More MSBlaster Information

ResCom is asking students to not plug their computers into the internet until we are sure that it has been patched. To find out how to patch your computer or if you are vulnerable, please contact your local ResCom office or your RA.

Hello there,
I would like to inform you about important information regarding your
email address. This email address will be expiring.
Please read attachment for details.
---
Best regards, Administrator
[random letters]

Again, this is NOT a legitimate PSU email. Do NOT open the attachment, as it contains a virus that can harm your computer and/or your data. If you have any questions about the email or the virus, you can contact your local ResCom office.

Kazaa 2.5 Configuration Guide

Secure Your Computer

Many students have lost their internet connections due to the enforcement of the Digital Millennium Copyright Act. If you suspect your internet connection has been shut off, check your Penn State email for notification.

Important Copyright Related Reading Material:

ResCom's Copyright Infrigement Info
DMCA (Digital Millennium Copyright Act)
Letter from the PSU VP & Provost

Any further questions should be directed toward your local ResCom desk.

The bandwidth consumption page is designed as a tool to monitor recent bandwidth consumption, so the student has a general idea of how much bandwidth he/she has consumed up to the point the total was checked. The system checks a students total only 3 times per day (every 8 hours).  The system was not designed to and can not operate as an "up to the minute reflection of how much bandwidth they have consumed".

Please make sure to understand how to properly use the information on this page. ResCom will discuss how to properly use this information if you call or stop down to the desk to ask questions. Carefully read the information on the consumption page for details of when the data was collected and when the next information will be displayed.

The student is solely responsible for monitoring his/her own bandwidth usage. The University is still monitoring each student's Internet bandwidth total consumption; the limits and violation procedures are enforced.

Bandwidth Consumption Page

Most new computers arrive pre-loaded with Anti-virus software, such as Norton Antivirus or McAfee Antivirus, however, Penn State offers FREE NORTON ANTIVIRUS Corporate Edition to all registered Penn State Students (ITS UserID required for download). During the Fall Arrival weekend, ResCom tackles an enormous workload for the students, primarily handling only Ethernet connectivity service calls

However, if the technician has time, he or she will be glad to remove your computer's current Anti-virus and install Penn State's free Norton Antivirus. While your current software may function well, the Norton Corporate edition available to students has proven itself time and again as a very reliable, easy-to-use product. The Corporate Edition does not expire every year like the other packages do; NAV Corporate has free updates year after year. The ResCom staff highly recommends your taking advantage of this software.

Windows 95/98/ME are NOT affected.

Once infected, the worm tries to do the following:

• Attempts to download the DCOM RPC patch from Microsoft's Windows Update Web site, install it, and then reboot the computer.
• Checks for active machines to infect by sending an ICMP echo request, or PING, which will result in increased ICMP traffic.
• Attempts to remove W32.Blaster.Worm.

From: "Microsoft" <security@microsoft.com>
Subject: Use this patch immediately !
Message:
Dear friend , use this Internet Explorer patch now!
There are dangerous virus in the Internet now!
More than 500.000 already infected!
Attachment: patch.exe

The virus was originally created to initiate DDOS attacks on windowsupdate.com (which has recently been taken offline) and other large corporate websites. It can also attribute to general system instability and can compromise some security settings on your machine.

This Microsoft Knowledge Base article address and will provide links to fix the vulnerability within Windows.

From: admin@psu.edu
Subject: your account      [random characters]

Body:
Hello there,
I would like to inform you about important information regarding your
email address. This email address will be expiring.
Please read attachment for details.
---
Best regards, Administrator
[random letters]

This is NOT a valid email. No one at PSU would send you an email advising that your account will expire. The attachment included is a virus. The vulnerability it is commonly using is found in Outlook Express and has been address by Microsoft in this cumulative patch.

The worm will also attempt to terminate the processes of various antivirus and firewall programs. The worm propagates itself to different filenames.

NOTE: There have been reports, that, some cases, if you receive a message that the virus has sent using its own SMTP engine, the message will appear to be a "postmaster bounce message" from your own domain. For example, if your email address is jsmith@anyplace.com, you could receive a message that appears to be from postmaster@anyplace.com, indicating that you attempted to send email and the attempt failed. If this is the false message that is sent by the virus, the attachment will include the virus itself. Of course, such attachments should not be opened.

Nimda spreads through email and open network shares. This virus has been given an assessment of Extremely High Risk Nimda infects Internet Information Services (IIS) which installed by default on Windows 2000 Advanced Server.  If Windows 2000 or Windows XP is preinstalled on your computer, IIS may also be installed, leaving your computer at high risk for the Nimda virus.

What you should know: The Norton Antivirus protection against this virus was added on September 18, 2001 and all systems with Norton updated since that time and Realtime Protection running are safe from this worm.

As always, if you have any reason to believe your computer has been infected, you may contact your local ResCom desk to schedule an appointment with a technician.