Comments on: Linux-based approach to fixing MSBlaster Worm infection

By: JoeBlog

JoeBlog — Sat, 06 Sep 2003 06:43:07 +0000

Fixing Windows with Linux boot CD

Dean, at Heal your Church Web Site, has a very helpful article about using a Knoppix (linux) boot CD for fixing MSBlaster worm infection. The cool thing is that it is a good general solution to fixing various Windows problems….

By: nop@233MMX

nop@233MMX — Sat, 16 Aug 2003 10:42:04 +0000

Think of this the next time you have to re-install Windows. Now pay attention. Do you remember the headaches? Do you remember where one of your previous versions of Windows is at right now? You’ll need it if your current version is an upgrade. Did you store the “key” with the disk? You’ll need that too. Know your ISP’s URL right off the top of your head? How about your mail server information? Do you remember every single program you installed with Windows? How long will it take to download/install all of the critical updates? Now start thinking about where you will find all of the programs you use that DIDN’T come with Windows. This is exactly why virus scanning software sells so well.

For years my favorite program was FORMAT with the /C: switch. I’ve found a better one. “GHOST”.

Starting with a clean hard-drive, I partition it with at least 2 partitions. Then I install and configure Windows and all of my necessary software. During setup I point the swapfile, e-mail, favorites and anything else I can get away with to the second partition. Post-Windows installations (that will work) also go on the second partition. The idea here is to keep the C: below 640Meg.

When everything is working properly and known to be “virus free” I kill temp files and cookies and defrag. Next I boot to floppy and run “Ghost”. I create an image of the C: partition and place it on the second partition. Next I boot back to Windows and write a CD with the image file.

Now I can install anything I want to without worrying about it overwriting a needed DLL with a crippled one. No more worries about virii. Test as many programs as I want without being stuck with parts of them forever. When (not if) something goes wrong I simply boot to the floppy and run Ghost. I flash the image back to the first partition and within 5-minutes I’ve installed and configured everything exactly the way it was the moment I made the image.

Go buy “Ghost” and quit worrying about the next virus. I hear the current version even works on Linux.

By: MellarilMan

MellarilMan — Sat, 16 Aug 2003 06:04:21 +0000

SD, MMC, Sony Memory Stick, Anything small gearless usb and on the go. Why why why do we insist on the beast we call windows machines?
Easy,lite, portable, pretty. Virri, Trojans, and Wurms frighten End Users, poor net work admins so alone with no friends.
Linux never recieving due respect. Soloris, HP-AUX, SCO, BSD, and Solaris agrivate my condition. Missing the days of VMS, ashamed of minix finding refuge in GNU.
So simple was the days when all i had was an fpu. Poking memory with basic on my Atari 400, while reading mad magazine. It is hard to believe I am only 23.
Linux is my friend, even when my teachers told me OS2 was the end for MS and IBM ruled. Pre 95 slackware on my rig god bless that wretched machine.
Peace bothers and sisters, some of us out there understand and share your pain.

A mental Patient
Paul R. Jones

FYI
I am 24
and gave up IT
no place for
us mental cripples
with love
Paul

By: BG

BG — Fri, 15 Aug 2003 17:16:40 +0000

I wonder whether you could set up Wine to run from your Windows partition, then run windows update from IE in Wine. Of course if you’re on a system with NTFS, this isn’t so good since it’d write to the disk. And it is probably risky. It’d be neat to try on a system that you didn’t care at all about.

By: Radenko Savic

Radenko Savic — Fri, 15 Aug 2003 12:21:36 +0000

Great post. Simple and correct. I did that, and I don’t have problem anymore. Thanks. Bye.

By: Dragan Mihaljevic

Dragan Mihaljevic — Fri, 15 Aug 2003 11:31:36 +0000

I don’t know what is the problem. You go directly to Windows XP/2000, start taskmanager, kill msblast.exe among processes, download & upgrade what you need. I managed to do that more than once in past few days.

I like and use Linux, but are you getting a little bit complicated?

By: Cirilo Bernardo

Cirilo Bernardo — Fri, 15 Aug 2003 08:47:01 +0000

This morning I just went through a process which would have eliminated the MSblaster worm … although I went through it for entirely different reasons (no worm on my computer!). I just happen to have a hot spare for my HD (can’t have it fail in field work) which was initially created via dd and with the data files kept up-to-date via other Linux tools. Windows went screwy thanks to bad software (not necessarily MS) so I just wiped the winnt directory and re-installed off my hot spare. I had a fully functional Windows2000 in under 10 minutes…

By: Earl

Earl — Fri, 15 Aug 2003 05:37:20 +0000

If knoppix was your OS (25min install) you wouldnt
need to duct tape the CD to your PC.

By: follerec

follerec — Fri, 15 Aug 2003 04:46:55 +0000

of course you have the issue of file-system… blaster/lovesan affects win2k, xp. these are 2 microsoft OS’s that default to NTFS. so that would mean that you’d either need a fat/fat32 partition available to download to (of course remount r/w). or a floppy diskette available… yuck. of course that’s assuming that the symantec fix and microsoft patch fit in floppies. it probably does, but when was the last time you had a floppy?