VeriSign: DNS Flood Shows Microsoft Blaster Worm Bigger Than Thought

ComputerWire ^ | August 15, 2003

[GSWarrior]

Thanks...and you're not being rude!

[TechJunkYard]

Shouldn't ISPs cache most of this information?

Yeah, but if the ISP's nameserver(s) is/are getting slammed, the client will eventually time out and go to the next nameserver. When it runs out of nameservers, it goes to the root nameservers.

[AEMILIUS PAULUS]

Mine too> What were the symptoms?

[undeniable logic]

You seem to know this thing pretty well. I think that my parents may have this thing, but they live in Atlanta and I live in Pittsburgh and they are not computer savvy AT ALL! They called me and told me that whenever they dialup their ISP to logon to the internet, a message box appears saying that the computer will shut down in 60..59..58 seconds authorized by NT Authority Systems or something like this. I thought that they may have gotten this thing - in your opinion, did they?

If so, what do I tell them to do??? They are running Win XP, but really know almost nothing about computers and use a dialup - what is the best course of action???

Thanks in advance!

[kylaka]

They absolutely have it. They need to do two things. # 1 go to Symantec's website and download the Blaster removal tool. Its a small program that will scan all files on the computer and remove the Blaster files including the registery references. That will prevent the worm from launching immediately after startup. # 2 Enable the personal firewall (before logging back onto the web again) which will prevent it from infecting the computer again. Several posts above describe this proceedure in good detail.

That will allow the computer to function normally but it is not the final fix. Ultimately it requires MS's patch to fix it, which is available on MS's website. You will also need all service packs up to date, in order to apply the patch. In their case, after doing the temporary fix, if they need SP1a (service pack) they can order it on CD from MS for $10. If you need any more details, feel free to ask. If you want anything sent to you, reply by freepmail.

[Monty22]

I want to recommend what some others have said also, get a D-link or Linksys router for your broadband. It's good sense, and has strong firewalls that'll stop these worms if you take care of it.

[undeniable logic]

Well, I tried to talk them through this on the phone, but they could hardly stay connected long enough to download anything. I was able to get them to download the blaster removal tool - they started the removal program, but apparently did not hangup the connection, and during the removal process, the system shut down. Now, every time they boot up, they get the blue screen of death (which is strange under Windows XP). So, I don't know what to tell them over the phone anymore. Any suggestions?

They are very clueless when it comes to computers and I had to walk them through every tiny process (what to click, where to type in Internet Explorer) - Before I moved to Pittsburgh, I setup a webpage that ran on the desktop with the links to every site that they visit, because they get confused by even having to type in an address in the address bar, so it was quite the challenge to walk them through the download, but I think now we are in over our heads (as far as me talking them through this on the phone.)

I was going to tell them to ship me the computer so that I could fix it and ship it back, but this seems almost rediculous.

Thanks again!

[kylaka]

You only have two options now. While the machine boots, tap F8 every second or so... a screen will come up and one of the options will be "revert to the last known good configuration". Try it, but I'm not optomistic. Secondly, you can reload XP from scratch, and try the whole thing again.

BTW if their copy of XP is newer than six months old it probably has the latest service packs. You can choose "Help" from any windows menu then "about windows" and it will show the version and update status.

[toupsie]

5. Sell your PC and buy a Mac so you don't have to do this ever again.