The Lovesan Worm

The lovesan worm has spread into high mode.  Although its destruction was originally thought to be targeted at Microsoft's Windows Update web site, it can crash certain systems, and is spreading rapidly.  It has affected some large institutions on a broad scale, and it is causing user systems to reboot frequently.  It can reach you.  So you need to take precautions.

The destructive feature of lovesan is a distributed denial of service (DDoS) attack on the Windows Update web site, which takes over the infected systems to send unwarrented traffic to the targeted web site, thereby making it unusable.  Among other outcomes, this would make it difficult or impossible for you to download critical patches to your Windows system.

The lovesan worm is very similar to the blaster worm that made its appearance earlier in the year.

The patch that Microsoft issued to take care of the blaster worm will also work with the lovesan worm.  So the company is not issuing a new patch.  If you have not done so already, you should run Windows Update to remove the vulnerability on your system.

More information from Microsoft for end users

More information from Microsoft for technical users

CERT Advisory - revised 8/11/2003

CERT's suggestions to deal with the lovesan / blaster worm.  (READ THIS IF YOU THINK YOU MAY BE AFFECTED.)

DRR 8/12/2003