Blaster Worm Advisory

ROSEVILLE, CALIFORNIA, AUGUST 12, 2003

Many computer users are experiencing the effects of a new virus going around this week.  The cure for the virus is fairly straight-forward, although you must be diligent about reading the steps carefully.

We at InnovaCrew are working diligently to help customers affected by this problem.  Fortunately most of our customers are already immune because of the way their networks were set up.  If you have this problem and need our assistance please call the office at  (916) 773-7222 and pick option 9 for the receptionist.  She will get you scheduled as soon as possible.

The current virus (called the Blaster Worm) only affects computers running Windows XP, Windows 2000, or Windows NT 4.0. Computers running any other version of Windows (98, 95, ME) are not affected by this worm.

Who is affected?

This worm can affect anyone with a connection to the Internet but without a "firewall" protecting your computer.  The people most often affected by this problem are home users who use a dial-up modem connection to the Internet, although users on a cable modem or DSL modem could be affected also if they do not have a firewall installed.

A firewall is also known as a broadband router.  If you have DSL or cable modem service you should have one of these.  Some common routers are made by Linksys, Netgear, and D-Link.  You can buy them off the shelf at Best Buy, Circuit City, CompUSA, and Fry's.  If you have one of these routers you are not directly affected by this problem, although you should still update your system. If you don't, we strongly recommend buying one.

Windows XP has a firewall built in to the software, but you have to turn it on.  If you turn on this firewall you will be protected against this worm.  See the instructions below for details.

What to do about it?

If you are using Windows NT 4.0, Windows 2000, Windows XP, or Windows Server 2003, you should follow the steps in this sequence to help protect your system and to recover if your system has been infected.

1. Make sure you have a firewall installed and activated to help protect your computer against infection, before you take other steps. If your computer has been infected, activating firewall software will help limit the effects of the worm on your computer.
    

   • If you have Windows XP or Windows Server 2003, follow these instructions to enable the Internet Connection Firewall.
      

   • If you have Windows NT 4.0 or Windows 2000, you will need to install a third-party firewall. Most firewall software for home users is available in free or trial versions. Check the following resources for more information on personal firewalls:
      

     • ZoneAlarm Pro (Zone Labs)

     • Tiny Personal Firewall (Tiny Software)

     • Outpost Firewall (Agnitum)

     • Kerio Personal Firewall (Kerio Technologies)

     • BlackICE PC Protection (Internet Security Systems)

     These products also work with Windows XP.
      

   • Alternatively, if you use Windows 2000, you can take steps to block the affected ports so that your computer can be patched. Here are some modified instructions from the TechNet article HOW TO: Configure TCP/IP Filtering in Windows 2000.
      

     1. In the Control Panel, double-click Network and Dial-up Connections.
         

     2. Right-click the interface you use to access the Internet, and then click Properties.
         

     3. In the Components checked are used by this connection box, click Internet Protocol (TCP/IP), and then click Properties.
         

     4. In the Internet Protocol (TCP/IP) Properties dialog box, click Advanced.
         

     5. Click the Options tab.
         

     6. Click TCP/IP filtering, and then click Properties.
         

     7. Select the Enable TCP/IP Filtering (All adapters) check box.
         

     8. There are three columns with the following labels:

        • TCP Ports

        • UDP Ports

        • IP Protocols

        In each column, you must select the Permit Only option.
         

     9. Click OK.
         

2. Download and install the security update addressed in Security Bulletin MS03-026 for the version of Windows that you are using from the Microsoft Download Center. When you click the appropriate link below, a dialog box appears. To begin the download process, do one of the following:
    

   • To start the installation immediately, click Open or Run this program from its current location.
      

     • Windows NT 4.0

     • Windows 2000

     • Windows XP
        

3. Make sure you install and use antivirus software.
    

   • If you have antivirus software installed, get the latest virus definitions from your antivirus vendor's Web site.
      

   • If you do not have antivirus software installed, visit Windows Catalog for a list of antivirus software vendors.
      

4. If you think your computer has been infected, use the worm removal tool available at your antivirus vendor's Web site. For additional details on this worm from antivirus software vendors participating in the Microsoft Virus Information Alliance (VIA) please visit the following links:
    

   • Network Associates

   • Trend Micro

   • Symantec

   • Computer Associates

   Learn about Microsoft's Virus Information Alliance.