Microsoft: 'Blaster' Virus Looks Like Dud

Dom · Aug 18, 2003, 05:23 PM

SEATTLE - The second wave of an Internet attack by the "blaster" worm barely caused a ripple Saturday.

Microsoft Corp. said it had no major problems from the worm's attempt to turn thousands of infected computers into instruments targeting the software company's Web site and network.

The Redmond-based company had not noticed any extraordinary network congestion, spokesman Sean Sundwall said. There were also no reports of customers having major problems accessing the targeted Web site, which houses a software patch that fixes the flaw exploited by the worm.

"So far we have seen no impact on our Web sites or any other Web sites due to the 'blaster' worm," Sundwall said.

Still, he urged people to take precautions to protect their computers.

The virus-like infection, also dubbed "LovSan" or "MSBlast," exploits a flaw in most current versions of Microsoft's Windows operating system for personal computers, laptops and server computers. Although Microsoft posted a software patch to fix the flaw July 16, many users failed to download it, leaving them vulnerable.

As of Saturday afternoon, the worm had infected more than 423,000 computers around the world since Monday, according to security firm Symantec Corp.

Of those, about 50,000 were affected on Saturday, said Mike Bradsaw, a Symantec spokesman.

The infection caused computers to reboot frequently or disrupted users' browsing on the Internet. But it also packed a second punch.

Computer experts said starting at 12:01 a.m. local time Saturday, infected computers that have not cleaned up the virus would in effect turn into a legion of zombies instructed to repeatedly call up a Microsoft Web site that houses the software patch. If enough traffic flooded the network, the site could be rendered unreachable and computer users would be unable to access the patch.

But the exploiters of the Microsoft flaw made a mistake themselves. The worm instructed computers to call up http://windowsupdate.com - which is an incorrect address for reaching the actual Microsoft Web site that houses the software patch. Although Microsoft has long redirected those who visited that incorrect address to the real site - http://windowsupdate.microsoft.com - the company disabled the automatic redirection Thursday in preparation for the onslaught of infected computers.

That has helped Microsoft's real Web site stay accessible to users, Sundwall said. The company was taking other measures to keep its site up and running, he said. He declined to give specifics.

Vincent Weafer, senior director of security response for Symantec, warned that Microsoft's network and others across the country could see a slowdown in Internet traffic simply from the volume of activity the worm is expected to generate from its legion of infected computers.

But that slowdown didn't happen, Weafer said Saturday.

The rate of new infections has slowed in recent days, he said, though computer users who still have not downloaded the patch need to do so. He said the company expects new infections to continue for as long as two years.

The worm left behind a love note on vulnerable computers: "I just want to say LOVE YOU SAN!" It also carried a hidden message to taunt Microsoft's chairman: "billy gates why do you make this possible? Stop making money and fix your software!"

______________________
Source: WashPost

DriveEuro · Aug 18, 2003, 05:59 PM

Quote:

Originally posted by Dom
But the exploiters of the Microsoft flaw made a mistake themselves. The worm instructed computers to call up http://windowsupdate.com - which is an incorrect address for reaching the actual Microsoft Web site that houses the software patch. Although Microsoft has long redirected those who visited that incorrect address to the real site - http://windowsupdate.microsoft.com - the company disabled the automatic redirection Thursday in preparation for the onslaught of infected computers.

Total bummer!

**MIG-31** · Aug 18, 2003, 06:02 PM

after all the hype about blaster and to say that the time i spent post linked emails to those who i know aswell.

Logla · Aug 18, 2003, 06:05 PM

Our company had lots of our engineers in on Saturday (I got out of it

) to scan HUNDREDS of our customers pcs and about 100 servers. All for (almost) nothing.

**MIG-31** · Aug 18, 2003, 06:12 PM

Quote:

Originally posted by Logla
Our company had lots of our engineers in on Saturday (I got out of it ) to scan HUNDREDS of our customers pcs and about 100 servers. All for (almost) nothing.

but that keeps you going.jus think of all the money your place gets out of that.

pity you won't see much of it!!

Logla · Aug 18, 2003, 06:19 PM

Quote:

Originally posted by johnybravo
but that keeps you going.jus think of all the money your place gets out of that.

pity you won't see much of it!!

Now heres the funny part - they wont get anything. They signed the customer up to a support agreement which means things like Virus infections are our fault therefore we pay.

the customer owns the network but we run it for them and support all kit attached to it. This means that we have to activley enforce virus protection accross the servers and try to get the customers to keep their machines updates. This is rather difficult to do as the customers forget to update every week. The company gets a fixed amount each year for the support so it would have cost us to come in this weekend. The only way to get any extra money out of them is to prove that they infected their own machines. this becomes virtually impossible as we probably support somewhere in the region of 10,000 pcs and a couple of hundred servers - this is a very large corporate WAN.

Did I mention I hate virus writers.

idots

**MIG-31** · Aug 18, 2003, 06:30 PM

didn't look at that way,i would say who needs the support but don't want to speak to soon.

Logla · Aug 18, 2003, 07:14 PM

Theres one thing though - They keep me in a job

**MIG-31** · Aug 18, 2003, 07:15 PM

thats one advantage in your favour.pays the bills.

Aug 18, 2003, 05:23 PM	#1
Dom DriverHeaven Extreme Member Join Date: Jun 2002 Posts: 12,940 Rep Power: 0	Microsoft: 'Blaster' Virus Looks Like Dud SEATTLE - The second wave of an Internet attack by the "blaster" worm barely caused a ripple Saturday. Microsoft Corp. said it had no major problems from the worm's attempt to turn thousands of infected computers into instruments targeting the software company's Web site and network. The Redmond-based company had not noticed any extraordinary network congestion, spokesman Sean Sundwall said. There were also no reports of customers having major problems accessing the targeted Web site, which houses a software patch that fixes the flaw exploited by the worm. "So far we have seen no impact on our Web sites or any other Web sites due to the 'blaster' worm," Sundwall said. Still, he urged people to take precautions to protect their computers. The virus-like infection, also dubbed "LovSan" or "MSBlast," exploits a flaw in most current versions of Microsoft's Windows operating system for personal computers, laptops and server computers. Although Microsoft posted a software patch to fix the flaw July 16, many users failed to download it, leaving them vulnerable. As of Saturday afternoon, the worm had infected more than 423,000 computers around the world since Monday, according to security firm Symantec Corp. Of those, about 50,000 were affected on Saturday, said Mike Bradsaw, a Symantec spokesman. The infection caused computers to reboot frequently or disrupted users' browsing on the Internet. But it also packed a second punch. Computer experts said starting at 12:01 a.m. local time Saturday, infected computers that have not cleaned up the virus would in effect turn into a legion of zombies instructed to repeatedly call up a Microsoft Web site that houses the software patch. If enough traffic flooded the network, the site could be rendered unreachable and computer users would be unable to access the patch. But the exploiters of the Microsoft flaw made a mistake themselves. The worm instructed computers to call up http://windowsupdate.com - which is an incorrect address for reaching the actual Microsoft Web site that houses the software patch. Although Microsoft has long redirected those who visited that incorrect address to the real site - http://windowsupdate.microsoft.com - the company disabled the automatic redirection Thursday in preparation for the onslaught of infected computers. That has helped Microsoft's real Web site stay accessible to users, Sundwall said. The company was taking other measures to keep its site up and running, he said. He declined to give specifics. Vincent Weafer, senior director of security response for Symantec, warned that Microsoft's network and others across the country could see a slowdown in Internet traffic simply from the volume of activity the worm is expected to generate from its legion of infected computers. But that slowdown didn't happen, Weafer said Saturday. The rate of new infections has slowed in recent days, he said, though computer users who still have not downloaded the patch need to do so. He said the company expects new infections to continue for as long as two years. The worm left behind a love note on vulnerable computers: "I just want to say LOVE YOU SAN!" It also carried a hidden message to taunt Microsoft's chairman: "billy gates why do you make this possible? Stop making money and fix your software!" ______________________ Source: WashPost

Aug 18, 2003, 06:02 PM	#3
MIG-31 HardwareHeaven News Mod Join Date: Dec 2002 Location: Nottingham,UK Posts: 56,854 Rep Power: 471 System Specs	after all the hype about blaster and to say that the time i spent post linked emails to those who i know aswell. __________________ Please Post Your News Submissions Here

Aug 18, 2003, 06:30 PM	#7
MIG-31 HardwareHeaven News Mod Join Date: Dec 2002 Location: Nottingham,UK Posts: 56,854 Rep Power: 471 System Specs	didn't look at that way,i would say who needs the support but don't want to speak to soon. __________________ Please Post Your News Submissions Here

Aug 18, 2003, 07:15 PM	#9
MIG-31 HardwareHeaven News Mod Join Date: Dec 2002 Location: Nottingham,UK Posts: 56,854 Rep Power: 471 System Specs	thats one advantage in your favour.pays the bills. __________________ Please Post Your News Submissions Here

Aug 18, 2003, 06:05 PM	#4
Logla HardwareHeaven Extreme Member Join Date: May 2003 Posts: 3,311 Rep Power: 0	Our company had lots of our engineers in on Saturday (I got out of it ) to scan HUNDREDS of our customers pcs and about 100 servers. All for (almost) nothing.

Aug 18, 2003, 07:14 PM	#8
Logla HardwareHeaven Extreme Member Join Date: May 2003 Posts: 3,311 Rep Power: 0	Theres one thing though - They keep me in a job