----- Original Message -----
From: "McAfee Dispatch" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, August 12, 2003 5:47 PM
Subject: VIRUS ADVISORY - W32/Lovsan.worm
(((((((((((((((((((( McAfee Dispatch )))))))))))))))))))))))
[This message is brought to you as a subscriber to the
McAfee Dispatch. To unsubscribe, please follow the
instructions at the bottom of the page.]
------------------------------------------------------------
** VIRUS ADVISORY - W32/Lovsan.worm **
------------------------------------------------------------
Dear J. Stephen,
W32/Lovsan.worm is a Medium-On-Watch Internet Worm.
This worm spreads by exploiting a recent vulnerability in
Microsoft Windows. The worm scans random ranges of IP
addresses on TCP port 135. Discovered systems are targeted.
Exploit code is sent to those systems, instructing them to
download and execute the file MSBLAST.EXE from a remote
system via TFTP.
Once run, the worm creates the registry key (may be either
of the following):
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "windows auto update" = msblast.exe
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "windows auto update" = msblast.exe I
just want to say LOVE YOU SAN!! bill
Indications of Infection
- Presence of unusual TFTP files
- Presence of the file msblast.exe in the WINDOWS SYSTEM32
directory
- Error messages about the RPC service failing (causes
system to reboot)
IMPORTANT SECURITY NOTE: Up-to-date McAfee VirusScan users
are protected from this threat. For dial-up connections,
we also recommend McAfee Personal Firewall Plus. An extra
layer of protection, it helps render your system invisible
to malicious code and break-ins like Lovsan.
Learn More about W32/Lovsan.worm:
==> http://us.mcafee.com/root/campaign.asp?cid=8340
Scan for W32/Lovsan.worm:
==> http://us.mcafee.com/root/campaign.asp?cid=8341
Subscribe to Personal Firewall Plus
==> http://us.mcafee.com/root/campaign.asp?cid=8350
____________________________________________________________
If you would like to receive the McAfee Dispatch in a
graphical (HTML) format in the future, please click here.
==> http://us.mcafee.com/root/campaign.asp?cid=8249
______________________Special Offers________________________
Subscribe to a full year of VirusScan Online for just $34.95
and get SpamKiller free*! Learn More...
==> http://us.mcafee.com/root/campaign.asp?cid=8241
* After $30 mail-in rebate.
------------------------------------------------------------
SpamKiller stops spam from polluting your inbox. SAVE $15,
now only $24.95. Get only the email you want and nothing else!
Learn More...
==> http://us.mcafee.com/root/campaign.asp?cid=8242
________________________Virus Fixes_________________________
VirusScan Online
The #1 anti-virus solution online. Protect your PC from
viruses and receive FREE automatic updates.
Is your protection current?
==> http://us.mcafee.com/root/campaign.asp?cid=8243
Subscribe to VirusScan Online
==> http://us.mcafee.com/root/campaign.asp?cid=8241
VirusScan 7.0
Stop viruses, trojans, worms, and more. Now includes enhanced
McAfee Firewall protection to keep hackers out of your PC.
Update DAT file
==> http://us.mcafee.com/root/campaign.asp?cid=8245
Purchase VirusScan 7.0
==> http://us.mcafee.com/root/campaign.asp?cid=8244
Upgrade Center
==> http://us.mcafee.com/root/campaign.asp?cid=8246
Personal Firewall Plus
Your Defense Against Hacker Attacks! See when someone is
trying to hack your system. Then track and report hacker
activity.
Subscribe to Personal Firewall Plus
==> http://us.mcafee.com/root/campaign.asp?cid=8350
Download a set of FREE security tools and also receive trial
versions of our world-class security services. Learn more...
==> http://us.mcafee.com/root/campaign.asp?cid=8247
Product Recommender! Find the right product for you,
click here.
==> http://us.mcafee.com/root/campaign.asp?cid=8248
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[ You are currently subscribed as: [EMAIL PROTECTED] ]
Please feel free to forward this dispatch to any interested
friends, family and associates.
Subscribe: If you received this message from a friend and
would like to subscribe to eSecurity News, virus alerts and
special offers, click here.
==> http://dispatch.mcafee.com/us/sub.asp
Unsubscribe: If you prefer not to receive future email from
McAfee, please click here.
==> http://dispatch.mcafee.com/us/unsub.asp
Need further assistance? Visit McAfee Support.
==> http://us.mcafee.com/root/support.asp
Click here to view our privacy policy.
==> http://us.mcafee.com/root/campaign.asp?cid=8207
McAfee is a business unit of Network Associates, Inc.
3965 Freedom Circle, Santa Clara, CA 95054, (408) 992-8599
� 2003, Networks Associates Technology, Inc. All Rights Reserved.
