Posted on Wednesday, August 13, 2003 - 05:04 pm:

---

quote:

Date: Wed, 13 Aug 2003 16:35:59 -0400
From: CoreComm Support <support@core.com>
To: support@core.com
Subject: IMPORTANT SECURITY NOTICE TO OUR USERS All headers

Dear Valued CoreComm Internet Customer,

IMPORTANT SECURITY NOTICE TO OUR USERS

On Monday, August 11, 2003 a new worm virus was discovered by Antivirus Companies. This worm, known as Blaster, is known to attack Microsoft Windows operating systems and can crash your computer and even slow your Internet connections.

Blaster targets computers running the most popular Windows systems including all versions of Windows NT, Windows 2000, Windows XP, and Windows Server 2003. Once the computer is infected, the worm will attempt to infiltrate and infect other computers by using a normal Internet connection. This process has allowed the worm to spread worldwide in a very short period of time.

Is Your Computer Already Infected?
It is possible that the worm has already infected your computer if you notice sluggish performance, crashing or if you have received the following text:
"This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM"

Followed by a message box that states:
"Windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly"

How to Protect Your Computer:
This worm is able to infect and utilize systems through security vulnerabilities discussed in Microsoft Security Bulletins MS03-010 and MS03-026. Please visit both links below and make certain to patch your system for these two vulnerabilities. The security patches will secure your system and prevent the reboots. They will not remove the virus from your computer. See section "How to remove the virus:" for removal instructions after both patches below have been installed:

MS03-010: http://www.microsoft.com/technet/security/bulletin/MS03-010.asp
MS03-026: http://www.microsoft.com/technet/security/bulletin/MS03-026.asp

*Because of the virus, it may be impossible to stay connected to the Internet long enough to obtain the patch or removal tool before the computer reboots. Follow these steps if this is the case:

a. Do one of the following:
Windows 2000: Right-click the My Computer icon on the Windows desktop and then click Manage. The Computer Management window opens.
Windows XP: Click the Start button, right-click the My Computer icon, click Manage. The Computer Management window opens.

b. In the left pane, double-click Services and Applications and then select Services. A list of services appears.

c. In the right pane, locate the Remote Procedure Call (RPC) service.
IMPORTANT: There is also a service named Remote Procedure Call (RPC) Locator. Do not confuse the two

d. Right-click the Remote Procedure Call (RPC) service and click Properties.

e. Click the Recovery tab.

f. Using the drop-down lists, change First failure, Second failure, and Subsequent failures to "Restart the Service."

g. Click Apply and then OK
IMPORTANT: Make sure that you change these settings back after you have installed the security patches and have removed the virus.

If you receive the error message “Setup could not verify the integrity of the file Update.inf. Make sure the Cryptographic service is running on this computer” then please visit the following website for information on how to resolve this behavior:

http://support.microsoft.com/default.aspx?scid=kb;en-us;822798

How to remove the virus:
A removal tool for this virus, with instructions, can be found at:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal .tool.html

Additional information on this virus can be found at:
http://www.sarc.com/avcenter/venc/data/w32.blaster.worm.html

Further information regarding the Microsoft vulnerability and this virus can be found at:
http://www.cnn.com/2003/TECH/internet/08/12/windows.worm/index.html
http://securityresponse.symantec.com/avcenter/security/Content/8205.html
http://isc.sans.org/diary.html?date=2003-08-11
http://www.cert.org/advisories/CA-2003-19.html
http://www.datafellows.com/v-descs/msblast.shtml

Protecting Your Computer From Viruses
Protect yourself and your computer from emailed virus attacks with CoreComm Defender. CoreComm Defender automatically scans all your incoming e-mail for viruses then notifies you and the sender should a virus be detected. All infected e-mails are quarantined and deleted ensuring you the best protection for your computer. In addition, CoreComm Defender monitors all major virus detection services and automatically updates the virus filters so you don’t have to. You can add CoreComm Defender to your account for just $2 a month. Call 1-877-CORECOMM to find out more.

You can also scan your computer for Worms, Malware, Trojans and Virii for free at:
http://housecall.antivirus.com
http://security.symantec.com/default.asp


*The worm is known by a number of names depending on the virus scanning program you use:
* W32.Blaster.Worm [Symantec]
* W32/Lovsan.worm [McAfee]
* Win32.Poza [CA]
* Lovsan [F-Secure]
* WORM_MSBLAST.A [Trend]
* W32/Blaster-A [Sophos]
* W32/Blaster [Panda].

*IMPORTANT*:
You are installing these Microsoft provided patches and the Symantec Blaster removal tool at your own risk. CoreComm is not responsible for any problems or data loss associated with installing them nor does CoreComm support these items.



Thank You,

CoreComm
Support@core.com

---