WARNING: w32.blaster & w32.lovsan worm (virus)

I am copying and pasting this warning from the Sony BBS:

(12 August 03) WARNING: w32.blaster & w32.lovsan worm / Microsoft Vulnerability

For customers who are running the following software:

Microsoft Windows NT? 4.0
Microsoft Windows NT 4.0 Terminal Services Edition
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server? 2003

Virus Alert

Microsoft advised that a security issue had been identified that could allow an attacker to compromise a computer running Microsoft? Windows? and gain control over it.
On Tuesday 12 August, a worm named ?w32.blaster?& 'w32.lovsan', was identified as exploiting this vulnerability and is starting to impact internet customers.

Microsoft advises going to the following site and downloading a patch to help protect your computer.
http://microsoft.com/security/incident/blast.asp

If you are already impacted by the worm click here for Information on how to remove it.

All services can be impacted but broadband services are more exposed to such security issues because of the always-on nature of broadband.

If your computer is not protected against worms and viruses, an attack could cause you to loose your service due to a system overload, your usage costs could increase dramatically or you could loose personal data amongst other possible impacts. Click here for Further FAQ?s on Viruses and Internet Security.

http://www.pandasoftware.com/about/p...x?noticia=4026

If your computer is not protected against worms and viruses, an attack could cause you to loose your service due to a system overload, your usage costs could increase dramatically or you could loose personal data amongst other possible impacts.

Janie xx

sorry for the intrusion... here's another link:

YAHOO NEWS

it is almost mandatory that your pc be equipped
with a virus scanner... as this virus seeks YOU
out.... and can access your pc without having to
open an attachment, etc.

if you have no saftey-net on your pc... get one

Thank you Janie!!

We just had a massive virus scare here [img]eek.gif[/img] There is about 250 people living on campus in my college (more in other colleges) and we all (about an hr ago) got this pop up message saying that our computers were going to shut down (more detailed than that, but I didnt read the message properly lol) and simultaneously everyone who had their computer switched on had their computer restarted by this mysterious thing [img]eek.gif[/img] Ofcourse everyone came out from their rooms going WTF is going on, and it happened to everyone... for some people their puters worked fine again after they were restarted.. others cant even switch their computers on let alone use the internet - we have no idea what happened [img]confused.gif[/img] Mine (obviously) is ok... but eeek!

Quote:

---

Originally posted by shatzy:
sorry for the intrusion... here's another link:

YAHOO NEWS

it is almost mandatory that your pc be equipped
with a virus scanner... as this virus seeks YOU
out.... and can access your pc without having to
open an attachment, etc.

if you have no saftey-net on your pc... get one

---

<font size="3" face="Tempus sans ITC, Papyrus,Verdana, Helvetica, sans-serif">Thanks for the link! [img]smile.gif[/img]

I've already got Norton Anti-Virus programme installed on my computer but with it came a Personal Firewall which I haven't installed as yet. The thing is, I'm not sure about firewalls and how they operate [img]confused.gif[/img] I don't want to find myself locked out of a site that I can't get into LOL but to stop hackers and viruses sounds like a very sensible idea. I'm just not sure whether I ought to riskk it and install it or not?

Janie xx

personally, i don't use a firewall... simply
because most of the common damage is deterred
through common sense (like opening strange
email attachments, etc).

i used to have a firewall but it ganked up a
few of my programs... and i disliked the restrictions
it gave me in as far as freedom. sure, it may
have protected me from a run-of-the-mill joe
trying to use my pc.... but they also cause
trouble.

personally, imo, if you have a virus scanner,
its enough... (and common sense)... if a hacker
wanted to infiltrate your system... rest assured
that the typical firewall won't do much.

to make a better analogy...

a firewall is like a $60K car with an alarm
parked in your garage in an upper neighborhood.
its redundant... and if a theif wants to steal
your car, he will know how.

I've already got Norton Anti-Virus programme installed on my computer but with it came a Personal Firewall which I haven't installed as yet. The thing is, I'm not sure about firewalls and how they operate [img]confused.gif[/img] I don't want to find myself locked out of a site that I can't get into LOL but to stop hackers and viruses sounds like a very sensible idea. I'm just not sure whether I ought to riskk it and install it or not?

Janie xx

OK Shatzy, thanks very much for your advice [img]smile.gif[/img] I think (I hope) that the anti-virus software I already have installed here will be enough. I am always a bit wary about installing new programmes like this just in case they mess other things up!

Janie xx

go ahead and install it. it can't hurt... and
you will then know how it reacts to the other
places you go to.

if it ganks up your stuff, just uninstall [img]smile.gif[/img]

I think I got that [img]frown.gif[/img]
I started having problems yesterday and my connection only lasts 5 minutes. I explained the problem to a friend....he just called me and said it's a worm but didn't get technical cos I wouldn't understand it.

I'm so frustrated now cos my anti-virus isn't good enough [img]frown.gif[/img]

The pop-up says: Windows must restart b/c the Remote Procedure Call Service terminated unexpectedly....blah blah blah


You won't see me for a while.... [img]frown.gif[/img]

<font color="#9966FF" size="1">[ August 12, 2003 06:10 PM: Message edited by: Ivana ]</font>

Quote:

---

Originally posted by Ivana:

The pop-up says: Windows must restart b/c the Remote Procedure Call Service terminated unexpectedly....blah blah blah


<font color="#9966FF"><font size="1">[ August 12, 2003 06:10 PM: Message edited by: Ivana ]</font></font>

---

<font size="3" face="Tempus sans ITC, Papyrus,Verdana, Helvetica, sans-serif">Ivana, I had the exact same pop up.. mine internet seems to be working fine though.. I dont know what the virus does [img]confused.gif[/img] Hope you get it sorted out & everything is ok [img]smile.gif[/img]

I am now virus free [img]smile.gif[/img]

And I've figured out what it does, it changes some settings so it instructs your computer to restart instead of restarting the service. This should be done manually after removing the virus and installing the patch. The whole procedure can be found on the site that describes the worm. I believe the link is posted but I'll try to find it again and post it [img]smile.gif[/img]

Because of the way the worm works, it may be difficult to connect to the Internet to obtain the patch, definitions, or removal tool before the worm shuts down the computer. There are at least two known ways to work around this, although neither solution works 100% of the time.

If you run Windows XP, activating the Windows XP firewall may allow you to download and install the patch, obtain virus definitions, and run the removal tool. This may also work with other firewalls, although this has not been confirmed.

In many cases, on both Windows 2000 and XP, changing settings for the Remote Call Procedure (RPC) Service may allow you to connect to the Internet without the computer shutting down. Follow these steps:
Do one of the following:
Windows 2000. Right-click the My Computer icon on the Windows desktop and then click Manage. The Computer Management window opens.
Windows XP. Click the Start button, right-click the My Computer icon, click Manage. The Computer Management window opens.

In the left pane, double-click Services and Applications and then select Services. A list of services appears.
In the right pane, locate the Remote Procedure Call (RPC) service.

CAUTION: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two

Right-click the Remote Procedure Call (RPC) service and click Properties.
Click the Recovery tab.
Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."
Click Apply and then OK

CAUTION: Make sure that you change these settings back when you have removed the worm

I have had it it said:

the rpcs is not responding

please save and close any programs you are using

you computer will be shut down in 00.30

then a pop-up behind it said: norton antivirus has detected a virus and has deleted it sucessfully. Even though it was too late, i had been shutdown

[img]graemlins/sure.gif[/img]

Hannah, do the thing described in my previous post [img]smile.gif[/img]

I've just received some more updated information about this:

You may have read recently that a computer virus known as MSBlast or Lovsan is affecting computers with Microsoft Windows Operating systems. This virus utilises vulnerability in the Microsoft software. Its effect is to cause computers to restart regularly. MSBlast is a type of virus known as a "worm" which does not appear to cause permanent damage but is a threat to be taken seriously.

Which computer operating systems are affected?

Users of the following operating systems could be affected: Windows XP, Windows 2000, Windows 2003, Windows NT 4.0.

Customers using Windows 95, Windows 98 or Windows ME are not affected.

What is the name of the virus?

Microsoft refers to this virus as the "W32.Blaster.Worm", but it is also known as W32/Lovsan.worm, WORM_MSBLAST.A, Win32.Posa.Worm.

How do you I avoid getting the virus?

Firstly, you should ensure that you install a Firewall application and anti virus software on your computer. A Firewall prevents unauthorised access to your computer and will prevent attack from viruses. Anti-virus software will protect you from viruses as long as you keep it up to date with the latest updates. Microsoft XP comes equipped with a Firewall - or you can download and install a free Firewall from www.zonealarm.com.

Users of the operating systems listed above, in the section 'Which computer operating systems are affected?' should enhance their software with the latest update called a "patch". The patch that will address this issue is called MS03-026. Updating your computer with this patch will remove the vulnerability and prevent this type of virus affecting you.

How do you know if your computer has the virus?

The most common symptom of the virus is that your computer will restart every few minutes, without your input. You may also find that a file called msblast.exe has been created in your computer's WINDOWS SYSTEM32 directory.

How do you know if you have the virus?

To detect this virus, search for msblast.exe in the WINDOWS SYSTEM32 directory or download the latest anti-virus software signature from your anti-virus vendor and scan your machine.

A number of software vendors are working together to overcome this virus. Additional information on this virus is available from any of the following links:

Network Associates:
http://us.mcafee.com/virusInfo/defau...virus_k=100547

Trend Micro:
http://www.trendmicro.com/vinfo/viru...WORM_MSBLAST.A

Symantec:
http://securityresponse.symantec.com...ster.worm.html

Computer Associates:
http://www3.ca.com/virusinfo/virus.aspx?ID=36265

Microsoft's Virus Information Alliance: http://www.microsoft.com/technet/security/virus/via.asp

If you get the Virus how do you remove it?

1. In order to remove this virus please follow these instructions:

Do a search for msblast.exe by using the find files or programmes command (usually found in system32 folder)
Delete it.
Click Start and select Run
Type msconfig & click OK
Select the start-up tab
Disable msblast
Reboot machine and enable your Firewall or anti-virus software. Refer to your software instructions provided to ensure that it is set up correctly.

Alternatively

Security specialists Symantec have released a tool which will remove the current infection from your computer. To download this tool, go to www.symantec.com and go to the security response section. Then click the W32.Blaster.Worm link in the latest virus threats section. This page offers more information regarding the worm, and a downloadable tool to remove it.

2. Once you have removed the virus, immediately select one of the links below to install the security patch needed to ensure no repeat infection occurs.

http://securityresponse.symantec.com...ster.worm.html

http://microsoft.com/technet/treevie...n/MS03-026.asp

If you are away from your machine or are unable to get on-line, then the above links will provide patches which are small enough to download from another PC on to a floppy disc, to install on your PC at a later date.

Janie xx

Thanx Ivana and Janie for the info i am sorted now

[img]smile.gif[/img]