computer related for Windows XP

Hi All

Sorry, but this has nothing to do with planes.
However, there is a really bad worm out there called "BLASTER WORM" that an anti-virus program "CURRENTLY" can not detect (as per Compaq's tech support)

I spent 2 hours on the phone with Compaq's TECH SUPPORT
so "PLEASE" don't think this is another hoax being spread

anyway

they walked me through downloading a PATCH that will help in the event that you receive the worm.
here is the link to download it

http://microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

if you are using another Operating System start at the

www.support.microsoft.com
and in the search box they told me to type in these numbers
823980 and go from there, thats where they walked me through it
if you are using Windows XP, I suggest the top link and just download and open it, I did this on two computers while on the phone with Microsoft

hope this helps prevent someone's loss

You bet. For all you Winders types out there, get the patch. This is a nasty one. (yet another time I'm glad I use Linux).

>You bet. For all you Winders types out there, get the patch.
>This is a nasty one. (yet another time I'm glad I use
>Linux).
>
>

Randy Powell

Hi Randy, I take it you have experienced this nasty bugger
I thought I had it and after the first few minutes with the tech we determined I did not,
and thankfully he walked me through protecting it,

I hope it works if it is ever sent my way.

Yup, I know of a particular business that had every PC in its possession knocked out for about 2 days with this one. The patch does work.

If you have an XP computer, you may want to download the patch even if you are not yet getting the symptoms (rapid, continual system shutdown.....), as the virus can get into your computer and send infect others even though it does not appear to be affecting yours....

Regards

Two admonitions:

Windows XP users should keep their internet connection firewalls on. In addition, keep those critical updates up to date. I had installed the patch in July before this worm ever became the problem that it has this week.

Update your anti virus definitions up to date. My latest Norton AV definitions do detect and quarantine the Blaster worm.

>Two admonitions:
>
>Windows XP users should keep their internet connection
>firewalls on. In addition, keep those critical updates up
>to date. I had installed the patch in July before this worm
>ever became the problem that it has this week.

I find it inexcusable the corporate network dudes don't keep their systems patched. If you're going to run Mr. Gates' software, patching is a way of life (I patched my home XP machine just last week ). I realize most intrusions are caused by employees with laptops who don't get the benefit of the network gurus who do take their jobs seriously.

>Update your anti virus definitions up to date. My latest
>Norton AV definitions do detect and quarantine the
>Blaster worm.

If you use any of the modern AV packages, you should be subscribing to auto updates. Most vendors issue updates each Thursday.
At $30 per year, AV subscriptions are cheap insurance.

Yea, we had it at work (just upgraded - I guess that's what you call it - to XP). I use a variety of Linux at home (Fink, if your into Linux - a version of Darwin...sorta). I have a home network with a cable modem, a router and such and while DOS attacks still happen, I don't have to put up with the Windows related nonsense like this.

Yep,
I was hit.. couldn't stay on line long enough to get the "patch". Had to firewall... then get the patch.. a friend who works for Dell as a problem solver helped me..

I have heard that it hit Al Rabe..

I have another friend that bought a new computer 2 days ago, he was hit.. he didn't have a chance to have any safeguards.. he was hit the first time he went online!

For those interested, here's how it works:

Certain versions of Windows (NT, 2K, 2.3K, and XP) have a process running by default that listens on ports 135 and 445 for an incoming signal fo a particular sort. If your computer is directly connected to a network (Internet or in house) and that signal arrives, the computer will try to process it. The Blaster signal has a buffer overflow in it that tricks the operating system into allowing certain commands to run superuser privileges. The commands hack your box, gather software, and then start to scan for other victims on your network.

Blocking those ports via hardware or software firewalls protects you from a direct network attack. But not from opening an e-mail attachment.

-- Don McArthur www.mcarthurweb.com/

You can also get it from opening an email attachment that contains this bug, but that is much less likely. A good router and firewall will protect you. It tried to hit me (according to my router logs...a lot of hits on port 135), but obviously couldn't run it's process.

Nasty stuff.

Those of you with (especially) broadband Internet connections would be well advised to download and install a free personal firewall from Sygate. My logs showed someone from Brazil was trying to run a port scan against my system yesterday afternoon.

Even dialup modem users are succeptable.

>Hi All
>
>Sorry, but this has nothing to do with planes.
>However, there is a really bad worm out there called
>"BLASTER WORM" that an anti-virus program "CURRENTLY" can
>not detect (as per Compaq's tech support)
>
>I spent 2 hours on the phone with Compaq's TECH SUPPORT
>so "PLEASE" don't think this is another hoax being spread

You are right, it is not a hoax, but I have never really been thrilled with Compaq's tech support. To say there is no anti-virus program that "currently" can detect this is balony. According to ZD net this virus was first found in the wild at around 3:00 in the afternoon EDT. I received the anti-virus updates from Symantic (Norton) by automatic update at 3:30 CDT. It took them one and a half hours from the time it was first detected to have the updates on my computer.

(I suppose I should also confess that I got the virus a half hour before that. Hey, I was one of the first ones. That should make me something special. I rebooted in safe mode and Norton took it out.)

Norton, McAfee, (the "good guys") have instructions on their web sites and tools to take care of this if you do not have their software. You do not need to have their software to use it. But you do need to download the patch from Microsoft to keep from being infected again with this type of problem.

Hey, I am becoming an expert on the subject. ("An expert is one who knows when to panic.")

definition of "Expert ".........

An "Ex" is a has-been and a spurt is a drip under pressure......

Nothing personal, Leonard, you know I'm only joking, but I could not resist.......

>definition of "Expert ".........
>
>An "Ex" is a has-been and a spurt is a drip under
>pressure......
>
>Nothing personal, Leonard, you know I'm only joking, but I
>could not resist.......
>
>

I have heard that one before and used it myself. It is funny what we can call ourselves sometimes.

"An expert is one who learns from his previous mistakes so he can make new ones."

That's funny, I thought that an expert was someone who knew more and more about less and less until he knew absolutely everything about nothing.

You know, if everyone would use the "Windows Update" thingy under the Start Menu, this wouldn't happen so much. The patch for this thing came out a couple weeks before the virus did. I suspect what happens is someone discovers the vulnerability, Microsoft releases a patch, the virus writers see the patch and figure out what it's for, and then they write something to take advantage of the people who haven't applied the patch yet.

On my machines, the thing runs automatically, and ever so often, it tells me it's downloading updates. To set this up (I think it's turned on by default), select Start, right click My Computer, and select "Automatic Updates". You can set it up to run once a day, if you want to.

I didn't have to worry about the worm since XP had already downloaded and installed the patch when I first saw news about it on Excite.com. It's interesting that this new worm includes a DOS attack on the Windows Update site, but it seems to be running OK now.

I got "blasted" last week, and the reasons were a combination of errors all lined up at once:

1. I don't "auto update" Windows XP on my notebook PC, because I use that PC for development and have been burned by auto update in the past. I always wait for a quiet period (all files checked in, test cases in a known state, etc.) before requesting the updates. (Last year I was down for a day because the updates screwed up my ability to run some debugger software. Had to back out two updates to get things working again. My sister is an IT dweeb and reports having similar problems in her installations, so she is also careful to test the updates first.)

2. I use Norton AV, but for some reason I had turned off the auto-scan a few weeks back (I was installing some software, can't remember what). After I turned that off, emails were being checked but nothing else.

3. I was on vacation in Canada for five days and dialed into my service provider "the old fashioned way" to check email. No hardware firewall, and I didn't bother to set up a software firewall either. The second time I dialed in to check email, my system did the Blaster shutdown.

Dumb.

So there I was, in Whistler and my machine wouldn't stay up long enough to download a patch or even find written instructions on how to disable the worm. The system stayed up fine when I wasn't dialed in, so I finally resorted (pardon the pun) to looking for and finding an "open" 802.11 port in Whistler Village (I have no idea whose router it was, but I hope he/she was running a firewall!). I was able to download the MS patch and a Norton Blastfix utility while sitting on a bench outside, next to a coffee shop.

I'm clean now, really! I don't know about the person with the open 802.11 hub, though... the next morning it was off the air.