Protecting yourself against the Blaster worm Options

[usr.c]

Check out the article from Symantec: http://securityresponse.symantec.com/avcen...aster.worm.html

Based on the number of submissions received from customers and based on information from Symantec's DeepSight Threat Management System, Symantec Security Response has upgraded this threat to a Category 4 from a Category 3 threat.

W32.Blaster.Worm is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. The worm targets only Windows 2000 and Windows XP machines. While Windows NT and Windows 2003 Server machines are vulnerable to the aforementioned exploit (if not properly patched), the worm is not coded to replicate to those systems. This worm attempts to download the msblast.exe file to the %WinDir%\system32 directory and then execute it. The worm has no mass-mailing functionality.

Additional information, and an alternate site from which to download the Microsoft patch is available in the Microsoft article What You Should Know About the Blaster Worm and Its Variants.

Users are recommended to block access to TCP port 4444 at the firewall level, and then block the following ports, if they do not use the applications listed:

TCP Port 135, "DCOM RPC"
UDP Port 69, "TFTP"

The worm also attempts to perform a Denial of Service (DoS) on the Microsoft Windows Update Web server (windowsupdate.com). This is an attempt to prevent you from applying a patch on your computer against the DCOM RPC vulnerability.

Click here for more information on the vulnerability that this worm exploits, and to find out which Symantec products can help mitigate risks from this vulnerability.

[Gringo]

Check out the article from Symantec: http://securityresponse.symantec.com/avcen...aster.worm.html

thanks for the info. But I guess prevention is better than cure and Updated virus might do the job on cleaning things. that's what I think.

[Grin]

thanks for the info. But I guess prevention is better than cure and Updated virus might do the job on cleaning things. that's what I think.

but how will you prevent if your updated anti-virus cant scan it? right?