Alias: W32/Lovsan.worm, W32.Blaster.Worm,
WORM_MSBLAST.A
This is a Trojan that will allow a hacker access to your
computer. After August 15th this program (Trojan) will begin
a denial of service attack on http://www.windowsupdate.com
You can use this link in order to scan for updates for windows
as well.
There is a critical update to plug up the security hole that the
hacker utilizes to access your computer. You can download it
from Microsoft. Check the Security Bulletin here:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/MS03-026.asp.
The following websites have MUST read information AND
the link to the critical update patch:
http://www.sophos.com/virusinfo/analyses/w32blastera.html
(Sophos does not have an update at the time of this posting.)
NORTON does have an update available, however you will
need to download and install manually. The instructions are
at the website:
http://www.sarc.com/avcenter/venc/data/w32.blaster.worm.html
Trend Micro (Pc-Cillian does have an update available):
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST
.A
Housecall (online up to date free scanner):
http://housecall.trendmicro.com/
McAfee does have dat file available:
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100547
This worm will execute every month (from Trend Micro): a..
On the 16th to the 31st day of the following months:
a.. January
b.. February
c.. March
d.. April
e.. May
f.. June
g.. July
h.. August
a.. Any day in the months of September to December
Please visit and READ the information provided and
download the critical update from Microsoft. Always read the
documentation BEFORE installing anything as each
computer is different. It does not matter if you access the
Internet by dial-up, DSL or Cable, online hackers could care
less how you got there.
Sven Swanson, Sr.
Date: Tue, 12 Aug 2003 07:06:45 +0800
From: Greg De Guzman <[log in to unmask]>
Subject: Virus or what?
I'm troubleshooting a friend's computer that started behaving erratically
that shows a pop-up after about 5 minutes that says "windows is shutting
down due to a ____ terminated process". The pop-up starts a timer within
itself after which the system re-starts. This process repeats itself
ad-infinitum everytime the computer re-starts.
I thought of peeking through the start-up list and see what the system was
loading and looked for unfamiliar programs. One entry caught my attention,
and it is "msblast.exe". I did a search from the computer's Start Menu for
the "msblast.exe* and it found the ff:
c:\Windows\System32\msblast.exe
c:\windows\Prefetch\MSBLASTEXE-09FF84F2.pf
Deactivating the "msblast.exe" from the Start-up List stopped the process.
What are these files? Are these Virus Payloads? Nothing was detected through
the Norton AV installed with a Virus Definition dated 6/27/03 after
repeating the Scan.
Thanks for any inputs.
Curious about the people moderating your
messages? Visit our staff web site:
http://freepctech.com/staff.shtml
|
