How I survived MSBlast

No problem. I went to Microsoft's site, which had convenient links to the needed service pack -- I went for the most recent, Service Pack 4. Microsoft provides a handy Express Installation, the idea of which is to scan your system, find out which bits you already have, and then install only the bits you need, thus cutting down on how much you have to download. The downside is that you have to stay online throughout the installation process, instead of just downloading the service pack in one go and then installing it offline. I launched the Express Installation and attempted to get on with some work while it was (slowly) downloading in the background -- about 26MB, it informed me.

After a while, I noticed that something strange was happening with Express Installation: the connection was resetting every few minutes, so that it was stuck with about 19MB left to download. This was no good. I decided to have a look at the Network Installation method, where you download the whole Service Pack at once, and then install it offline. Unfortunately, this was out of the question -- the Network Installation version requires you to download 129MB. I might have been able to leave my PC overnight to download a file that size, but I needed to get some work done right away, and in its current state my PC was next to useless.

I should note that Microsoft also offers Service Packs on CD; they can be ordered from the company's Web site.

There's another, more immediate way to protect yourself against MSBlast that doesn't involve patches or Service Packs: if you have a firewall, you can set it to filter certain ports used by the worm, which should keep you safe for the short term. Windows XP and Mac OS X ship with firewalls built in, but Windows 2000 requires you to get the software from a third party. Microsoft's Web site lists a few companies that let you try out their firewalls for free. This, I figured, would be a short-term fix that would let me get on with the day's work -- although by this time the morning was already gone.

I found a likely looking candidate, with a download size of only a few megabytes: Armor2Net Personal Firewall, which took only about half an hour to download. To my chagrin, it didn't seem to have a port-filtering option. Another three-quarters of an hour wasted. Next candidate, Norton Personal Firewall. It seemed very small as well, although I discovered when I launched it that this was only the installer -- it needed to download a bit more to finish the installation. Actually, it needed to download another 26MB, meaning it would be finished around bedtime. Not an option.

Another firewall had a promising name: Tiny Personal Firewall ("Turn your PC into the fortress!"). It did seem moderately tiny (6.7MB or so), and only took another forty-five minutes or so to download and set up. Tiny's site even has instructions on how to filter the ports used by MSBlast, although these turned out to be inordinately complicated. And although the user interface was friendly-looking, alert boxes kept popping up declaring that unknown system processes needed to be "enrolled" or added to mysterious security groups. I did observe, however, that a process called MSBlast was being dealt with, which set my mind at ease.

The next step was to run the Symantec MSBlast remover, so that, theoretically, I could get back to work. The program took a long time, apparently scanning every file on my hard drive, and finally, at the end, informed me that there was no MSBlast infection on my computer. Really? I restarted in Safe Mode and ran the remover program again, with the same result. Was the infection all in my head after all?

Apparently not. If the worm had been destroyed, it had left behind plenty of evidence of its passing. Certain programs were corrupted, the most important of which was Microsoft Office, which was now unusable, though all the program files were still on the hard drive. I didn't have the install CD to hand, which meant I was now deprived of Outlook, Word and other useful Microsoft products. What's more, after all my efforts, I was still without my Service Pack and still unpatched. I had begun working on my PC at about 8:30 a.m., and it was now 3:00 p.m.

Fortunately, there was another immediate solution readily available. I had a Power Mac packed away somewhere; I switched the PC off, plugged in the Mac, and connected to the corporate intranet without incident or worm attack, managing to get a couple of hours' work done in the end.

People may not bother writing hardware drivers or games for the less-popular Mac platform, but they also don't bother writing worms to attack it.