Blaster Woes.

[dxkj]

Any network admins here with any ideas? This is my situation:


Firewall protects all computers behind it from this virus.


New students bring in computers, hook up to the ports, and spread virus behind the firewall.

Im not the network admin, but Im one of the workers with Resnet. Right now we are being told that we have to go around to every computer, patch it, and install virus software on it, and remove the virus. Since this is for 3000+ computers, this will be way more work than we can handle for a while and delay a lot.....

Is there anyway to block the port that it spreads on? *reads some more*


will enabling the FIREwall in XP block the virus from spreading to other computers.

 

[speed01]

Enabling the firewall has had some good results. Microsoft has made available a tool to scan entire networks for the hole used by Blaster and they have provided a script to use in deploying the patch to entire networks. If I could remember where I found it on the Microsoft site I'd link it....🙂 This however will not help with infected machines, they still need to be visited and cleaned. I read about the tools from Microsoft after we went around and manually patched around 1000 machines so I wasn't able to test them out so you will have to investigate for yourself if they'll work for you or not.

Speed

 

[kt]

Are you running ADS on your domain? If so, I would suggest you get the patching VB script. You can download that from Microsoft site. It allows you to scan the network computers and deploy the patch on all unpatched computers.

 

[kt]

oops.. hit reply button one too many time.

 

[dxkj]

Originally posted by: speed01
Enabling the firewall has had some good results. Microsoft has made available a tool to scan entire networks for the hole used by Blaster and they have provided a script to use in deploying the patch to entire networks. If I could remember where I found it on the Microsoft site I'd link it....🙂 This however will not help with infected machines, they still need to be visited and cleaned. I read about the tools from Microsoft after we went around and manually patched around 1000 machines so I wasn't able to test them out so you will have to investigate for yourself if they'll work for you or not.

Speed

crap, if you could find that , that would be a BIg help


btw, I am searching for it too 🙂 thanks


linked

this is a tool that scans and finds out which computers are missing the patch i believe. Just need to find the next step to patch them all simultaneously

 

[Garion]

Make an announcement that your network will now allow computers to connect which have not been patched. Shut down the users who aren't patched. You can do this by giving them a bogus reservation in DHCP with their MAC address, shutting down their switch port, etc. You will then, of course, have to give out the patch on floppy, since they can't get to the Internet.

The alternative is to block all TCP ports used by the virus on your network until you're confident that everyone has cleaned their act up.

- G

 

[drquest]

Here's another one too....

scanner They also offer a $$ pay version that will patch those it finds... not cheap though.....

Also if you have those on Active Directory you should be able to push the patch to the machines...

mrpeabody

Originally posted by: dxkj

Originally posted by: speed01
Enabling the firewall has had some good results. Microsoft has made available a tool to scan entire networks for the hole used by Blaster and they have provided a script to use in deploying the patch to entire networks. If I could remember where I found it on the Microsoft site I'd link it....🙂 This however will not help with infected machines, they still need to be visited and cleaned. I read about the tools from Microsoft after we went around and manually patched around 1000 machines so I wasn't able to test them out so you will have to investigate for yourself if they'll work for you or not.

Speed

crap, if you could find that , that would be a BIg help


btw, I am searching for it too 🙂 thanks


linked

this is a tool that scans and finds out which computers are missing the patch i believe. Just need to find the next step to patch them all simultaneously

 

[Abzstrak]

heres the info you need

Scanning Tool
http://www.microsoft.com/downloads/details.aspx?FamilyID=c8f04c6c-b71b-4992-91f1-aaa785e709da&DisplayLang=en

Howto use scanning tool
http://support.microsoft.com/default.aspx?kbid=826369

vbscript stuff
http://support.microsoft.com/default.aspx?kbid=827227

All pretty straight forward, we did it in a few hours for a 3500 node network....