Bottom line to stop blaster re-infections

[John Prophet]

Ok, being the "computer guy" I am gettin my share of calls from family etc about the blaster worm.

The two peeps in mind have xp home and use dial-up.

If I am able to get the worm off their comps...and then I turn on xp firewall.....is that enough to stop the worm or do they also absolutely need antivirus.

The one couple had Mcafee which I suspect wasnt updated or maybe had run out......the other lady has norton which was supposed to be autoupdating....but Im not sure if she had xp firewall enabled.


Whats the bottom line to keep the worm off once I get it off?


oh yeah, on XP home is there such thing as tcp/ip filtering where maybe the affected ports can be turned off altogether?

Thanks, JP

(as usual, msofts site sends you in 50 loops instead of just stating in plain english what needs to be done....symantec is so much plainer)

[Chiguy]

I had one of my family members turn on XP firewall and that worked.

[John Prophet]

I have used norton firewall in the past.....how exactly does XP firewall work? Cuz when I have enabled it on peoples comps they never call me back asking about any sort of warning screens like norton gives you. How is it actually configured to know what to block and what to allow?

JP

[DoctorReno]

I think you also need to download and install the MS patch to keep other future attacks from occuring thru this security hole.

[John Prophet]

Yeah, I guess the patch will keep this particular worm out...I guess mayabe I was trying to make sure how to get it all the way out of the system in the first place.

JP

[VHockey86]

The patch is only about a 1 megabyte download, I dont see why anyone would NOT just do that, as opposed to finding some sort of alternative

[John Prophet]

Well, a lot of the peeps with the virus are on dial up and they have about a minute before the virus kicks em off. But yeah, obviously the patch(es) are a no brainer. And I have never had a patch mess up a system yet although Ive heard all kinds of horror stories about peeps downloading DRIVERS from msoft, lol.

JP

[DoctorReno]

John, I have found 2 locations of registry entries that I delete and also there is one in the System32 folder that I'll be damned if I know how to delete yet. Apparently it is "in use" and can't be deleted thru normal methods and my anti-virus says it can't be quarantined.
Apparently the virus/worm is now disabled in my machines but the one file still bugs me. (no pun intended with bug)

[DoctorReno]

It is my understanding that the patch originally slowed your machine way down .... almost worse situation than being shutdown every hour or so. I'm not certain if MS has rewritten the patch or not. Just read about this in a back issue of PC Mag June 30 2003.

[SiliconJon]

XP's firewall is not enough, as a friend caught the worm with his XP Home's software firewall enabled. Now, I didn't check to see how it was configured, but it sounds like that failed him. But clean up following Norton's little guide and a follow-up patch from disk before getting back online has kept him worm free for two days now.

As for staying free, depends on what other exploits are yet un-exploited! And who finds it first!