is this possible? (msblaster worm)

i was rebuilding a PC, I just fdisk'ed, and formatted, then installed win98SE.

then installed the winXP upgrade. as soon as winXP was installed i set up internet. a minute later i got the "remote procedure terminated unexectedly, system shutdown ". a sympton of the blaster worm.

so i downloaded the msblaster removal tool and sure enough, i was infected.

that means withing seconds of me setting up internet, I was infected. i didn't even hav time to set up firewall.

wow

 

Certainly possible. If you were on an infected business network, it would be inevitable.

As you describe it, you either had very bad luck or else your ISP is infected and passed it along to you as soon as you connected.

 

This Blaster thing has me scared. It's a whole new breed of virus. No need for email attachments or malicious scripts. It just travels from modem to modem and infects your comp. Antivirus programs don't stop it, only a firewall. It scares me to think of what other stuff awaits us in the near future.

 

Hi shadowhawk,

One bit of good news: the Welchia worm - the "fix" for the Blaster worm - dropped dead as of 01/01/04, I can log pings on the firewall logs again. The pings from this worm just overwhelmed the logs for the last 6 months.

Regards - Charles

 

The MSBlaster virus is a nasty one and it seems like many people have done nothing to protect themselves against it, but antivirus CAN stop it, provided you keep your signatures up to date. We were able to stop an infection cold in its tracks on our internal LAN when a visitor hooked up his infected laptop to our network. It was introduced inside our firewall but Symantec Antivirus Corporate Edition prevented any damage from occurring. The irony is the virus was brought in by an outside financial auditing company that wanted to look at how we secure our network as part of the audit. After their faces turned red with embarassment their only recommendation was to institute a policy of inspecting all laptops from visitors before allowing them to connect to their network.

 

When you reinstall Windows, do so with the modem off and/or unplugged. Install and enable your favorite internet security program. Then shut off the computer, reconnect your modem and boot. NEVER be online without your firewall up and running. NEVER.

Johanna

 

Yup that's another good lesson I learned the hard way. For the first few days after I had XP installed I had my Kerio on, but had it in its lowest security mode, so it might as well not have been running at all. Sure enough my Hotmail and Yahoo passwords were cracked and my accounts stolen.

I talked with a former hacker and she said passwords for sites like those are stored in the Windows Registry which is an easy target if you're unfirewalled. Now I did search my Registry for one of my current passords, but didn't find it. But then I figure there may be some encryption involved.

 

Yep, this happened to me last night.

I installed Windows XP (while connected to the net) and as soon as I installed Zone Alarm the MSBLAST worm was detected. I immediately stopped it. I suppose it could have sent some passwords out, but only the user passwords (no other passwords had at that time been set up, thank goodness!)

So, would it be sensible to change all passwords now?

Dodge

 

Disconnect from the internet and reinstall Windows, then install your internet security, enable the firewall and then go online again.

Johanna

 

Thanks Johanna,

I'll not be able to get to his house for a few days, but I'll let him get on with it and see how bad the problem is. Then I'll go back and try what you suggest.

Regards,
Dodge