Who else has been affected by this computer virus?

[Lorix2]

I did the 32 edition - no real reason behind it.

 

[kbeverina]

Miss Jasmine, I think most people have 32 bit. Also, I have dsl, I don't know if that makes a difference between what I had to do and what cable or dial-up have to do. Again--complete computer idiot.

 

[Lorix2]

HERE'S WHAT I FOUND THIS MORNING
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Internet Infection Hits Thousands Of Computers

POSTED: 6:47 a.m. EDT August 12, 2003

WASHINGTON -- Researchers say tens of thousands of computers have been hit by a virus-like infection.

It's being called "LovSan" or "Blaster."


PERSONAL VIRUS PROTECTION
Free Microsoft Patch
Download Virus Definitions
Virus Removal Tools
Securities Update Vault
REMEMBER: Don't open e-mail attachments that end in .vbs or othe unfamiliar extensions. Even if the e-mail appears to come from a trusted source, it could be someone "spoofing" an address. Confirm it's from who you think it's from before you open.




The outbreak of the computer virus-like infection prompted government and industry warnings Monday. The virus spread rapidly across the Internet, causing computers to mysteriou slyrestart and coordinate an electronic attack against Microsoft.

Security experts say the infection exploited an unusually dangerous flaw in Windows software.

The infection left a note behind on vulnerable computers that read "I just want to say LOVE YOU SAN!" A second message taunting Microsoft Chairman Bill Gates stated "billy gates why do you make this possible? Stop making money and fix your software!"

Researchers reported tens of thousands of infected computers inside universities, businesses and homes. Infected computers were programmed to automatically launch an attack on a Web site operated by Microsoft on Saturday.

Security experts say the infection isn't seriously disrupting Internet traffic but poses that risk as it spreads.

Government and industry experts have anticipated such an outbreak since July 16, when Microsoft acknowledged the flaw affected nearly all versions of its Windows operating system software.

Microsoft offers a free patch on its Web site to protect Windows users vulnerable to infections because of a program flaw.

Antivirus company Symantec has developed a tool to clean a computer that has been infected by the worm.

The Microsoft flaw affects Windows technology used to share data files across computer networks. It involves a category of vulnerability known as "buffer overflows," which can trick software into accepting dangerous commands.


On the Net:


Network Associates
Symantec
Microsoft Warning
Government Warning
Copyright 2003 by The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or

 

[kbeverina]

Here's a link to another message board discussing this--if you browse around in there, there's another board talking about viruses, trojans, etc. that discuss it:

http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi?;act=ST;f=18;t=4907

 

[LarryE]

it doesnt per say "come" through the net to your computer

the virus is a worm that searches for security exploits in windows machines.

as long as you run windows update and have all the security patches you will be fine and dandy..

if you have it and are having trouble getting windows to stay open long enough to run the antivirus boot into safe mode and run it from there

 

[KimRaye]

It appears by brother got this worm and, he called me (LMBO) for help. Like I know anything.....so, I came here and, VOILA! I helped him find some things to rid his computer of this nasty little thing!

Just wanted to thank all of you who posted! Especially the 'safe mode' tip, helped him stay on line long enough to follow the rest of the instructions!

 

[catsrule]

I haven't had any problems, but at work, the agents laptops all over the country got hit. Didn't hit the home office though. It is a mess......

 

[kbeverina]

Here's an article from the Washington Post with more information on getting rid of it:

A computer running the Microsoft Windows XP, Windows 2000 or Windows NT 4.0 operating system that is infected with the "Blaster" worm will either slow significantly as the worm searches for other vulnerable systems or display a pop-up warning that it will restart in 60 seconds.

After it restarts, the restart warning and reboot are likely to repeat, the result of the worm attacking a program that the computer's operating-system needs.

To fix the problem on a computer running Windows XP, experts at Atlanta-based Internet Security Systems Inc. say:

• Stop the reboot loop by pressing the Ctrl, Alt and Delete keys simultaneously. Then search for a file in the pop-up "applications" list that will appear called "msblast.exe." Click on the "msblast.exe" file name and then click on "End Task" to stop the worm from running.

• Use the computer's search program to find the culprit file -- msblast.exe -- on the hard drive. To do that, click the "Start" button on the lower left corner of your screen, then "Search." That will bring up a search box.

• Choose the option to search all files and folders. Once the search prompt opens, enter the search term "msblast.exe." Delete any matching files, then empty your recycle bin.

• Turn on the firewall software included in Microsoft XP. From the Start menu, click on the "Connect To" menu, then select "Show all connections." Select the first icon you see there, right-click it and select "Properties." Click the "Advanced" tab, the last one on the right, and check the box next to "Internet Connection Firewall." Repeat this step for each icon in that connections window.

• Download the Microsoft software fix to protect your computer against the Blaster worm from the Web site windowsupdate.microsoft.com.

• Unplug your Internet connection. Restart your computer. Once the computer is fully rebooted, reconnect it to the Internet.

• If you have not been keeping up to date with patches from Microsoft, go back to Windows Update and let Microsoft scan your computer for other critical updates. Download and install all of those listed.

• Make sure anti-virus software is installed, and update virus definitions.

 

[Lorix2]

kbeverina - thanks for posting this info, I found this earlier on our local news page and did this. I was surprised to find the "msblast.exe" still there after all the 'washing' I did yesterday.

 

[mom2boys]

My boys' computer is fine. That's what I've been using for a the past 3 weeks because my office computer won't keep an internet connection. I finally broke down & updated their antivirus protection & have been downloading updates. I too received a "critial" update notice about windows vunerablility a while back. I did download it but at the time I thought it was unneccesary. Glad I installed it.

 

[piratesmate]

DH told me about this yesterday after work. Evidently, this virus/worm has a "bug" of its own. (Sorry - I find that really funny!) Evidently it doesn't always replicate itself properly - DH's workstation is running XP & got hit with the rest of the company. They were all told to disconnect from the network immediately. While waiting for them to fix it, DH started running a virus check - no virus (he had new definitions from Monday). He still couldn't use his system w/o getting the "remote service call" problem - so he HAD the virus!

He got it fixed by using dial-up (instead of the network) to download the patch & fix.

 

[December99]

We didn't have computers rebooting themselves but we did end up with other errors and it appeared to really hit the excel registry (we couldn't open or do anything in excel) and also was hitting a piece of the Word registries. One registry is hit so make sure you get a message after doing the tool that it next to the registry is a number 1. You might have more than one that got hit but it needs to at least have one or you have other problems.

Out of 27 computers I've just completed patching 18 of them including cleaning two that were hit. It really was causing us some probs!!!!

Ah...and a good point to bring up - your virus software might not be able to catch this one.

If you want to know if you have the virus do Ctrl Alt Delete ONCE and you should get a box (this is if you have Windows2000 or XP as far as I know) and click on TASK LIST. Then click on Processes and under processes click on Image Name (that will sort the list in alpha order descending. Look to see if you have this in the list - MSBLAST.exe. If you do - then you have the virus. Some of our machines didn't have the virus but were having the same "sickness symptoms" as the machines that were infected had.

Hope this helps some

 

[Harambe]

Boy - this is scary stuff for us computer dummies! I did the patch thing yesterday - since I have DSL thru Verizon, I went to their website and they explained the worm and had the Microsoft patch file on their site.

Today I bought and installed ZoneAlarm Pro to give my security a boost - and the first file it filtered coming into my computer - msblast!!!!!! I'm going to go back and do the search for this on my hard drive. I haven't been kicked off since I ran the patch, but I guess it is still in my computer!

 

[~Sparkly~Zoe]

Does this also cause the "internet explorer has encountered a problema nd needs to shut down" etc, etc, etc.
That has been happening a lot this past week! I know that my windows is updated and so is my virus protection and I have that firewall thingy already done.
I just checked for the msblast thing and it's not in my computer.

 

[phamton]

No problem at home as we have 5 Macs and no Windows, but I was trying to change my phone plan with Cingular wireless and their computers were all going down. She told me to call back this evening and try again.

Bev

 

[kbeverina]

Originally posted by Harambe
Boy - this is scary stuff for us computer dummies! I did the patch thing yesterday - since I have DSL thru Verizon, I went to their website and they explained the worm and had the Microsoft patch file on their site.

Today I bought and installed ZoneAlarm Pro to give my security a boost - and the first file it filtered coming into my computer - msblast!!!!!! I'm going to go back and do the search for this on my hard drive. I haven't been kicked off since I ran the patch, but I guess it is still in my computer!

Harambe--simply downloading the patch did not work for me because I had not turned on the firewall that comes with XP. I have Verizon DSL, too, but I'm not sure that really matters. You might want to check that the firewall is enabled--it's in the article I posted earlier. As soon as I turned on my firewall, it blocked the hits.

Lorix2--the same thing happened to me--it was explained to me that the anti-virus software doesn't pick this up because it's a trojan.

 

[kbeverina]

Originally posted by ~Sparkly~Zoe
Does this also cause the "internet explorer has encountered a problema nd needs to shut down" etc, etc, etc.
That has been happening a lot this past week! I know that my windows is updated and so is my virus protection and I have that firewall thingy already done.
I just checked for the msblast thing and it's not in my computer.

If you're still having problems on that spybot site I posted earlier they were telling people how to run logs and post them and then they would help them figure out what's wrong.

 

[Diane]

Thanks, everyone, for the info! I had the virus and didn't even know it. I think I'm okay now.

 

[Tuffcookie]

I cannot believe my luck!!! Oldest DS had been after me for ages to get McAfee virus scan so I finally subscribed to it, get this, on 8-4! I also got Firewall plus. I downloaded and installed all the updates on microsoft's web site and, per December 99's instructions, just checked my computer. NO VIRUS!!!! Hurray!!!!

TC

 

[KathyTX]

PLEASE make sure you've installed the Microsoft patch KB823980 for Windows 2000 or Windows XP, described in Microsoft bulletin MS03-026. You can link to the patches from this Microsoft location. (Win 95 and Win98 are not affected and do not have patches. Win2000, WinXP, NT 4.0 and Win2003Server are affected and do have patches.)

We expect other worms to circulate soon that will exploit this same security hole, so patch now to prevent being part of the next wave of problems!

Install and KEEP UPDATING a good virus scan software (McAfee and Norton are the most commonly used ones.) These guys publish updates to their virus scan data files weekly, and you MUST set up to get these updates for the software to be effective. The data files for the Lovesan/Blaster worm were not available until Monday or Tuesday of this week, so anyone who hadn't updated immediately was not protected. The $30 or so that the virus scan software will cost you annually is good insurance.

If you did get hit with the worm, you need to (A) install Microsoft's operating system patch to prevent getting hit by this or similar problems again, and (B) run a CURRENT and UPDATED virus scan to remove it from your machine.

If you were lucky and didn't get hit with the worm this time, you STILL need to do these two things!

(I've spent the past couple of days at work taking care of this. It could have been pretty bad...)