Forum Home
Press F1
 
Thread ID: 43756 2004-03-25 10:22:00 Lovsan.E worm - How do I disenfect. mejobloggs (264) Press F1
Post ID Timestamp Content User
225121 2004-03-25 10:22:00 Not having experience with getting rid of viruses I thought I would ask you people.

Lovsan.E worm Please tell me what to do.

Also, how to protect from further infection from it?

Thanks
mejobloggs (264)
225122 2004-03-25 10:25:00 Hup. Sorry, I just deleted it with NOD32. It said it could not clean the virus, so I thought that meant it couldnt do anything. I just noticed it had delete :-) mejobloggs (264)
225123 2004-03-28 05:59:00 Well, it just popped up again in another file. I think maybe it is spreading? mejobloggs (264)
225124 2004-03-28 06:05:00 Woah... the Blaster virus... old school :-)

You need to get a patch from MS to prevent becoming reinfected over and over again.

Then you'll need a virus removal tool or similar to get rid of it.

This Symantec Page (securityresponse.symantec.com) has all the info you need including a removal tool and links to the MS patches for W2K or WXP (only affected OS's).
whiskeytangofoxtrot (438)
225125 2004-03-28 06:06:00 I am guessing you are using win xp?

If so disable System Restore (Note: you will loss all your System Restore points) then that will help with removing it.
stu140103 (137)
225126 2004-03-28 06:13:00 > Woah... the Blaster virus... old school :-)

I don’t think so....

This is what Blaster is called:

W32/Lovsan.worm.a [McAfee], Win32.Poza.A [CA], Lovsan [F-Secure], WORM_MSBLAST.A [Trend], W32/Blaster-A [Sophos], W32/Blaster [Panda], Worm.Win32.Lovesan [KAV] source: securityresponse.symantec.com

There is northing there that says: Lovsan.E

mejobloggs: are you shore you got the name right?
stu140103 (137)
225127 2004-03-28 06:40:00 > I don’t think so....
>

I do...

Lovsan.E is the same as Blaster.E it's just another variant of Blaster.

The Symantec Removal tool linked off the page above removes Blaster A through F so will get rid of the Blaster.E (Lovsan.E) virus.

All variants of Blaster (Lovsan) infect through the same port, so you definitely need the MS patch and the removal tool.

Symantec's Blaster E Page (securityresponse.symantec.com)

Removal Tool Direct Download (securityresponse.symantec.com)

Symantec Security Response has developed a removal tool to clean the infections of W32.Blaster.E.Worm.

Also Known As: W32/Blaster-E [Sophos], W32/Lovsan.worm.e [McAfee], Worm.Win32.Lovesan [KAV]
whiskeytangofoxtrot (438)
225128 2004-03-28 06:53:00 Download page for W2K Patch (www.microsoft.com)

Download page for WXP Patch (www.microsoft.com)

Dunno how well those link's will work - give em a try.
whiskeytangofoxtrot (438)
225129 2004-03-28 06:58:00 Removal Tool Direct Download (securityresponse.symantec.com)

Seems something funky happened to the url the first time - will try that one again.
whiskeytangofoxtrot (438)
225130 2004-03-29 07:18:00 Sweet, thanks guys. All sorted now. mejobloggs (264)
1