"LoveSAN" or "MSBlaster"

sharkbyte · Posted: Tue Aug 12, 2003 1:47 pm Post subject: "LoveSAN" or "MSBlaster"

For those of you that haven't heard, or didn't think there was an issue...Nanite and I have been dealing with this issue most of the day...

The following articles are very informative. The CNN article provides information on getting the patch.

Please read it and update your system, if necessary.

http://itmanagement.earthweb.com/secu/article.php/2247791

http://www.cnn.com/2003/TECH/internet/08/12/windows.worm/index.html

Assuming I didn't miss it, and this is the first post on this, maybe someone could make this a sticky...
_________________

The Nanite · Posted: Tue Aug 12, 2003 1:49 pm Post subject:

Aye, updating with the patches from WindowsUpdate is the best way but it's extremely congested at the moment and is incredibly slow. If you have routers that you are working through you can block port 135, while this will solve the problem it will also block all RPC traffic.
_________________

N|kamichi · Posted: Tue Aug 12, 2003 2:43 pm Post subject:

Yah, thanx for the heads up.
_________________
Don't take life too seriously, no one makes it out alive.

Stevo · Posted: Tue Aug 12, 2003 5:10 pm Post subject:

No critical updates for me. I guess I already have the patch...
_________________

The Official TVR Website
Fopp
Song of the Week

Vulcan · Registered User Joined: 29 Dec 2001 Posts: 2773

Stevo · Posted: Tue Aug 12, 2003 5:20 pm Post subject:

Vulcan · Registered User Joined: 29 Dec 2001 Posts: 2773

Replica · Posted: Tue Aug 12, 2003 5:27 pm Post subject:

damn me and upgrading to Xp pro... coudl ahve kept ME and avoided a few minutesa of work to endure hours of misery
_________________

sharkbyte · Posted: Tue Aug 12, 2003 7:47 pm Post subject:

Just an update...

The traffic on Microsoft's site appears to be thinning out. It only took about a minute to get to the actual page to check for updates. http://windowsupdate.microsoft.com

Also, be aware that you might not be as up-to-date as you think. My non-everyday computer needed 23 updates, while my everyday one needed 14.

It is easy to forget to check for updates...and it will eventually cost you dearly.
_________________

Replica · Posted: Tue Aug 12, 2003 7:56 pm Post subject:

for now, how do i disable the port and what will it do?
_________________

The Nanite · Posted: Tue Aug 12, 2003 8:04 pm Post subject:

Disabling the port depends on what type of router you have, which would be?
_________________

Simpleman · Posted: Tue Aug 12, 2003 8:32 pm Post subject:

My firewall has blocked the same addy's on port 135 like 100 times since yesterday

DCE endpoint resolution

sharkbyte · Posted: Tue Aug 12, 2003 9:44 pm Post subject:

DaKon · Ville Supporter Joined: 19 Feb 2002 Posts: 2342

A good SW firewall works good (Norton Roxor). They identified the attack and prevented it at the same time with current updates as of the attack beg.

Also most HW Firewalls will kill that port acess into you sys and pay them a visit with a tracert and a block of all associated IPS

DK
_________________
P4E @ 4.00 Ghz, LeadTech 6800GT 420mhz/1.16Ghz, 1 gb Corsair PC 4400, Creative X-fi, Raptor

Simpleman · Posted: Wed Aug 13, 2003 12:47 am Post subject:

I have McAfee t works well