Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

Updated on Worm
Email From SBC Global | 04/03/04 | self

Posted on 05/03/2004 8:05:13 AM PDT by shadeaud

Dear SBC Internet Services Member:

This is an extremely important update to an e-mail SBC sent you 04/30/04 or 05/01/04. It is extremely important you read this message and take immediate action if you are using Windows NT, 2000, 2003 or XP.

In addition to a computer worm referred to as Gaobot or Agobot, that is currently infecting computers across the Internet, there is now another computer worm, known as Sasser, that is spreading across the Internet, exploiting the same apparent security vulnerability in these Microsoft Windows operating systems. In response, we strongly urge you to immediately take the following security measures: 1) Use a personal software or hardware firewall to protect your computers from network worms and intruders. 2) Download and install all available critical patches for your Windows operating system from the Microsoft web site: http://windowsupdate.microsoft.com/ 3) Use up-to-date anti-virus software to detect and remove Gaobot and Sasser or other computer worms and viruses.

It is extremely important you take these measures now because it’s likely you will not be able to take these measures if your computer becomes infected.

If you have more than one computer using these specific Windows operating systems, you should perform these actions on all such computers that connect to the Internet. Failure to take appropriate action could result in infection of your system, slow browsing or the inability to connect to the Internet and spread of this problem - and could lead to suspension of your account.

Because computer worms do not spread by email, you may have little or no warning before your computers are infected.

Users whose computers are infected with Sasser should follow the worm removal instructions at: http://www.microsoft.com/security/incident/sasser.asp, or if infected with Gaobot, follow the worm removal instructions at: http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.removal.tool.html.

If you are unable to connect to the Windows Update or Anti-Virus web sites, in order to download the removal tools or the patches for Windows and your anti-virus software, please contact Microsoft at 866-PCSAFETY or 866-727-2338.

SBC Yahoo! members can access additional information about SBC Yahoo! security features, including free anti-virus and personal firewall, at http://help.sbcglobal.net/. Further information is available at http://www.microsoft.com/security/protect/.

Thank you,

SBC Internet Services

About SBC Internet Services Security Alerts

SBC Internet Services sends notices about security updates after we publish information about them on our website. If you are ever in doubt about the authenticity of an email claiming to be an SBC Internet Services Security Alert, check http://help.sbcglobal.net/ to confirm if the Alert is listed. Go to the Alert section in the left hand column of the home page and look under the bullet which references this email.


TOPICS: Miscellaneous; Technical
KEYWORDS: flaw; getamac; linux; lookoutexpress; lowqualitycrap; microsoft; patch; securityflaw; trojanhorse; virus; windows; worm
Navigation: use the links below to view more comments.
first 1-2021-27 next last
This is the latest email I received from SBC.
1 posted on 05/03/2004 8:05:13 AM PDT by shadeaud
[ Post Reply | Private Reply | View Replies]

To: shadeaud
Thanks for this informative and timely post!
2 posted on 05/03/2004 8:07:58 AM PDT by fuzzthatwuz
[ Post Reply | Private Reply | To 1 | View Replies]

To: shadeaud
"Download and install all available critical patches for your Windows operating system from the Microsoft web site: http://windowsupdate.microsoft.com."

Is it safe to do this. I have Windows 2000.
3 posted on 05/03/2004 8:11:50 AM PDT by Bahbah
[ Post Reply | Private Reply | To 1 | View Replies]

FREE PC PROTECTION:
(Not an exhaustive list. Your results may vary. Void where prohibited. For entertainment purposes only. No wagering, please. Whattayawantfernuthin'.)
(Thanks, but "Buy a Mac" doesn't qualify as "FREE PC protection")

4 posted on 05/03/2004 8:14:27 AM PDT by martin_fierro (A v v n c v l v s M a x i m v s)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Bahbah
Is it safe to do this.

It is NOT safe to AVOID it.

5 posted on 05/03/2004 8:15:44 AM PDT by Izzy Dunne (Hello, I'm a TAGLINE virus. Please help me spread by copying me into YOUR tag line.)
[ Post Reply | Private Reply | To 3 | View Replies]

To: Izzy Dunne
Thanks, Izzy.
6 posted on 05/03/2004 8:17:34 AM PDT by Bahbah
[ Post Reply | Private Reply | To 5 | View Replies]

To: shadeaud
Because computer worms do not spread by email, you may have little or no warning before your computers are infected.

There are such things as mass-mailing worms that are spread by e-mail, so the first part is not technically correct. The second, however, is certainly correct for Sasser. The creater of Sasser are prolific, too. With four variants in as many days, it looks like someone's making use of their debugging skills. If you know a geek in the IT security field, they may need a hug today. ;)

7 posted on 05/03/2004 8:18:18 AM PDT by FourPeas
[ Post Reply | Private Reply | To 1 | View Replies]

To: shadeaud
There needs to be a 24-hour Star Trek channel to keep hackers busy.
8 posted on 05/03/2004 8:18:57 AM PDT by Doohickey ("This is a hard and dirty war, but when it's over, nothing will ever be too difficult again.”)
[ Post Reply | Private Reply | To 1 | View Replies]

In case anyone cares: What is the difference between viruses, worms, and Trojans?
9 posted on 05/03/2004 8:21:10 AM PDT by FourPeas
[ Post Reply | Private Reply | To 7 | View Replies]

To: Doohickey
Nah, that'll just encourage them to drink more Mountain Dew and name their viruses after various and assundry Klingons, Romuluns, etc. (Of course, it might be worth it if you own a lot of Pepsi stock.)
10 posted on 05/03/2004 8:22:55 AM PDT by FourPeas
[ Post Reply | Private Reply | To 8 | View Replies]

To: shadeaud
A security vulnerability in MS Windows? I don't believe it. </extreeeeeeeeeeeeeme sarcasm>
11 posted on 05/03/2004 8:34:54 AM PDT by TheBigB ("Any moment now, unspeakable horror! Trust me!" -Tom Servo)
[ Post Reply | Private Reply | To 1 | View Replies]

To: TheBigB
bump,,this weekend my puter was so slow loading,,it was all but unworkable. Wonder if I have it. I do have a "hijack" thing on it that embedded itself in Explorer,,from some casino. Hubby has been working to get rid it,,it slows down theputer and takes up memory. I hate my computer.
12 posted on 05/03/2004 8:46:20 AM PDT by cajungirl (<i>swing low, sweet limousine, comin' fer to Kerry me hoooommmee</i>)
[ Post Reply | Private Reply | To 11 | View Replies]

To: martin_fierro
MUST MUST MUST ARCHIVE THIS AT HOME.........this is the third time I've tagged this very same post....CMON 47!!!!!!

Thanks for your patience martin. hehe
13 posted on 05/03/2004 8:58:24 AM PDT by FourtySeven (47)
[ Post Reply | Private Reply | To 4 | View Replies]

To: shadeaud
How comes these MS-centric tech guys never tell us poor Linux users how to avoid these viruses and worms?


Oh yeah... I forgot.


Never mind.
14 posted on 05/03/2004 9:01:25 AM PDT by Redcloak (Have you hugged your tagline today?)
[ Post Reply | Private Reply | To 1 | View Replies]

To: martin_fierro
You should add the command-line SysClean from Trend Micro to that list.

The stand-alone template is here.


If you are not a Trend Micro customer please download the following file.

alt Sysclean Package 1.6MB
alt
MD5 checksum: 24C63720989D40C95B3E4F3BB2B81455
alt

NOTE:
For instructions on how to use this package, consult the "How to Use" section of the readme file, readme_sysclean.txt. This file also contains the description and the different features of this package.

Note that for the Trend Micro Sysclean Package to be effective, you must download and place the latest pattern file in the same folder as the Trend Micro Sysclean Package.

And the definition/pattern file is here.


Official Pattern Release 885 (1.885.00)

The Official Pattern Release or OPR is Trend Micro's latest compilation of patterns for identified viruses. It is guaranteed to have passed a series of critical tests to ensure that customers get optimum protection from the latest virus threats.

alt lpt885.zip    (AS/400, S/390, Windows)    4.0MB
alt
alt ptn885.tar    (UNIX)    8.2MB
alt

This pattern file is most effective when used with the latest scan engine. We strongly encourage you to update your scan engine to ensure you are using the best virus protection available. For latest viruses added, please read the whatsnew.txt file.

Burn them onto a CD and you can fix just about anything without having to install a full AV program.  It's saved me from having to reformat many systems where the resident AV has been compromised by a 0-day virus or worm.

 

 

15 posted on 05/03/2004 9:10:06 AM PDT by Psycho_Bunny
[ Post Reply | Private Reply | To 4 | View Replies]

To: shadeaud
Yawn- Mac user here.
16 posted on 05/03/2004 9:27:08 AM PDT by Wacka
[ Post Reply | Private Reply | To 1 | View Replies]

To: FourPeas
Is this the vulnerability that the critical updates covered a couple of weeks ago? I just checked windows update and there were no new critical updates.

I have a 5 computer network here at work that I want to make sure is safe. I've updated the AV but would like to know that I've got the vulnerabilities covered.
17 posted on 05/03/2004 9:40:44 AM PDT by TruBluKentuckian
[ Post Reply | Private Reply | To 7 | View Replies]

To: TruBluKentuckian
Yes, it exploits the LSASS vulnerability described in Microsoft Security Bulletin MS04-011.
18 posted on 05/03/2004 9:42:45 AM PDT by FourPeas
[ Post Reply | Private Reply | To 17 | View Replies]

To: FourPeas
Thanks, that answers my question.
19 posted on 05/03/2004 9:46:38 AM PDT by TruBluKentuckian
[ Post Reply | Private Reply | To 18 | View Replies]

To: Bahbah
My home computer was attacked by this virus Saturday morning. I did not get it cleaned out until Sunday evening.
20 posted on 05/03/2004 10:50:19 AM PDT by tom paine 2
[ Post Reply | Private Reply | To 3 | View Replies]


Navigation: use the links below to view more comments.
first 1-2021-27 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson