HELP!!! Question about the Worm, DSL, outdated Anti-Virus and Firewall

[LynneSin]

That's my computer in a nutshell!

My computer is online 24 hours a day but the Anti-Virus software is out of date and I haven't paid to get the new subscription. (Bad Bad me).

However, I do have a firewall on my computer (Zone Alarm), so won't that protect this worm from getting into my computer since I have to approve everything that is sent through my computer??

Please advise! I'm hoping I'm not going home to a mess on my computer!!!

Thanks!

[Cha]

1. Here's a roundup link by Undisclosedlocation!

http://www.democraticunderground.com/discuss/duboard.php?az=show_topic&forum=105&topic_id=89794

[LynneSin]

3. I've read it but i'm still trying to get a specific answer

well, I'll find out in 15 minutes - I'm heading home from work right now

[JCMach1]

2. I believe the worm exploits XP, so if you have a prev. ver. of WIN

you MAY be okay.

[SOteric]

4. Not necessarily.

If you're running any of the vulnerable new editions of Windows, it's advised you get the patch for the buffer over-run problem regardless of the level of your protection.

[JCMach1]

5. Also download AVG anti-virus now

It's FREE

http://www.grisoft.com/us/us_index.php

[tsipple]

9. Another Good, Free Antivirus Package

Download AntiVir as soon as you can. Or, better yet, try Linux without even installing it.

[Rick Myers]

6. This worm does NOT attack computers running

Win 98, Win98SE or older versions of Win2000. And a firewall like ZA DOES provide protection from this particular worm.

[Cha]

7. Yeah! It attacked my "WindowsXP", Big Time, yesterday!

And it was down all night! I called Dell for assistance and they were overloaded with calls ...so I called RoadRunner and waited on the line for two hours due to the amount of People who were also experiencing the same problem as I.

The guy @ RR told me it was a hacking problem and gave me the site to download the patch which I thought I was going to have to download on another computer and install in mine..but it turned out that today I could do it on mine!


http://www.bartcop.com has the link right on the top of his page! B-)

[LynneSin]

8. Great, I have Win98

Sigh of major relief and to top things off I have Zone Alarm which helps

Mods - you can lock this thread now for all I care!!

[starroute]

10. I spent some time this morning researching firewalls

The reviews and discussions I found seemed to agree that Zone Alarm is out of date, buggy, and a major memory hog. Agnitum Outpost, which I've been using, doesn't get such great marks either, except for being simple to use.

The two that were recommended most often were Kerio and Sygate, with Kerio having a slight edge. I've downloaded both of them, but apparently they take a bit of expertise to set up and configure, so now I'm looking for online guides.

http://www.kerio.com/kpf_home.html
http://smb.sygate.com/products/spf_standard.htm

Both are free for personal use.

[Davis_X_Machina]

11. ZA works on this one....

...I've been hammered all day on port 135 -- the affected port -- to no ill effect.

[WannaJumpMyScooter]

14. Me too, and to no avail of the worm

The comments about ZA you hear all the time, the guy who wrote it has a lot of enemies. It works. It does not eat up memory. It is easy to use.

Sour grapes from assholes who can't write tight code.

[Kahuna]

12. Thank goodness I still have my old win 98 PC

I copied the Norton fix it file and the Windows patch to a floppy. Then copied the files to my XP computer. The internet keep shutting my PC off before I could download to my XP computer. :grr:

[Ivory_Tower]

13. I've been trying to figure this out, too

I understood the headaches I went through at work today since our network is like a sieve, but at home:

I have an up-to-date AV data file, plus a firewall on my router, PLUS ZoneAlarm. (I'm running Win2K, btw.) I've run the "Probe My Ports" test and all that, and theoretically, my network is invisible to the outside world. I checked the log on my router and port 135 is constantly getting pounded. I check the log on ZoneAlarm and didn't see any attempts to reach Port 135 (or any port, for that matter since the router firewall seems to be working). And yet, when I checked my PC, I saw the same symptoms as the ones I saw at work! So, either the symptom I'm seeing isn't really a sympton and I'm safer than I thought (I don't tend to think that way, though), or my computer got infected by some other method (but the only method I've read about is unauthorized exploits through port 135).

The symptom I had was watching tftp.exe "miraculously" restore itself in the system32 directory after I rename it or delete it. I didn't see it active in Task Manager, either, so I'm not sure who restored it.

Once I ran the updates and patches, I was able to delete the restored instances of tftp.exe without having them return, so I'm pretty confident that I was attacked. But I'll be damned if I can figure out how.