port block of blaster

alvi2 · 08-31-2005, 03:51 PM

dear using squid with iptables
now all of my clients using win2000
all clients infected of automatic reboot after 60 second
but if one unplug the network cable then no reboot

so this virus attack from internet from my gateway
can someone tell me how can i block the attack of this thread
block tcp port but which one
.....

Matir · 08-31-2005, 04:52 PM

The relevant ports are TCP/4444, TCP/135, and UDP/69. W32.Blaster is SO old, however. You should have patched the clients LONG ago. Additionally, any decent firewall would've kept it out in the first place (unless it got loose on the LAN).

alvi2 · 08-31-2005, 05:00 PM

latest anti virus (norton) is installed on each client as well as patch of this is also install from microsoft site but again and again attack
so also tell me are these ports are working mean if i block from the linux mechine then in future my clients will not distrub from this blaster
or need some extra care

Matir · 08-31-2005, 05:07 PM

If you block those ports, it will protect the machines from the outside, but if you have infected computers behind the firewall, you have to clean those up. Has the antivirus confirmed the infection to be blaster?