www.elektronik.si

[frenki]

Tole je zelo sveže, zato v originalni obliki
------------------------------------------------
F-Secure Virus Descriptions
Alphabetical Index

NAME: Lovsan
ALIAS: MSBlast, Poza
SIZE: 6176

F-Secure is currently analysing a new RPC worm, known as Lovsan. First sample of this worm was received at 20:22 GMT on 11th of August, 2003.

This 6176 byte executable "msblast.exe" contains about 11kB of uncompressed code, which apparently exploits the MS03-026 DCOM/RPC hole,"Buffer Overrun In RPC Interface", http://www.microsoft.com/technet/security/bulletin/MS03-026.asp This vulnerability was discovered on July 16th, 2003.

The worm adds a key called "windows auto update" to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm contains these texts:

I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!

Apparently the worm will start a distributed denial-of-service attack against the windowsupdate.com server on 15th of August, 2003.

[frenki]

Danes bo moj firewall po***dil od zavračanja zahtev po portu 135. Torej, če je kdo brez požarnega zidu naj si tole zgoraj kar dobro prebere. Izgleda, da je aktiven kot hudič .