W32.BLASTER.WORM IMPORTANT!!!

Post by **wardrich** » Wed Aug 13, 2003 8:43 pm

ok, this is the worst virus EVER (not really) but anyway, if you have winXP or W2K, then chances are you have this virus. It creeps in thru the windows update port on your computer. FIREWALLS AND ANITVIRUS PROGRAMS WILL NOT DETECT IT. I HAVE THE PATCHES AND FIXES FOR IT AND AM PUTTING IT ON MY FRIENDS SITE ASAP!!!

This is HUGE. It HAS to be done BEFORE SATURDAY AUGUST 16! When the 16th hits, it will preform a DoS (Denial of Service) attack on the windows update site so that YOU WILL NO LONGER BE ABLE TO OBTAIN NEW WINDOWS UPDATE FILES!!!

I shall get the site updated and let you know... it is my friend's site and i have no clue in hell as to when she will respond to my MSN message... Nevertheless, if you are worried, simply email me and i will try my hardest to send you the fix for it. HOWEVER, THE WINDOWS PATCH IS TOO BIG TO SEND VIA MY POOR LITTLE 56K MODEM. The patch is readily available on www.microsoft.com though.

-Richard-

Post by **wardrich** » Wed Aug 13, 2003 9:10 pm

INSTRUCTIONS
THIS IS HELLA IMPORTANT, AND THE ORDER MATTERS!!

1) DOWNLOAD BOTH THE FIX AND THE PATCH

2) DISCONNECT ALL PHONE AND NETWORK PLUGS FROM YOUR COMPUTER

3) RIGHT CLICK ON MY COMPUTER AND CHOOSE PROPERTIES

4) GO TO SYSTEM RESTORE, TURN IT OFF, THEN RESTART YOUR COMPUTER.

5) NOW THAT YOUR COMPUTER HAS BEEN RESTARTED, RUN THE FIX.

6) ONCE THE FIX HAS FINISHED, CHOOSE NO WHEN IT ASKS YOU ABOUT DOWNLOADING THE PATCH

7) RUN THE PATCH FILE AND PLACE A CHECK IN THE BOX AT THE END OF THE INSTALLATION

8) PLUG IN ANY CORDS THAT YOU UNPLUGGED PREVIOUS TO THE INSTALLATION OF THE FIX AND PATCH

9) TURN THE SYSTEM RESTORE BACK ON (if you had to turn it off)

10)RESTART YOUR COMPUTER **NOTE THAT EVEN IF YOU DIDN'T HAVE TO TURN THE SYSTEM RESTORE BACK ON, YOU STILL
M U S T RESTART YOUR COMPUTER FOR THE PATCH TO TAKE EFFECT.

FILES

The removal tool can be downloaded HERE

for the windows patch (which should NOT be run until you have run the symantic tool to remove the virus) can be found HERE

if you are using XP, download the 32 bit one. The 64 bit is for XP servers.

-Richard-

Post by **emmzee** » Wed Aug 13, 2003 9:22 pm

Yup this is a biggie ... coincidently, I downloaded and applied the patch from Microsoft one day before I learned about this new virus. Freaky. Anywho, everyone running NT/2000/XP should download and apply this patch ASAP. Otherwise you may be really, really pissed when your computer is fubar and you have to do some real work to get it goin again

Post by **wardrich** » Wed Aug 13, 2003 9:31 pm

you may still want to download the symantec fix. The patch doesn't actually get rid of the virus. It just plugs the hole in the code that the virus uses.

Splodginator · Post by **Splodginator** » Thu Aug 14, 2003 1:29 am

I also had it. Its not that bad, but all our school's computers have it, half our class has it (yep, 2k/XP is popular for some reason). Removal is easy, Firewalls will actually block the worm from being received (it is sent by hacking) but will not stop it if its already on your computer, it uses Windows' components. But...

Get the fix immediately.*

According to Symantec, the Worm will DoS WindowsUpdate every day from August 16th- December 31st, every year. I'll provide a back-up link on my server if the site actually goes down. Also, if the Worm's coder is here, I have ZoneAlarm Pro, so you'd have to be a good hacker to take me down.

nastypoisonspikes · Post by **nastypoisonspikes** » Thu Aug 14, 2003 3:22 am

XP is a bucket of fun!

Splodginator · Post by **Splodginator** » Thu Aug 14, 2003 3:54 am

Its fun, but its not that fun. Especially with my official count of 8 programs on start-up. Well 8 that run in the taskbar. Probably at least 10 on start-up. The fun bit comes when you try hunting down the bugs, viruses and other problems that make XP what it is. Now off to WindowsUpdate to download some important patches before at least 100 people take down WindowsUpdate indefinitely*.

*According to Symantec

Thunderdog · Post by **Thunderdog** » Thu Aug 14, 2003 2:09 pm

This isnt required for Windows 98SE, is it?

Splodginator · Post by **Splodginator** » Fri Aug 15, 2003 12:56 am

No. 2000 and XP only. Its with the RPC Service, a hole in it. Also, I predict that WinUpdate will be down indefinitely so get patches immediately.

Da_Goat · Post by **Da_Goat** » Fri Aug 15, 2003 5:37 pm

Um, I have XP, I ran the test, but it said I wasn't infected....

Splodginator · Post by **Splodginator** » Fri Aug 15, 2003 6:30 pm

Unless you have a firewall, your ISP might have blocked Port 135- which is where the worm spreads. Also, around 200,000 people have been infected with msblast.

Post by **wardrich** » Mon Aug 18, 2003 4:11 pm

Da_Goat: nor did I

Just because you are hooked up to the internet and have XP/2K does not mean that you will have the virus. However, there is a great chance that you do. This is more of a server virus, HOWEVER, it still infects stand-alones. The server at the Whitby Psych has it, and the second i hooked a NEW computer to the server, it automatically (like, within the blink of an eye) had the virus, so it spreads fast.

-Richard-

Post by **Dogbreath** » Mon Aug 18, 2003 5:19 pm

Well, too late now...

Post by **wardrich** » Mon Aug 18, 2003 7:04 pm

UPDATES:

www.microsoft.com has been going up and down for the last few days. Downloading the patch is going to be harder than before. Especially if you have the virus. I am trying to get ahold of my friend Nikole to see if she will host the patch for any poor soul who was not able to get the patches in time. Even though w32.blaster has mutated, the Symantec™ patch has still been able to remove the virus to the best of my knowledge. I shall post up the NEW site with the patch ASAP. I will also update my previous post with the new patch too.

-Richard-

Kazer0 · Post by **Kazer0** » Mon Aug 18, 2003 9:02 pm

Yep, it wont install on my computer. Stupid anti-piracy. Oh well, ill have black ice on here in a minute.

nastypoisonspikes · Post by **nastypoisonspikes** » Wed Aug 20, 2003 1:23 am

What is this "Black Ice?"

Kazer0 · Post by **Kazer0** » Wed Aug 20, 2003 1:49 pm

Like the best firewall you can buy. Or not buy on kazaa.

John The Ax · Post by **John The Ax** » Wed Aug 20, 2003 7:33 pm

Download a firewall off Kazaa. That's just... Stupid.

Kazer0 · Post by **Kazer0** » Wed Aug 20, 2003 7:48 pm

I did, works fine... cept for application watching

Oz · Post by Oz » Wed Aug 20, 2003 8:18 pm

kazer0, you always did strike me as funny...

i got a similar virus, which makes use of the same exploit, which restarted my pc. it happened 2 hours before i went on holiday, tho, so i wasn't bothered to clean it. just left it off.