Remove the Blaster Worm [MSBlast, Blaster, etc.]

• Editing the RPC to allow you to connect to the internet
  • Start > Run
  • Type: "services.msc /s" in the open line and click OK
  • On the right hand side find the Remote Procedure Call service [there is a Remote Procedure Call Locator service, do not confuse the two]
  • Right-click the Remote Procedure Call (RPC) service, and then click Properties.
  • Click the Recovery tab.
  • Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
  • Click Apply, and then click OK.
     
    

    Note: Make sure you change these back after removing the virus.

    
     
• For Windows XP
  • If your computer reboots repeatedly, please unplug your network cable from the wall.
  • First, enable Internet Connection Firewall (ICF) in Windows XP: http://go.microsoft.com/?linkid=220772
    • In Control Panel, double-click "Networking and Internet Connections", and then click "Network Connections".
    • Right-click the connection on which you would like to enable ICF, and then click "Properties".
    • On the Advanced tab, click the box to select the option to "Protect my computer or network".
  • Plug the network cable back into the wall to reconnect your computer to the Internet
  • Download the MS03-026 security patch from Microsoft and install it on your computer:

  Windows XP (32 bit)
  http://go.microsoft.com/?linkid=220773
  
  Windows XP (64 bit)
  http://go.microsoft.com/?linkid=220774

  • Install or update your antivirus signature software and scan your computer
  • Download and run the worm removal tool from your antivirus vendor.
     
• For Windows 2000 systems, where Internet Connection Firewall (ICF) is not available, the following steps will help block the affected ports so that the system can be patched. These steps are based on a modified excerpt from the article; HOW TO: Configure TCP/IP Filtering in Windows 2000. http://go.microsoft.com/?linkid=220775
  
  • Configure TCP/IP security on Windows 2000:
    • Select "Network and Dial-up Connections" in Control Panel.
    • Right-click the interface you use to access the Internet, and then click "Properties".
    • In the "Components checked are used by this connection" box, click "Internet Protocol (TCP/IP)", and then click "Properties".
    • In the Internet Protocol (TCP/IP) Properties dialog box, click "Advanced".
    • Click the "Options" tab.
    • Click "TCP/IP filtering", and then click "Properties".
    • Select the "Enable TCP/IP Filtering (All adapters)" check box.
    • There are three columns with the following labels:
      1. TCP Ports
      2. UDP Ports
      3. IP Protocols
    • In each column, you must select the "Permit Only" option.
    • Click OK.
       
  • Download the MS03-026 security patch for Windows 2000 from Microsoft and install it on your computer from: http://go.microsoft.com/?linkid=220776
     
  • Install or update your antivirus signature software and scan your computer
     
  • Then, download and run the worm removal tool from your antivirus vendor.
     
• Prevention:
  • Turn on Internet Connection Firewall (Windows XP or Windows Server 2003) or use a third-party firewall to block TCP ports 135, 139, 445 and 593; UDP port 135, 137,138; also UDP 69 (TFTP)and TCP 4444 for remote command shell. To enable the Internet Connection Firewall in Windows: http://go.microsoft.com/?linkid=220782
    • In Control Panel, double-click "Networking and Internet Connections", and then click "Network Connections".
    • Right-click the connection on which you would like to enable ICF, and then click "Properties".
    • On the Advanced tab, click the box to select the option to "Protect my computer or network".
       

      This worm utilizes a previously announced vulnerability as part of its infection method. Because of this, customers must ensure that their computers are patched for the vulnerability that is identified in Microsoft Security Bulletin MS03-026. http://go.microsoft.com/?linkid=220783.

      
      
  • Install the patch MS03-026 from the Microsoft Download Center:
    
    Windows NT 4 Server & Workstation
    http://go.microsoft.com/?linkid=220784
    
    Windows NT 4 Terminal Server Edition
    http://go.microsoft.com/?linkid=220785
    
    Windows 2000
    http://go.microsoft.com/?linkid=220786

    Windows XP (32 bit)
    http://go.microsoft.com/?linkid=220787

    Windows XP (64 bit)
    http://go.microsoft.com/?linkid=220788
    
    Windows 2003 (32 bit)
    http://go.microsoft.com/?linkid=220789
    
    Windows 2003 (64 bit)
    http://go.microsoft.com/?linkid=220790

  • As always, please make sure to use the latest antivirus detection from your antivirus vendor to detect new viruses and their variants.

    Related Knowledge Base Articles:
    http://go.microsoft.com/?linkid=220791

    Related Microsoft Security Bulletins:
    http://go.microsoft.com/?linkid=220792

How to set-up a Home Network:

IP Settings: Click Start and choose Control Panel   Click Network and Internet Connections   Choose Network Connections   Right-click the Local Area Connection and choose Properties   Select Internet Protocol (TCP/IP) and click the Properties button   Tick: Obtain an IP address automatically and Obtain DNS server address automatically   Click OK to close the box, then OK on the next to apply the setting.   Configure the workgroup settings per the next section.

Note: If you have a My Network Places icon somewhere, you can right-click it and choose properties in substitution of the first three steps

Workgroup and Computer Name Settings: Click Start then right-click My Computer and choose Properties. (This can be done if you have the icon on your desktop also)   Choose the Computer Name tab and click the Change button   Under Member of: tick the Workgroup option and type in a network name, or leave it as the default. (Keep in mind, for your computers to see each other on the network, the workgroup names must all be identical)   Click OK to apply the settings, then OK again to close the remaining box.   You're Finished!

Click to view the image at its full dimensions (will open a small window for the image)

Another Old Content Update. I'm not hosting the Automatic Removal Tool anymore, so who knows when the link will expire.

Realphx / TalkStocks ( AIM Virus ) Removal Instructions / Tools:

Download the Removal Tool (automated javascript) -- Just download it and run it. (or just open it directly)

These may have appeared in your profile if you have been infected:

Manual Removal Instructions:

1. Press the CTRL, ALT, and DEL keys at the same time to bring up the task manager.
2. Click on the processes tab (windows 2000/XP), and find 'b.exe', 'bbb.exe' or 'av.exe' and kill the process.
3. Go to C:\Windows\ and delete 'b.exe' and 'bbb.exe' or 'av.exe' (or do a search for the virus: click Start > Search > look up each virus individually) Delete these when you find them.
4. Click Start, then click on Run, type in "Msconfig" in the box and press ENTER.. When the box comes up, click on the "startup" tab and look for "b.exe" or "av.exe" listed (possibly listed under"antivirus") then uncheck the box to the left. (Windows 98/XP only)
5. Clear your profile (or make a new one) and restart.
6. When the msconfig box comes up after restart just check the box telling it not to come up again.

As some of you may have noticed, I've recently added a search box to the top of the site.  This is a default module in joomla, but the template I'm using didn't have support for a search bar right out of the box.  This blog post describes how I added the modified the WR_Futilus_Situs theme so it would have a search box that looked like it fit in.

At a high level, the steps involve:

• Enabling the search module and setting it up
• Modifying the theme's index.php file to include the search box
  

And here are the details:

Setting up the module: 

• Enter the Joomla Administration page.
• Click Modules > Site Modules
• Click on the Module named "Search" (of type "mod_search")
• Make sure the item is published by clicking the appropriate radio box.
• And change the Position Drop Down box to position User8
• Click save at the top
  

Modifying the index.php file:

• FTP into your server
• Access the joomla_home/templates/wr_futilus_situs folder
• Download the file index.php (from the above folder) for editing
• Find the section called <!-- START: SUCKERFISH -->
• Below : <div id="nav">
                          <?php mosShowListMenu($menu_name);    ?>
              </div>
  Insert:     <div style="padding-top: 5px;" align=right>
                          <?php mosLoadModules ( 'user8', -1 ); ?>
                </div>
• Save the file and upload it via FTP
• You are DONE!