RE: Hit by LoveSan/Blaster ? -- PCTECH

>I am curious if any of the various anti-virus programs successfully stopped
it?

Below is a copy of a letter I received 8/16 from NAI (McAfee), the vendor of
our enterprise av package. If you want to cut to the chase on av-specific
response read the paragraph titled "McAfee VirusScan(R) Anti-Virus
Software."

I had no hits. However MS announced the patch sometime in advance and I was
able to push it out to my desktop and server boxes. The ports mentioned in
the press were closed anyway. 

Best,

Alan

P.S. While McAfee offered a downloadable search/extraction tool I found the
one at Symantec preferable. They both worked fine though.

==========================
This past Monday, many of our customers were exposed to an attempt to
exploit a vulnerability in some versions of the Microsoft Windows operating
system. This vulnerability, referred to as MS03-06 was something that we
initially told you about a little more than two weeks ago. Since that time,
the vulnerability has been exploited and an active worm exists (W23/Lovsan
worm). Any vulnerable Windows desktop or server connected to the Internet
may be open to an attack. By exploiting the RPC vulnerability in Windows,
the worm is able to execute (without requiring any action on the part of the
user) and could potentially crash machines, causing downtime and continue to
spread to vulnerable computers for further propagation. This worm is still
moving aggressively across the Internet. We're making sure you are
protected.

The McAfee Protection-in-Depth Strategy
The McAfee(R) Protection-in-Depth(TM) Strategy delivers the industry's only
complete set of system and network protection solutions differentiated by
intrusion prevention technology that can detect and block the
W32/Lovsan.worm before it can cause damage to systems and networks. With the
core components of the McAfee Protection-in-Depth Strategy, customers can
take immediate steps to identify and resolve occurrence of the LovSan worm.

McAfee System Protection Solutions
McAfee ThreatScan 
The latest ThreatScan(TM) signature (2003-08-12) includes detection of the
W32/Lovsan.worm virus. This signature is available for ThreatScan v2.0,
v2.1, and v2.5. By using ThreatScan customers can detect incidents of the
LovSan worm.

Network Associates Stinger Tool
An update has been made available to the Stinger tool so that customers can
stop further infection of desktop PCs, download the required Microsoft
software patches and re-establish the security of infected desktop systems.
This is a no-cost tool available through the Network Associates web-site.

McAfee Desktop Firewall
McAfee Desktop Firewall would block access to TCP port 135 if no legitimate
applications where defined to make use of the port, and would have prevented
the worm from opening TCP port 4444.  This would prevent infected systems
from further propagating the worm.  Even if the worm had been executed by a
unsuspecting user (received for example, in email) the worm would not have
been able to connect to any remote computer system, in effect isolating the
infected computer on the network.

McAfee Entercept System Intrusion Prevention
McAfee Entercept(R) stopped the W32/Lovsan.worm before it was a known
threat/attack. The McAfee Entercept solution provides patented protection
against exploitation by code execution as a result of buffer overflows,
protecting the integrity of the server. This protection functions whether or
not the server has the latest security patch installed. The McAfee Entercept
solution and its patented technology safeguards servers against buffer
overflows, without any signature or code updates. 

McAfee VirusScan(R) Anti-Virus Software
McAfee Anti-Virus solutions protected against W32/Lovsan.worm before it was
even discovered. W32/Lovsan.worm exploits the MS03-026 vulnerability, and
McAfee anti-virus solutions with signatures updated since August 8, 2003 are
able to detect a variety of threats containing code that attempts to exploit
that vulnerability. By scanning files as they are saved to disk, downloaded
through the Internet gateway, or as they pass through the e-mail server,
McAfee anti-virus solutions can detect and eradicate W32/Lovsan.worm from
your environment.


McAfee Network Protection Solutions
Sniffer Distributed and Sniffer Portable Software
Sniffer(R) Technologies filters can be used to alert managers to the
presence of the malicious worm exploiting the Microsoft RPC buffer overflow
vulnerability. Sniffer Technologies filters for Sniffer Portable and Sniffer
Distributed, can identify the Lovsan.worm used to exploit Microsoft RPC
vulnerability and to monitor traffic on TCP port 135. 

McAfee IntruShield Network Intrusion Prevention
McAfee IntruShield(R) can both detect and block W32/Lovsan.worm, stopping it
before it even reaches the targeted host computer. Users that have updated
their systems with signature set 1.5.9.3, released on July 22, 2003, are
fully protected from this worm. Users who have not yet updated their systems
will be notified of suspicious activity via the McAfee IntruShield anomaly
detection engine. Users who have not updated should do so immediately.

InfiniStream Security Forensics
InfiniStream(TM) Security Forensics mining capabilities can accurately pin
point the infected machines, and the source of infection, reducing mean time
to resolution and the chances of reoccurrence. Furthermore, as the new
variants of the worm are introduced, InfiniStream enables customers to
rapidly isolate destructive email payloads for verification through the
WebImmune online virus scanning system.

We're Here to Help
Our legacy is built on helping our customers protect their business by
protecting the security and availability of the technology that powers it.
As part of our McAfee Protection-in-Depth Strategy, we offer a full range of
emergency services that complement the technology solutions identified
above. 

To help you, we've documented all the steps to resolve this issue on our web
site at www.networkassociates.com. 

To receive more information about this threat and a custom solution please
click here:
https://secure.nai.com/us/forms/registration/survey.asp?code=ne269.


Regards,

Network Associates Sales

-----Original Message-----
From: Booth Martin [mailto:Booth@xxxxxxxxxxxx]
Sent: Tuesday, August 19, 2003 2:46 PM
To: pctech@xxxxxxxxxxxx
Subject: Re: [PcTech] Hit by LoveSan/Blaster ?


hit but not hammered. That was the first virus on my own machine I've ever
had cause disruption.
 
I am curious if any of the various anti-virus programs successfully stopped
it?
 
 
 
---------------------------------------------------------
Booth Martin http://www.MartinVT.com
Booth@xxxxxxxxxxxx
---------------------------------------------------------
 
-------Original Message-------
 
From: PC Technical Discussion for iSeries Users
Date: Tuesday, August 19, 2003 1:37:33 PM
To: pctech@xxxxxxxxxxxx
Subject: [PcTech] Hit by LoveSan/Blaster ?
 
Hi Folks,
 
Thought I subscribed to this the INSTANT David announced it but guess not J
So how many of you got hammered by LoveSan/Blaster ?
Chuck
 
 
 
 

_______________________________________________
This is the PC Technical Discussion for iSeries Users (PcTech) mailing list
To post a message email: PcTech@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/pctech
or email: PcTech-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/pctech.


=== [ KI (USA) Corporation - http://www.kiusa.com ]
====================================== 
Tel. 859.986.1420  --  Fax. 859.986.1485 
This e-mail, including any attachments, contains information from KI (USA)
Corporation that may be confidential or privileged. Mail is intended only
for those to whom it is addressed. If you are not the intended recipient do
not copy, distribute, or take any action in reliance on the contents of this
message. 
If you have received this e-mail in error notify the sender immediately then
delete or destroy all electronic and hard copies of this communication,
including attachments. 
KI (USA) Corporation's anti-virus system checks for known viruses. However
you are advised to run your own virus check before opening any attachments
received. KI (USA) Corporation will not accept any liability once an e-mail
and/or any attachment is received. 
Views expressed in the e-mail are those of the author and not necessarily
those of KI (USA) Corporation. 
============================================================================