Re: Blasting Blaster.Worm (aka LovSan Virus)

Check the clock on the affected user's computer. If it's set in the future, the worm may well have triggered, thinking that August 16th was already here.

Also check for other malware. Since 135 was open, it's quite likely that the computer is vulnerable to other sploits.

As previously suggested in this forum, please read the Symantec analysis at https://tms.symantec.com/members/AnalystReports/030811-Alert-DCOMworm.pdf.

To inhibit propagation of the worm to/from your network, block the following ports at (at least) all of your border routers (in/out), and preferrably (to inhibit infection within your netowkr) on your interior routers as well:

• Close port 135/tcp (and if possible 135-139, 445 and 593)
• Monitor TCP Port 4444 and UDP Port 69 (tftp) which are used by the worm for activity related to this worm.

More details are available from the CERT advisory at:

        http://www.cert.org/advisories/CA-2003-19.html

--Lloyd Taylor
  VP Technology & Operations
  Keynote Systems

On Tue, 12 Aug 2003, Alavan wrote:

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

> Date: Tue, 12 Aug 2003 12:40:43 -0700
> From: Alavan <alavan@pangeatech.com>
> To: incidents@securityfocus.com
> Subject: Blasting Blaster.Worm (aka LovSan Virus)
>
> All,
>
> We're a small ISP providing T-1 access to residents of apartment

-- 



---------------------------------------------------------------------------
----------------------------------------------------------------------------