;COMMENT: LoveSan/MSBlaster I-Worm checking
;DESCRIPTION: Denies packets carrying the LoveSan/MSBlaster Internet Worm. Requests to TCP ports 135 and 4444 are denied on level 5 and higher. To avoid log-file cluttering, logging of this worm is disabled.

Virus-LoveSan
		Comment = "LoveSan/MSBlaster Internet-Worm",
		Protocol = TCP,
		Rule-Action = Deny,
		Destination-Port = "135 4444",
		Log-Control = Disabled,
		Log-Message = "LoveSan/MSBlaster I-Worm request",
		Log-Details = "LoveSan (also known as MSBlaster) is a worm that spreads itself over the Internet, using a Windows 2000/XP DCOM RPC vulnerability. The worm sends a special request to TCP port 135 and once your PC is infected, port 4444 is opened for remote use. The worm contains no destructive code for your PC, however it spreads itself and attempts to perform a DOS attack on the windowsupdate.com server - thereby preventing users from updating their Operating Systems. Note that requests to TCP port 135 may be the result of legal use, such as remote debugging. Requests to ports 135 and 4444 cause blacklisting on level 6 and higher; on lower security levels a warning message is generated and the offensive packets are denied.",
		Log-Severity = High,
		Direction = Incoming
