Blaster Worm? Not? What then?

[Big Mac]

I have a couple of questions at the bottom of this post after the
somewhat lengthy explanation.

I just reformatted my hard drive. I install Windows XP from my
install CD I originally got with the computer. I Install a printer
and whatever stuff (printer, mainboard, graphics) - all from factory
CDs (no back-ups of anything). Then I install "Total Access 2004"
from a CD (My ISPs Internet software).

I log onto Earthlink (my ISP), with my fresh virgin-like system, and
get promoted by Windows to d-load a Windows Messenger update. Ok, I
do. It is quick to d-load/install, no reboot required. The next
thing I do is to download Total Access in case there is a newer
version, so I do. It takes a while at dial-up speeds. After
installing, my system needs to re-boot. Ok. Call right back to
Earthlink. Go to Windows Update to d-load all of the Windows updates
I will need (looking at well over 4 hours of d-loads).

Ok - after a couple of minutes, I get a "system is shutting down, save
your data" message. Never gotten that before. System shuts down and
reboots. Call back. After maybe 5 minutes online d-loading, again
"system shutting down, etc". 3rd try, not even trying to d-load,
system shut down.

I call Earthlink. The guy tells me I have the blaster worm. He tells
me to enable my firewall on XP (whoops, forgot - why doesn't it enable
when you install Windows??). Ok, so it works - no more system
shutdowns. ** However, I will need to remove blaster from my system,
as the firewall only stops the problem, not remove the worm.

Well I go and d-load Windows service pack #1 (4 hour d-load).
Install. Then I go to symantec online and get the Blaster 32 removal
file, and run it after setting up the system like it says. It scans
my hard drive and tells me NO Blaster Worm found. Then I go back to
symantec and do the online scan of my system for any known viruses.
Nothing. Clean as can be.

I haven't turned off my firewall since, so I don't know, but:

(1) Does anyone have anything to tell me about what was, or probably
still is, on my system, or going on with my system?

And I thought you needed to open a file to catch a worm or a virus.
Earthlink tells me that all I need to do is surf the net, and that
since I didn't have any updates to windows, I was exposed to something
that is all over (like I said - all I did was update Messenger and
d-load from Earthlink, and only after the install/reboot of
Earthlink's Total Access software did the system shutdowns begin to
happen).

So (2) - is Earthlink right? Was I open to infection by
god-knows-what just by being online for a few minutes? Or do I need
to open a file (.exe, .bat, .pif, .scr, whatever) to get a worm or
virus?

Any comments as to what was/is on my system are appreciated.

And BTW I went without my XP firewall turned on up until November. I
didn't even know I had it to use. I only opened files online that
were .jpg or .gif (pictures), or only d-loaded/opened stuff from major
web-sites. Never caught a virus or worm that I know of. But only 15
minutes online at Earthlink and....

 

[Beauregard T. Shagnasty]

Quoth the raven named Big Mac:

So (2) - is Earthlink right?
Yes.

Was I open to infection by
god-knows-what just by being online for a few minutes?

Minutes? Seconds may have been long enough. The rampant blaster worm
on infected computers is constantly pinging for new victims, generally
within its own netblock, e.g. 66.81.nn.nn IPs such as yours.

Or do I need
to open a file (.exe, .bat, .pif, .scr, whatever) to get a worm or
virus?

Nope. Just be online without that firewall... BTW, I suggest you get
a better one. Even ZoneAlarm is better than the inbound-only thingy
that MS provides. IIRC, they don't even call it a firewall.

 

[GSV Three Minds in a Can]

I have a couple of questions at the bottom of this post after the
somewhat lengthy explanation.

I just reformatted my hard drive. I install Windows XP from my
install CD I originally got with the computer. I Install a printer
and whatever stuff (printer, mainboard, graphics) - all from factory
CDs (no back-ups of anything). Then I install "Total Access 2004"
from a CD (My ISPs Internet software).

I log onto Earthlink (my ISP), with my fresh virgin-like system, and
get promoted by Windows to d-load a Windows Messenger update. Ok, I
do. It is quick to d-load/install, no reboot required. The next
thing I do is to download Total Access in case there is a newer
version, so I do. It takes a while at dial-up speeds. After
installing, my system needs to re-boot. Ok. Call right back to
Earthlink. Go to Windows Update to d-load all of the Windows updates
I will need (looking at well over 4 hours of d-loads).

Ok - after a couple of minutes, I get a "system is shutting down, save
your data" message. Never gotten that before. System shuts down and
reboots. Call back. After maybe 5 minutes online d-loading, again
"system shutting down, etc". 3rd try, not even trying to d-load,
system shut down.

I call Earthlink. The guy tells me I have the blaster worm.

Not necessarily - what you have is an =infection attempt= by the blaster
worm. The firewall stops that. If you install =all= the MS updates (in
particular the July 2003 ones) you will have the infection loophole
fixed too (just SP1 on its own doesn't cut it).

Google is your friend - just search for 'MSBLAST' or similar (if you use
the 'groups' facility you can access all the previous wisdom posted
here).

Most decent ISPs are filtering the worm infection (by not allowing
traffic on the relevant port) these days, but the crashes will happen
anyway I believe.

 

[FromTheRafters]

(1) Does anyone have anything to tell me about what was, or probably
still is, on my system, or going on with my system?

DCOM RPC Exploit code from Blaster (or variants) that is
crafted for OSes other than yours, will cause the symptoms
you described. This is not necessarily an indication that you
were infected, only that you were vulnerable to the exploit.
There is a good possibility that you were also hit by the code
that *was* crafted for your OS, so a full scan by an up-to-
date AV would be a good idea.

And I thought you needed to open a file to catch a worm or a virus.

Many people think that that is so, but they are wrong. Also, files
are routinely opened and executed without the user even being
aware that it is happening.

Earthlink tells me that all I need to do is surf the net, and that
since I didn't have any updates to windows, I was exposed to something
that is all over (like I said - all I did was update Messenger and
d-load from Earthlink, and only after the install/reboot of
Earthlink's Total Access software did the system shutdowns begin to
happen).

It's a jungle out there, and Earthlink gave you access.

So (2) - is Earthlink right? Was I open to infection by
god-knows-what just by being online for a few minutes?

Yes. Microsofts DCOM RPC had an internet facing vulnerability
(Buffer Overflow® By Microsoft®) which allowed hostile code to
be downloaded (Blaster worm executable) and executed without
any user action needed.

Actually, minutes are a long time, many people experienced the
shutdown problem within seconds of connecting.

Or do I need
to open a file (.exe, .bat, .pif, .scr, whatever) to get a worm or
virus?

No need ~ sit back and relax while Microsoft's software does
all of the work for you.

Any comments as to what was/is on my system are appreciated.

Probably a Blaster variant, but a scan is in order to determine which
(if any) were successful in their attempt.

Good luck

 

[Big Mac]

Not necessarily - what you have is an =infection attempt= by the blaster
worm. The firewall stops that. If you install =all= the MS updates (in
particular the July 2003 ones) you will have the infection loophole
fixed too (just SP1 on its own doesn't cut it).

Thanks for the positive input. You are the only person who has told
me positive news so far. I have posted in a couple of other
newsgroups. This is good to hear.

I ran Symantec's blaster remover, and also ran their online check for
all known viruses, and in both cases nothing was found on my hard
drive.

Still 0 shutdowns since I turned my XP firewall on after the initial
problem.
......