links to descriptions, scanning and removal tools for blaster/lovesan worm:

http://www.eeye.com/html/Research/Advisories/AL20030811.html
http://www.eeye.com/html/Research/Tools/RPCDCOM.html
http://isc.sans.org/diary.html?date=2003-08-11
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
http://support.microsoft.com/?kbid=823980
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp
http://www.secadministrator.com/Articles/Index.cfm?ArticleID=39837
http://www.counterpane.com/alert-v20030801-001.html
http://www.iss.net/support/product_utilities/ms03-026rpc.php
http://support.microsoft.com/default.aspx?scid=kb;en-us;823980
http://support.microsoft.com/default.aspx?kbid=826369

additional tidbits:

- if you are experiencing the shutdown problem associated with this issue, open a command prompt window and type shutdown /a. you may be able to abort the shutdown process. this only works on windows xp or win2k w/resource kit.

- you may be able to prevent a failing rpc service from rebooting your machine by changing the service properties. navigate to start / control panel / administrative tools / services / Remote Procedure Call RPC, right-click and select Properties / Recovery. change the failure response to something else than reboot the computer.

==============================================================

there is another piece of malware out there since 8/2 that also takes advantage of the rpc vulnerability and installs an existing backdoor mechanism. this one is a trojan, not a worm, and is a separate threat / NOT related to the blaster/lovesan worm!

http://www.viruslist.com/eng/viruslist.html?id=61506
http://news.com.com/2100%2D1009%2D5059263.html
http://www3.ca.com/virusinfo/virus.aspx?ID=36115
http://www.datafellows.fi/v-descs/rpc.shtml

if your machine has been rooted by use of this backdoor, then the only safe method of recovery is a clean install.


once again, the lesson learned is: visit the windows update site regularly and install all critical updates immediately! alternatively, use the automatic windows update feature to automatically download all critical updates, or at least subscribe to microsoft's security notification service at http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/notify.asp.

if you don't trust the critical updates, get yourself drive imaging software such as acronis true image and make a drive image before installing the critical update. alternatively, windows xp offers the system restore feature in case something goes wrong.

the only reason why worms like this one can propagate is due to user ignorance. properly patched systems are not affected.

Bumping this up because we've already had a few people with the problem.

Mickster just posted a web site to help out those people and i am just passing this along in case they do not read that post... http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp

PWRGURU

The patch is on that page also.

applied the patch as it sounded less scary.

will keep you all posted.

sophie

21 minutes and no shut down yet.

this may be it!

Based upon the number of posts today here alone on this subject, seems like for the majority of users out there Shelly has it correct.


<http://www.pcqanda.com/dc/dcboard.php?az=show_topic&forum=2&topic_id=242888>
"You were correct to install the critical updates, all "rules" should be broken under certain circumstances, and security is one good example."


Wonder what the commonality is between the various people who have just gotten this worm is. Ok, a port scanner & lax security?

That's not the same thing as this is it?

http://www.washingtonpost.com/wp-dyn/articles/A46233-2003Aug11.html

because I didn't see any mention of the alias "san" on the sites mentioned above. I also didn't find any support for a virus that goes by "blaster" and "san" on the Symantec website. Any news on this?

Alex's first post has the Symantec Removal Instructions link. Here's the link again.

http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html


Tufenuf

http://www.internettrafficreport.com/main.htm

Am I correct in understanding that this does NOT apply to 98?

>Am I correct in understanding that
>this does NOT apply to 98?


Correct.

Systems Affected: Windows 2000, Windows XP from this link:

http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

marti

According to my German providor, T-Online, the worm is a danger for NT4, 2000 and XP.

All flavors of NT.

Shelly

Shelly,

I've just downloaded the patch from microsoft for the blaster worm and all seems fine with my computer. Just wondering if it is recommended to download the "removal tool" even thought I don't believe I am infected; to have it just in case so to speak??

Thanks,

Adirondack Girl

it doesn't hurt anything to run it. all it takes is a few minutes computing time. if you want to be safe and have peace of mind, by all means, go ahead.

Paul, I'm sure that this only affects Win NT, 2K and XP. BTW thanks to the Gurus I've succeeded in getting rid of the Worm/Virus whatever. There have been some repercussions however. I did all the good things as per Alex's piece, but there remain some registry entries that keep coming back after reboot. They are in H_KEYUSERS/Software/Microsoft/Searchassistent/ACmru/5603/Defaultreg_SZ......They are as follows Lovsan, Start %s, windowsupdate.com, BILLY, and msblast. I've tried to rename them, but they come back, so I guess they're in the MBR. Any ideas please, apart from a clean install, that my friend is hesitant to do??? AVG puts up a screen that says it's detected the virus, but when you run, it finds nothing. As far as I can tell the system seems to be working OK apart from that. Any ideas please, and thanks in advance !!!
Sincerely,
Richard.
Website http://www.mvessexgirl.com
Athlon XP2600, MSI K7N2 Motherboard with onboard sound, 1x 30Gb 1x 80Gb hdds, , Toshiba DVD,NEC DVD+RW, 1Gb DDR RAM,GeForce 128Mb video card, 450w PSU, OneTouch8600 scanner, Win XP Pro.
“It’s nice to be important, but it’s important to be nice”

http://www.worldcommunitygrid.org/getDynamicImage.do?memberName=oldgit&mnOn=true&stat=1&imageNum=3&rankOn=false&projectsOn=false&special=true" frameborder="0" name="di" scrolling="no" width="125px" height="176px">

Microsoft wrote the patch specifically for W2K SP2 and SP3, but because SP4 shipped prior to the patch being released, said it was supported only on the current and N-1 SP (SP3 and SP4). Its taken them 27 days to officially say it will work on a platform they designed it for, SP 2.

Mostly cut and paste from NTBugTraq, but something I've been trying to beat over the head of several coworkers here. It does work for Win2K SP 2.

Can I just use a system retore point prior to the date of infection and then install the MS patch and update my NAV definitions?

Thanks

There are also a few interesting threads on our own Board about all this. Here are a few:

http://www.pcqanda.com/dc/dcboard.php?az=show_topic&forum=2&topic_id=243393&mesg_id=243393&page=2

http://www.pcqanda.com/dc/dcboard.php?az=show_topic&forum=2&topic_id=243373&mesg_id=243373&page=

http://www.pcqanda.com/dc/dcboard.php?az=show_topic&forum=2&topic_id=243379&mesg_id=243379&page=3

It shutdown our domain within 30 minutes yesterday afternoon. The servers that I support already had the patch, but majority of the others did not. Not to mention the 10000+ clients that needed patching. You can guess that amount of headaches going on around here today.

Direct download for the patch...If you don't already have it.
To check, go to Control Panel Add\Remove Programs, and look for Hotfix KB823980.

http://www.microsoft.com/security/incident/blast.asp

My friend got the worm and i figured i could find information on this site. PC Q and A rules!
Soccerace

512MB DDR 333 RAM
AMD 1.6 Ghz processor
128 R-9000 graphics card
60gig harddrive
Windows 98se

Hi, I'm still having trouble with my computer after deleting the blaster worm. I used the symantec exe to get rid of the worm, but I'm still having internet connectivity issues: I can log on thorugh my dsl modem but I can't load any pages or ftp or anything. Plus, my virus scanner (McAfee) still crashes out unless I'm in safe mode. Anybody have any suggestions?

AMD 1900
Win2000

Don't know what the Symantec fix might have done to your McAfee virus, unless it decided to delete it, too. Makes sense, in a way. I'd suggest going to McAfee site and get the instructions for deleting it and then install a good AV, or reinstall McAfee. (Affectionately known as McCrappy. )

Thanks..

Latest Microsoft information and fix: What You Should Know About the Blaster Worm.

AMD Athlon64 3000+, MSI K8T Neo-FSR, Corsair CMX512-PC3200C2, Windows XP Pro, High-Speed AOL Plus!

Looks like this might be what hit me today, but it's not checking out that way.

When I first came home, had black screen saying that it couldn't find a boot file, install disk and hit any key.

After checking out bios my primary hard drive was not showing, and I couldn't make it show. Went into Fdisk and it wasn't there either.

I changed out the cable and it booted and I say hooray and walked out of the room. Came back five minutes later to see it boot again. Uh oh...

I went into safe mode to see what I could see.

I'm on a home network with a router, WinXP Home, AOL broadband which I'm told works as a VPN. I have all XP updates as of two days ago, and Norton AV 2003 updated as of yesterday with a full system scan.

Right now I'm using the blast tool, but Norton already said I didn't have any virus problems.

I followed Alex's direction and went into processes and changed it from rebooting, but I've not finished with the tool yet.

If it's not Blaster what else can I try? thanks

After much playing, I was able to get it to boot up and stay booted. But all my personal preferences are gone - email, etc. I can see my name in documents and settings, but there is another me in there also.

But there is only one name as user so I'm very confused. It's late and I'm wiped..I'll start another thread tomorrow.

I'm not convinced that this was caused by a virus/worm.

"A flaw in Windows Update caused some organisations - including the US Army - to wrongly believe they were protected from MSBlast, according to a researcher.

A flaw in Windows Update -- Microsoft's online tool that lets customers update their operating system with patches and fixes -- enabled the MSBlast worm to infect computers that apeared to have already been patched, according to a security expert."

http://news.zdnet.co.uk/0,39020330,39115732,00.htm