PlusNet - The Smarter Way To Internet We have detected a possible Worm Infection - Immediate Action is Required
  
  

It is extremely important that you read this message and take immediate action.

Message from PlusNet Support: Possible Worm / Virus Infection on your machine

You are seeing this page because a computer using your connection has acted in a way which suggests it is infected by an Internet Virus or Worm, such as MSBlast, Nachi or Nimda. Because of the nature of these particular worms, you may not notice any effect yourself, however any worm on your system will have significant impact on other users. It is necessary for us to request your immediate action in order to help protect all PlusNet customers.

If you are not the owner of this Internet Connection, please contact your System or Security Administrator in relation to this message.

In order to resolve this, please take a few minutes to complete the following:

  1. Run the free, on-line virus checker at http://housecall.antivirus.com

  2. Follow the Blaster removal instructions at http://www.microsoft.com/security/incident/blast.asp

  3. Visit http://windowsupdate.microsoft.com to download and install all available critical patches for your operating system. Once installed remember to reboot your machine.

    You must perform the above actions on all computers that use your Internet connection.

  4. If you don't already have one, download and install a software firewall for your PC. Free firewalls such as Zone Alarm are generally adequate.

  5. Disconnect and Reconnect from the ADSL service. If you have successfully cured the problem you will not see this page again. If, after reconnecting, further messages appear here, please see the notes below on what may be causing us to issue this message.
Click here for further techncial information about this problem >>

If you have any general enquiries about this message, please contact our support team using the Help Assistant facility on our portal. However, please be aware that the support team will be unable to assist in configuration of software on your own system. If you are unsure about the cause of this please contact your PC/Software Supplier or IT consultant. Alternatively, you can visit our Portal Discussion Forums to discuss your issue with other users of the service.

We thank you for your prompt action on this important matter and apologise if this message has been triggered inappropriately, however we have had to take this action in order to prevent degradation of our network as the result of customers who are infected with a worm / virus. Please follow the instructions below to prevent your PC from issuing traffic on port 135 and you will not see this message again.


With Regards,
PlusNet Customer Support
Tel: 0800 432 0200 or 0345 140 0200


You can continue to use the Internet in order to resolve this problem by opening a new browser window. You will be able to continue surfing 60 seconds after this page was first loaded, however, in somecases you may need restart you browser for this to happen.

Please note that we have blocked your access to ICMP (Ping / Traceroute) for the remainder of your current connection session. By disconnecting and re-connecting from the ADSL service your account will be reset unless further outbound port 135 connection attempts are detected.

PlusNet does not access the contents of customers' computers. This message has been triggered because your machine behaved in a manner which suggested a virus or worm was present on your connection. This may not be the case, however other spurious traffic generated by a PC on your connection may be causing this warning to appear.





Technical Information

We believe a computer using your IP address may be infected because of network traffic on TCP Port 135 originating from your network IP address. If your router uses Network Address Translation (NAT) or you use Microsoft's Internet Connection Sharing (ICS) to connect to the Internet, one or more computers on your network may share the same IP address. Computers with IP addresses beginning with 10.x.x.x, 172.16.x.x.x through 172.31.x.x and 192.168.x.x use Network Address Translation (NAT). If multiple computers on your network share the same IP address, you must check all your computers for infection. PlusNet cannot determine which particular computer on a NAT network is infected. You may continue to receive this message until all the computers on your network have been repaired.

Virus un-related outbound connection attempts on port 135 may be caused by any of the following:

  • You have an option enabled in your connection properties which is allowing the sharing of files and folders over your Internet connection.
  • You are running an older version of Microsoft Exchange.
  • You are attempting to access an older version of Microsoft Exchange on another network - This may include some corporate email web based clients.
  • You attempted to port-scan another machine on the Internet
  • You have an incorrectly configured firewall or router which is allowing internal network traffic onto the Internet.
  • Advice for prevention of this message from virus unrelated activity

    If you have checked for, or resolved, all of the issues above but are still seeing this message when you connect, we advise you create a specific firewall rule to block all outbound access on port 135 from your machine or network.

    "I need to use port 135 for..."

    Some older software may attempt to use port 135 for legitimate purposes. Recently, Microsoft changed it's advice to system administrators about the usage of port 135. This port should not be made available to access to or from the Internet due to vulnerabilities associated with the services running by default on all windows machine which use this port.


    If the software you use has a requirement for port 135 access via the Internet we would advise you to contact your software supplier for advice about alternatives.