A type of worm that replicates by sending complete, independent copies of itself over a network.
<strong> </strong> Please note that F-Secure Internet Security protected you against this worm proactively without updates, with the distributed firewall functionality. <br /><br /><strong><br />Manual Disinfection</strong><br /><br />1. Boot up the infected computer <br /> 2. If you keep getting the "Shutdown in 60 seconds" dialog, click Start / Run, and execute command 'shutdown -a' <br /> 3. Download and save the F-LOVSAN tool to your desktop from: ftp://ftp.f-secure.com/anti-virus/tools/f-lovsan.zip <br /> 4. If you're running Windows XP, Windows System Restore might restore the infection afterwards. Disable it.<br /> 5. Download and run the Microsoft patch to close the RPC hole. <br /> <br /> Download for Windows 2000 from www.microsoft.com: <br /> http://www.microsoft.com/downloads/details.aspx?FamilyId=F4F66D56-E7CE-44C3-8B94-817EA8485DD1 <br /> Download for Windows XP from www.microsoft.com: <br /> http://www.microsoft.com/downloads/details.aspx?FamilyId=5FA055AE-A1BA-4D4A-B424-95D32CFC8CBA <br /> <br />6. The patch installer will reboot the machine in the end. When the machine reboots, enter SAFE MODE by keeping F8 pressed when the computer screen goes black for a moment, then choose "1) Safe mode". <br /> 7. When the computer has booted up in Safe Mode, log in and execute the F-LOVSAN tool you downloaded in step 3. <br /> 8. Reboot normally - and you're done. <br /> <br />After this, it would probably be a good idea to install a firewall (such as the ones provided by F-Secure) to protect the machine from internet connections. If you can't do that, have a look at Windows XP's internal network protection settings: http://www.f-secure.com/support/technical/winxp_fw.htm <br /> <br /><strong><br />Special Disinfection Utility<br /></strong> <br />F-Secure's special removal tool will remove A, B, C and E variants of Lovsan. The tool can be downloaded from: <br /><br /> <ul> <li>http://www.f-secure.com/tools/f-lovsan.zip </li> <li>ftp://ftp.f-secure.com/anti-virus/tools/f-lovsan.zip </li> </ul> Documentation on the tool is available from: <br /> <br /> <ul> <li>http://www.f-secure.com/tools/f-lovsan.txt </li> <li>ftp://ftp.f-secure.com/anti-virus/tools/f-lovsan.txt </li> </ul> <br /> System administrators who are using F-Secure Policy Manager, can distribute the F-LOVSAN tool as a JAR package automatically to all workstations. System administrators can download the JAR version from: <br /><br /> <ul> <li>http://www.f-secure.com/tools/f-lovsan.jar </li> <li>ftp://ftp.Europe.F-Secure.com/anti-virus/tools/f-lovsan.jar</li> </ul>
Description Created: 2010-06-18 11:16:52.0
Description Last Modified: 2010-06-11 07:06:10.0