W32.Blaster.Worm

I have the points, so what the heck, eh?

I run an independant shop, and we have about 20 machines in here right now with the worm. I have spoken to customers that have had entire bank intranets taken down by this worm. We probably got about 200 call today about this worm and how to protect or recover from it. At least in our customer base, the first infections that we got calls on were at about 10am cst on Tues. We are working overtime to get the machines cleaned up and patched so they don't get infected again. Such fun we are having now.

Vickie

Expierenced it hitting the coporate enviroment of a hotel network setup,the computers kept giving a RPC error message,then it would shut down and reboot,it happened the night before and it was back this morning,after updating the system with the RPC patch were it possible to get the network up and running
Considering that it moves so fast especially affecting computers on a dsl or network connection,puzzling how it is able to get pass the firewall,yet is does not create any replication or attach it self to any system programs.
One word scary

Hi,
Just this evening recieved an email from a LARGE Corprate entity that carried the worm in an email forwarding attachment being sent in groups of 6.
I just called their IT security and informed them about it.
Seems they knew about it this morning, before noon anyway and are doing the corrective measures.
What they do not understand is how it got past their firewalls and security as they are neighbors of M$.
And I do mean next door literally.
More as I am kept posted by their security.
fred

So far we have been very lucky and NOT been hit, mainly due to the way our network is set up. I know one of our users got hit at home, and another user reported that at her husband's office everyone got sent home yesterday (Tuesday) because they couldn't get any work done.

We are deploying patches today so that hopefully we can continue to avoid the problem. We hadn't thought until last week about our VPN users, which could provide a back door in to the network for the worm. We've warned the VPN users to make sure they're machines are patched.

I patched the servers and workstations here back when the security alert was first sent out [July 16]. Didn't get hit. I didn't patch the stand alone web site server. That didn't get hit either. My opinion is the patching did the trick for us.

I did patch my servers a week and a half ago (after I posted a question on stability issues with the patch), and so far, so good. No problems in the user VLAN. Only users at home with problems.

So far I have had a few home users call up to rid themselves of the worm....seems these people have the patch downloaded automatically by windows, but they don't bother going through with installing the patch.

I have found that merely cleaning the infection out using the removal tool, does not let you go out and install the updates as the computer still reboots. I finally figured out (read the fix more closely) that by enabling the built-in firewall and changing the RPC Service settings in WinXP can the patch be downloaded.

I am now receiving calls from small businesses that are using WinNT. I don't think I have the same options with that OS and Microsoft is no longer supporting it. We will see how this cleanup will go...anyone have any tips?

Mike

And just to add to this, if you run into machines that cannot install the RPC patch, read this Techrepublic.com question I posted a long answer to:

https://www.techrepublic.com.com/5208-6239-0.html?forumID=39&threadID=134985
(please remove any spaces)

The patch install might error out, and give you a message stating something along the lines of "Setup could not verify the integrity of the file Update.inf".

In XP, the Cryptographic Service needs to run to install the patch, apparently.

For Win2K, there is a much more complicated method to fix this so you can then run the patch.

We didn't get hit at work, but then again we run Win98 behind a fairly tight firewall. I did hear of a law firm that was knocked out for an afternoon though. (pretty good recover I thought)

I have XP at home, but I have Zone Alarm on it which was madly blocking port 135 (the one BLASTA uses) last Thursday night. Got a total of 33 hits in two hours, but only about 75% were on port 135.

Downloaded CA's file to remove BLASTA just in case and ran it, but came up clean.

Also gave a copy of Zone Alarm and the BLASTA fix to the mother-in-law over the weekend when they visited from interstate, to install at home to make sure they were safe too.

And on the subject of firewalls, does anyone know whether the standard Win XP firewall will block these attempts? Or if it can be configured to if it doesn't?

Thannks!

Stu

After we've installed service pack 3 & 4 and patches (SP and Patches varies on what OS installed on the PC), so far this was fix already.

Service Pack 4 is already available. Install it after the patch.

I have been lucky as my company has invested in St. Bernard's "Update Expert" software and every machine was up to date. On the notice of the Blaster virus, all that was needed was to block port 135 on the firewall due to our company web server being the only server past certain firewall restrictions. All in all, I have been fortunate to have no systems infected out of 25 servers and over 1000 workstations.

Funny thing is though, my dept. manager, after going home the initial day of the virus alert, came home to find his pc infected with the little blaster virus. He only fessed up to it after a few days of wondering why his messenger service wasn't running.

My home network, I used to use a cisco router there, but am currently using a d-link 604 and have everything block and redirected by that.

None of the computers at my office were affected. However, I applied the service packs and patches early on, and I stayed on top of updating virus definitions.

Several users reported, however, that their home computers were hit - even though I warned them (in a memo) about that very thing. I made it very easy for them to email themselves the necessary patches/links to protect their home computer, but no, some people just don't listen. I'm glad I did their office computers myself, instead of counting on them to do it.

I run a network of about 65 PC at 4 sites. All sites had firewalls setup and we passed with no problems. However, I had several coworkers tell me that their home PC's were affected. At first was passing out disks with Symantec's fixblast on it. Some workers wanted the fix even though they were unaffected.

My dad called me and said he had it. I tried running the Symantioce program and it failed three times. I deleted the virus manually. I then went to the McAfee site and downloaded Stinger. That worked very well. I then setup the firewall that's included in XP, something I should have done in the first place.

Overall, not too bad, but I think we'll se more of these.

In the shop I work at we have had at least thrity calls from home users and some small businesses, we have dealt with at least twelve systems infected (and climbing).

I have found that a couple of the systems are having the problem described in one of the earlier posts regarding cryptography, I have managed to get the patch but this has not made any improvement on the problem.

Whew! So it is that my network is safe, as all the workstations are still running the old Windows 98se which is NOT targeted by this virus.

However, my server (WinNT) was not patched but was behind a LinkSys Router with almost all ports blocked, including 135, so we didn't experience any problems with this virus. I have, of course, now brought my Server up to date on its patches.

The log reports on my LinkSys was filled with attempted passes at port 135, so it was trying to get through!

On a corporate level, we were not hit, thankfully. Firewalls are important! :)

On a personal note: my father's comptuer and my wife's friend's computer were both hit. Both are dialup users. I had to fix those. I could have charged then $70 each to do it (that's what our local Best Buy was charging), but since I'm the one they look at I end up doing it for free.

My opinion: Malware authors should be executed with a bullet to the head.

Our firewall got hammered but nothing got through. Fortunately no-one dialed in who was infected as that way in wasn't protected.

Firewall at home ignored the flood.

Probably got hit about 100 times an hour on this subnet.

So, I posted this question back on Tuesday, Aug 12, and I assigned it the 25K points.

Yet it took 6 days for it to get to the Top 5 Question list!!!!

Ah, more bugs in the new Jive Software version of TR. Well, better late then never, I guess.

I do want to know what your experiences have been with Blaster, its variants, and the new W32.Welchia.Worm variant, which is a "good" version.

I hope your experiences have not been troubling. My own personal ones were not that bad. I did not have one problem at work, but I had to talk to 8 different people (including a person at our NYC office) for their home computers on what to patch, why patch, and how to patch. I should start charging people for this!

I had a thought well helping out a friend. What about setup a group policy or add to a group policy and spefify not to run the excutable.

I wonder if this would work?

Ok, time to close this question, I think. Thanks for your experiences with this one. Between the worm and the blackout, last week was one for the books!

Ok. Thanks
Joe

This question was closed by the author

I closed this a week ago. Why won't it go away????