How to prevent yourself from the Blaster Worm and how to remove it!

Note:The Blaster Worm is one of the most dangerous viruses of this year.The variants of this virus are still being written and are still being spread across the internet.I've written a free ebook on the Blaster Worm that tells everything one needs to know about the Blaster Worm and how to remove it and protect himself from it.The following article is just one chapter from that ebook.You can download the whole ebook for free at:
http://www.virustimes.cjb.net/msblast/download.html

How to prevent yourself from the Blaster Worm and how to remove it!

Today we're gonna learn how to prevent ourselves from the Blaster Worm and also how to remove it if we are already infected with it.Its gonna be easy,trust me!

The Fantastic 4!

OK,we are not exactly talking about the Comic Characters The Fantastic 4.However,the following 4 steps will,prove fantastic in helping you get rid of the Blaster Worm.

Step 1:Enabling a firewall:

Enabling a firewall will prove beneficial to you in any case.If you aren't already infected then it will help keep the virus away from your computer.And if you already are(poor you!),then it will help limit the effect of the virus.Though you can buy Firewall software easily,however,the latest version of Windows have a built in firewall installed.I will tell you how you can enable the firewall if you're using Windows XP,Windows 2000 and Windows NT 4.0 because these 3 are the most widely used operating system these days.


If your computer is restarting repeatedly,then disconnect from the internet before enabling the firewall.Follow the instructions provided for your operating system and then reconnect to the internet.

For Windows XP uers:

1-Open Control Panel.You can do so by clicking on Start-->Settings-- Control Panel. or Start--->Control Panel.
2-Click the Network and Internet Connections category. (If the Network and Internet Connectionsis not visible, click Switch to Category View under Control Panel on the left side of the Control Panel window.)
3-Click on Network Connections.
4-Right Click the Internet Connection you use to connect to the internet and click on Properties.
5- On the Advanced tab, under Internet Connection Firewall, select Protect my computer or network, and then click OK. The Windows XP firewall is now enabled.

For Windows NT 4.0 and Windows 2000 users:

You will need to install a 3rd party firewall.That means,that you do not have a built in firewall feature in your version of Windows.Therefore you will need to buy a firewall.There are lots of Firewalls available for free or trial versions.Check out the following links for more information:

Zone Labs:
http://www.zonelabs.com/

Checkpoint
http://www.checkpoint.com/

Trustix
http://www.trustix.com/


Doorstop
http://www.opendoor.com/doorstop/


Sun Microsystems
http://www.sun.com/security/

Remember what I told you about Windows Update and the DCOM RPC bug back in Tutorial 2(download my ebook for that tutorial)?Well,now is the time to download the patch that fixes this bug so that you can be safe from the blaster.Just connect to the internet,and go to the Windows Update site.Hmmm,I guess you can go to Windows Update Website by visiting http://www.windowsupdate.microsoft.com or by clicking on Start and then clicking on the link that says "Windows Update" next to a tiny globe picture.Once you get to the website,choose your version of windows,and,follow these steps:

1-Click "Scan for Updates" next to the green arrow near the center of your screen.Don't worry if it takes a bit long for the scan to complete.
2-After the scan completes, under Pick updates to install on the left side of your screen, click Critical Updates and Service Packs.This would show up a list of updates. The update we need to install here is identified by the number 824146.
3-Click Review and install updates near the center of your screen to begin downloading and installing the updates.

That's it!

Step 3-Using an Anti Virus Software

So now we've come to the obvious and the typical step when it comes to protecting a computer from viruses.Using an Anti Virus Software!Well,this step isn't just obvious and typical,its also critical in protecting your computer from the mean Blaster Worm.Anyway,you might already be having an AntiVirus software installed,but make sure,that its always up to date.Because there are several variants of our old little friend Blaster and its best to have the best antivirus software.Once again,make sure that your anti virus software is as up to date as possible.If you don't already have an anti virus software installed,you can easily buy one or use the trial version of one from one of the following websites:

Norton Anti Virus:
http://www.symantec.com/

Pc Cillin
http://www.trendmicro.com/

Mc Afee
http://www.mcafee.com/


Sophos AntiVirus

http://www.sophos.com/

Step 4-Blasting off the Blaster!

Hey,finally we have come to the removing stage of the worm.Cool,huh?Well,congratulations on reading so far!Now you're almost done.In a few seconds,you'll remove the Blaster Worm and get rid of it forever.

Are you infected?

Do you think that you are infected with the Blaster Worm?Well,if you have any of the following symptoms,then most likely you are infected and you should carry out the steps to get rid of the Blaster:

Symptos:

Well,some people who are infected by the virus do not notice the presence of the virus at all,while others who are not infected experience problems with their systems because the virus is attempting to infect their computer.The typical symptoms include Windows XP and Windows Server 2003 systems restarting after every few mintues automatically,or Windows NT 4.0 and Windows 2000 systems becoming unresponsive.

If there is even the slightest possibility that you are infected,I mean,your computer's infected,(ahem),then download the free removal tool found at:
http://securityresponse.symantec.com...oval.tool.html
If you prefer an anti virus vendor other than Symantec,then visit its website and search for Blaster Worm.Hopefully,You'll find a removal tool there as well.

With that,we come to the end of today's Tutorial.Boy..does that feel good getting rid of that crappy Blaster Worm?Today's tutorial has been pretty long.I hope it wasn't boring..My last message for today is,that you should visit the page:
What You Should Know About the Blaster Worm and Its Variants.
http://www.microsoft.com/security/incident/blast.asp
Its the best resource available for information about the Blaster Worm.Infact,I got most of the information for today's tutorial from that page.You simply must check out this page.Well,That's all for today.Have fun!


Don't forget to post your feedback.Also,don't forget to download the whole ebook.Its free:
http://www.virustimes.cjb.net/msblast/download.html

Thanks.
Ali.

you forgot tomention to disable system restore, My computer> right click Properties> sistem restore >disable

and also you could type dcomcnfg in the run. . . box and disable dcom

Yeah but there isn't any need to do all that if one follows the steps given in this tutorial.I mean,they wouldn't catch the virus if they follow these steps so there isn't need to disable system restore since its a pretty useful feature.

I think i have seen it somewhere else this tutorial. Anyway good work.

I used the page from Microsoft that I mentioned in the tutorial to help me write it.Or you might have downloaded my ebook.

Quote:

---

Originally posted here by ali1
Yeah but there isn't any need to do all that if one follows the steps given in this tutorial.

---

i consider that all the security measurements even if they are not really needed should be taken just to be more safe

So basically...use a firewall, anti-virus software, and don't be stupid? Wow. Ground-breaking.

Harsh, yes. But this tutorial would have been much more useful awhile back when MS Blaster was brand new, and no one knew how to deal with it. Most AV software wasn't ready then.

Oh, the one sure fire way to be safe from MS Blaster....don't use Windows.

Oh, and is it just me, or does it seem like this tutorial was taken partly from the last one? Especially the lists/links....

http://www.cisilion.com/news-cisco-blaster.htm

That link supplies almost exactly the same information, more detailed and with more work-arounds, as well as specifics information on how the Blaster affects Cisco networks.

The information they supply is also a lot more indepth then "Enable MS Firewall" or "Download a 3rd party one!"

They also have a lot of links that give a lot more information. I highly recommend this website to anyone who wants to do more research on the MS Blaster Virus.

Galen: Why would anyone.... in their right mind.... place a windows machine on the public network without a firewall blocking port 135?

Blaster was hardly difficult to stop so to blame windows is a little lame.... You shouldn't have port 135 open on a *nix, etc. etc. etc box either!!!!!

In our other conversation - I wasn't flaming or looking for one either..... It was just a thought about the fact that in an Open Source system the potential for a compromise that is "so subtle" and therefore may never be found _seems_ to be that much higher than in a Closed Source system.......

It was nothing more or less than that...... I don't have a gene in me that desires flame wars... I was young once but I grew out of that...... I do state my point, and yes, I can be a crabby old bastard at times..... But when I do it's _painfully_ obvious.... ;) Trust me......

Mostly that was purely a cheap shot at Windows...

BUT Windows is the only operating system that is vulnerable to Blaster for one very important reason. It relies on WinSocks. For more information about this, see the tutorial I am writing about the inner workings of MS Blaster. It should be posted later today.

Also, my point was that AV Software and Firewalls, at this point, go without saying. We don't need tutorials that are pointing such basic things out. Yes, they are important to take note of, and if anything unusual needs to be done with them, we should be told. But saying "Get AV and Firewalls and you're good" doesn't make much of a tutorial, no matter how many links to software he puts up, does it?

chill, relax, yoo have a point there but lets not start a flame war :)

Well,installing an AntiVirus software and a firewall aren't all that is covered in this tutorial.It also tells you how to update windows and download the patch that fixes the DCOM RPC bug.Still if you think that this tutorial was of no benefit to you,or if it offended you in anyway,then I'm sorry!

I'm a bit stressed out by finals...I really didn't want to start a flame war, and I'm sorry if it seemed like I did. ::Bows and apologizes:: Truly sorry, guys.

Also, yes, the tutorial DID cover a bit more than that, but it was kind of limited. I'm not pointing this stuff out to make you feel bad but just so that you'll know for future reference. We only get better by criticism, and I'll bet that, like me, you could use some.

BTW, thanks Graphictron for pointing out that I was starting to step out of line. I need the occasional slap upside the head. :-)

Its ok Pal.Don't worry about it.And yeah,you're right that critisicm makes one better.I'll try to be better next time.
:)

I have written and finished my In-Depth Tutorial on how the MS Blaster virus works, complete with source code. You can find it here:
http://www.antionline.com/showthread...hreadid=252016

One thing to mention is that the patch provided by Microsoft still leaves DCOM enabled. If you don't need to disable it. You can use DCOMbobulator found here http://www.grc.com/dcom/

thanks for the info.

When the blaster is shutting down your system and you dont have enough time to get the patch, you can use the shutdown abort command.

Go to start,run, then type in:

shutdown -a

Then you can go and get your patch.

Yeah...or you can kill the process "msblast.exe" through the task manager.

I think what he was trying to say was that you can stop a shutdown process that way. A useful bit of information if it happens to you.

Just for shits i checked out the site to get this "ebook". When you click the download thing it asks you to enter an email address after that a page with a download link for that ebook shows up. Well when look at the target to that link it says. "Blater Worm.exe" SUPRISE SUPRISE.

here is the target of that link "http://cgi-bin.spaceports.com/~digitald/msblast/Blaster%20Worm.exe"

not very nice place to point people ali1

Quote:

---

Originally posted here by ali1
Yeah but there isn't any need to do all that if one follows the steps given in this tutorial.I mean,they wouldn't catch the virus if they follow these steps so there isn't need to disable system restore since its a pretty useful feature.

---

Sorry ali1, but disabling system restore is recommended for a reason...the reason being that the blaster worm also infects the restore directories. The only way to remove it once it gets in there is to disable system restore because until you do, the files in the restore folders are write-protected and cannot be deleted or modified.

Quote:

---

Just for shits i checked out the site to get this "ebook". When you click the download thing it asks you to enter an email address after that a page with a download link for that ebook shows up. Well when look at the target to that link it says. "Blater Worm.exe" SUPRISE SUPRISE.

here is the target of that link "http://cgi-bin.spaceports.com/~digitald/msblast/Blaster%20Worm.exe"

not very nice place to point people ali1

---

I went to check it out, but it said that the file is not available, so I got the e-book from my email. There isnt a virus in it - His e-book just happens to be a executable and he named it blaster worm. Ill even PM you screenshots of the e-book if you want me to.

Yeah that's right.I just named the ebook file Blaster Worm.exe and that's it.Just because the name of the file is Blaster Worm doesn't mean that it is the Blaster Worm.If you need screenshots then PM me or I suggest that you download the file and scan it for viruses.If it doesn't show up any viruses(that it sure won't) then you can check it for yourself.
:)

Anyway I'm thankful to you that you.It was because of you that I found out that I had a broken link to the ebook at my website.That broken link is now fixed.Everyone who tried downloading the ebook earlier but it didn't work for him/her can now download it.I have also renamed the file so that someone might not feel reluctant to download the ebook.However,please do not post the direct link to the ebook in the forum since it is considered confidential.

This has been discussed in depth many many times in AO. Thank you for the information but personally i'd rather see something new being posted. No offense Ali. Pretty good Tut too :)

http://www.antionline.com/showthread...t=blaster+worm
http://www.antionline.com/showthread...t=blaster+worm
http://www.antionline.com/showthread...t=blaster+worm

thanks for posting a 'cute' tutorial on how to 'remove' MSBlast (in case we get infected by it). However there is something you tend to forget. If you're infected by an MSBlast, the best thing that you need to do before running your anti-virus software is to 'kill' first the process in the memory.

Now, how would you do that if your PC keeps on shutting down everytime you boot it up. First, of course as you pointed it out correctly, you need to disconnect your PC from the internet. But it won't stop your PC from shutting down automatically everytime you reboot.
You need to disable system shutdown by running SHUTDOWN -A (Click START>RUN>then type shutdown -a> then click OK.

Then you need to open the windows task manager and look for the running process: it's either MSBlast or MSLaugh. Select that file then click on End Process to, well, end the process!!! Now after removing the process, edit the registry and delete the Windows Auto Update in HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run.

Then run your antivirus. Then download the MsBlast Critical Security Patch in Microsoft webpage.

Then take a good nap!!! hoha!!!!

well,I have mentioned it all in the ebook.As I alreay wrote in the article,this chapter is just a page from the ebook.I've written it all in the ebook.