Networks

Ask something
Discussion Locked

Blaster Worm's effects and my Network

0 helpful
2 replies

by craigh

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello all,

I am reletively new to a lot of these issues so some of my questions may come across as being very simple. I have in my care about 135 stations that have 2 or 3 and in some cases 4 different bootable partitions. My understanding is that the Blaster worm does not affect WIN95/98/ME and that it only affects the NT OS's. So my question is really a two part question first is what are the residual effects once we have had the virus(MS Office glitches, router probs etc.) and with all of the miscellanieous data floating around does the security patch actually remove the virus or does it only prevent further occurances of. My second question may be related to the first so that is why I am posting it here as well. My router will not maintain a connection for more than about 10 minutes with a full load of 135 computers but with only about 15 computers atached it will maintain a connection for about 1.5 hours. Then the router just resets itself and won't allow access. Any ideas or advice as to how to help the new guy with this would be very much appreciated. Thanks.

2 replies

by joseph moore

Yes, the RPC/DCOM vulnerability that Blaster exploited is only valid on NT4/2K/XP/2K3 machines. The Win9x line (95/98/ME)is not vulnerable.

So, for each partiton on your machines with NT4/2K/XP/2K3 you need to patch. So, if MACHINE1 had 3 partitions with 98, NT4 & XP on it, you would need to patch BOTH NT4 partition AND XP partition separately, with the appropriate patch. There is a different version of the patch for each OS version!

Next, yes, if you are not patches and if you have been infected (or even an attempted infection) by Blaster, then you will have problems. Machines might count down from 60 seconds and reboot themselves; you might get SVCHOST.EXE popup errors; some Windows functionality (drag-n-drop, Windows Explorer windows, etc) might not work or work strangely. This is all due to the RPC service, which controls a lot of stuff in Windows, being affected by the worm and/or being corrupted by the worm.

Strange functionality can extend to applications. So, the answer is yes, you could be having problems with Office due to Blaster worm.

by joseph moore

Now, as for your router problems, that is an entirely different matter. Since only Windows OS is directly vulernable to Blaster, your router cannot get infected by it. The only thing your router could be having problems with is due to the virus' actions. It will scan the local subnet and look for other Windows boxes to infect. If all of your machines are infected, then they would be continuously scanning for more machines to infect. The virus does not stop scanning. So, your router could be getting flodded with connection attempts from your 135 workstations. That could, indirectly, be performing a DoS against your router, and bringing it down.

I would look at the interfaces on the router and see what they are reporting. IF it were a Cisco router, you could telnet or console into it and do a SH INT to see the interfaces. You could then look at the errors, dropped packets and other interface statistics to see what is happening.

But I think, from what little you posted on the router, that it is having a problem. Maybe you could post the Running Config (again, if it is a Cisco router) to the forum so we could see if anything looks wrong.

hope this helps

This discussion is closed to new replies.