even sp1 installed so it looks like anyone with sp1 or above might be safe.... also i have herd that the patch contains what is deteacted as "spyware" by some spyware removeal tools so i'd take this all with a grain o salt __________________

Aug 19, 2003, 10:01 PM	#19
~~craig588~~ Banned Join Date: Nov 2002 Location: In clothing Posts: 3,510 Rep Power: 0	I had one of my computers get infected with it, so I disconnected it from my network untill I removed it. I was able to remove it manually, before they came out with the automatic removal tool. Then I reconnected that computer and nothing happened to it or my other computers after that. I installed the patch as soon as it was released.

Aug 19, 2003, 10:43 PM	#22
tek DriverHeaven Senior Member Join Date: May 2003 Location: Boston, US Posts: 2,103 Rep Power: 0	I got the Blaster virii 3 times today, all in 3 hours time, but I removed every one of them __________________ [COLOR=White][/COLOR]

Aug 20, 2003, 12:02 AM	#24
BavonWW DriverHeaven Junior Member Join Date: Apr 2003 Location: LONDON UK Posts: 73 Rep Power: 0	Nope, not yet but looking around I've just noticed a few odd processes etc so will investigate............ What is dpnsvr (255,255,255,255,6073) 6073 UDP ? Is it harmless? __________________ Displays by ATI Central heating by Intel Last edited by BavonWW; Aug 20, 2003 at 12:12 AM.

Aug 20, 2003, 01:10 AM	#25
Davidgt Car Audio Guy Join Date: Jul 2003 Location: Atlanta, Ga Posts: 499 Rep Power: 0	thats not a valid ip address is the network your own subneted? __________________ Sales/Support Manager Taraautosound.com wonderful sig by tastyweat

Aug 20, 2003, 01:25 AM	#27
WildChild I'm Still Watching Join Date: Dec 2002 Location: New Jersey,U.S.A. Posts: 1,068 Rep Power: 0 System Specs	a worm /virus is still a worm/virus no matter what it does __________________ Knowledge is SCARY,Stupidity is REALLY frightening