Protect Your PC from viruses, hackers, spam and more. Buy PC-cillin 2009 with Easy Installation & Support! (Note: this is what I use for my PC's and those of my family. --Kristina)

[Main Page | Bookstore | Search | CGI Scripts for Educators | ESL/EFL Links Page | Submit an ESL/EFL Site | Contact Me | Site Map ]

Fixing the MSBlast/LovSan/SoBig/Dumaru Worm(s)

Update May 3, 2004: The hits just keep on coming. Warning: a new Internet worm is actively attacking Windows computers. If your Windows operating system is not up to date, you can be infected without even knowing it! Microsoft provides a tool to determine if you are infected by this worm. Please click here to go to the Microsoft information page. (You will need to use Internet Explorer to use Microsoft's detection tool.)

More information about this worm (and a tool to remove it and clean your computer) can be found here on McAfee's AntiVirus site and you can read more about the worm on Symantec's site as well here.

Please check your computers and get updated virus protection if necessary! A firewall may also help protect you from this worm.

Update Sep 18, 2003: Yet another worm, called W32/Swen@MM (also I-Worm.Swen, W32/Gibe.e@MM, W32/Swan, Win32.HLLM.Gibe.2), is running around pretending to be a patch from Microsoft. The email looks quite official, but it will infect your system and use it to infect other computers! DO NOT open attachments even if they appear to come from Microsoft. Microsoft does not email security patches to their customers. Please see this page from for more details about this worm. I just received it in my email today.

Update Sep 10, 2003: WHOA! Looks like the last patch from Microsoft may not have been a complete fix for MSBlast or similar things. Check out this latest announcement from Microsoft: Get to and make sure you have the latest patch!

Update Aug 30, 2003: Well, one virus writer is out of the way. The author of the "teekids" worm, a relative of MSBlast, has been arrested.

Update August 26, 2003: The W32.Dumaru worm (also known as W32.Dumaru@mm and WORM_DUMARU.A) sends mail from "" with the subject "Use this patch immediately!" It also sends an attachment called "patch.exe". DO NOT OPEN THAT ATTACHMENT! If you are infected with the Dumaru worm, Symantec has provided this tool to help remove the virus It will stop the W32.Dumaru processes, delete the files, and generally try to clean up after it. Please keep your system updated. To help prevent viruses or protect yourself from viruses, remember to practice safe computing!

Update August 20, 2003: The SoBig.f worm (also known as W32/Sobig.f, WORM_SOBIG.F, SoBig virus, SoBig worm, and so forth) is on a wild rampage!

If you're getting bounced email that you never sent, you may be infected OR the virus may just be using your email address and pretending to be you. The links below for MSBlast should help you scan your computer. Also, here is McAfee Software's page on the SoBig.f worm specifically, which might help you learn how to get disinfected.

Update August 12, 2003: The MSBlast/LovSan worm is getting a lot of people

Worms and viruses are a constant threat nowadays, especially since use of the Internet is so widespread. Recently, we've seen a lot about the MSBlast worm (also known as Win32 Blast, LovSan, Lovesan worm (with an "e"), teekids, W32.Blaster.Worm, Win32.Poza, and others) can cause your computer to crash, reboot unexpectedly, or just become unstable. Even worse, the worm can cause your computer to infect other computers and even attack other systems on the Net!

My Internet Service Provider (Great Basin Internet Services) has posted the following message on their site. It has some links to help you patch your computer if you're not infected and links to some antivirus sites that can help you get rid of the worm. Since this is so widespread, I thought I'd post it here for you all as well. In addition to the tips below, the University of Connecticut has put together this page with tools and information on how to fix the MS Blast/Lovsan worm as well.

If you do not have any antivirus software, these sites will let you scan your computer online for viruses:

Trend Micro's Housecall Virus Scanner (This one is my favorite -- it will let you scan your whole computer if you wish. It will want to install a file on your computer, but doesn't require any registration, or your email address.

Panda Sofware ActiveScan Virus Scanner (requires your email address)

RAV Antivirus Online Virus Scanner (appears to scan only one file at a time)

Also, I just found This page which tells you what to do if you can't download the patch before your computer reboots. It may be worth a try.

Be careful out there, and try to keep your computer clean! Once you've cleaned your computer, here are some tips on how to help prevent viruses and worms from infecting your system again: practice safe computing! -- Kristina

ALERT! Win32 Blast Worm infecting Computers! (2003-08-12 13:45:14)
As as you may have heard on the news, there is a new and very active computer worm (sometimes also referred to as a virus) which is infecting computers across the country. The worm spreads due to a problem with certain versions of Microsoft Windows and other software. This worm infects computers, sometimes shuts them down, and creates other problems. For example, if the date is between the 16th and the 30th (or 31st) of the month, it will use infected computers to launch an attack on It is spreading extremely quickly, so we strongly encourage all users to update their antivirus and Windows software.

What can I do?

You can help prevent your computer from becoming infected by going to one of the following websites to either get updates for your anti-virus software, or to install a patch from Microsoft to prevent infection:

Download the patch from Microsoft

This page from Microsoft has information about the problem in Windows, and patches to download to fix the underlying problem.

Update your antivirus software

You may read more about it at Symantec's page, Trend Micro's page, and McAfee's page. These sites also will generally have updates for your antivirus software.

Clean your system

Some of these pages have information on removing the worm if you have already been infected. Symantec has created this tool to remove the worm. In addition, you can download McAfee's Stinger tool which will detect several kinds of worms and viruses in addition to MSBLAST. PLEASE NOTE that if your system has been infected, there may be internal damage that these tools cannot repair.

Keep your software up-to-date!

We cannot stress strongly enough how important it is to keep antivirus and other software up to date. New viruses, worms, and threats appear constantly, and out-of-date software cannot protect you.
Go to Linguistic Funland TESL Main Page
E-mail the Webmaster of this site

This page copyright © 1996, Kristina L. Pfaff-Harris. All rights reserved.