W32.Blaster.Worm and High cpu utilization

zhang-hao · ‎08-13-2003

Attack of blaster.worm from lan cause router's cpu utilization reaches 70%-80%, besides intalling patches on affected pcs, is there any other work around on cisco router or switch to filter such viruses?

zhuangyr · ‎08-14-2003

you can add ACL to deny these traffic,such as

access-list 110 deny tcp any any eq 135

access-list 110 deny udp any any eq 135

access-list 110 deny tcp any any eq 139

access-list 110 deny udp any any eq 139

access-list 110 deny tcp any any eq 445

access-list 110 deny udp any any eq 139

access-list 110 deny tcp any any eq 593

mitchell_kohn · ‎08-15-2003

Hi,

I just got this from Cisco that will point you in the right direction.

Title: Cisco Security Notice: W32.BLASTER Worm Mitigation Recommendations

URL: http://www.cisco.com/warp/customer/707/cisco-sn-20030814-blaster.shtml

(available to registered users)

http://www.cisco.com/warp/public/707/cisco-sn-20030814-blaster.shtml

(available to non-registered users)

Posted: August 13, 2003

zhang-hao · ‎08-21-2003

Thanks, new worm was found then.

Cisco Security Notice: Nachi Worm Mitigation Recommendations