Urgent warning

[Newt]

If you run NT4/2K/XP, go to the microsoft site below and read then download & install the patch for your OS version. Very fast spreading critter that is not being reliably caught by AV software due to the way it operates.

 

http://support.microsoft.com/default.aspx?...kb;en-us;823980

[Steve Randles]

Grabbing the patch now Newt...Thanks mate!

[Elton]

Cheers, Newt.

[chesters1]

naughty boys ,shame on you proves you dont use windows update regularily

[dogfish]

I'll second that.I checked out the downloads and found I already had it.I update regularly.Now I know why!

[Steve Randles]

Some extra info for you all on removal and symtoms etc etc....

 

 

Some of you may experence an RPC error then windows will reboot!

You need to patch the exploit....

http://www.microsoft.com/technet/tr...in/MS03-026.asp

 

if it keeps shutting down before you manage to install it!

install or modifily your firewall to block port's 135 and 138

 

Another way

===========

 

First, if you have zonealarm or any similar firewall, DONT ALLOW msblast to access the internet.

 

Go to start->run type regedit. Go to HKEY Local MachineSoftwareMicrosoftWindows

CurrentVersionRun

 

If there is a key named 'windows auto update' with 'msblast' as the data, DELETE IT. What this does is it causes the program to allow connections on port 135.

 

Next, go to start->run type msconfig. Go to 'startup' and find msblast, uncheck it, and hit 'apply' and then 'ok'. When prompted to restart hit 'exit without restart'.

 

Next, alt-ctrl-delete. Go to 'processes' and then find msblast. Right click->end process tree. When prompted, hit YES.

 

Now, go to start->search and search for msblast. Anything that comes up [between 7-10kb files] drag to the desktop, and delete.

 

===================================

 

 

 

 

Microsoft RPC DCOM Worm

 

11 August 2003

 

Greetings,

 

On Monday, August 11, 2003, Counterpane was made aware of a wide spreading worm exploiting the recent Windows RPC vulnerability. This is a critical vulnerability affecting Windows NT, Windows 2000, Windows XP, and Windows Server 2003. The vulnerability exploits a flaw in the DCOM implementation which listens on RPC enabled ports. Specially crafted malformed messages can enable an attacked to gain complete control over a vulnerable Windows-based system. DCOM listening on TCP and UDP ports 135, 139, 445, and 593 are accessible to this vulnerability. Full details on the Microsoft security alert can be found at the following links:

 

http://www.microsoft.com/technet/tr...in/MS03-026.asp

http://www.cert.org/advisories/CA-2003-19.html

 

Counterpane research has seen positive indicators of worm activity in the wild. It is important to apply all vendor supplied patches as soon as possible to reduce exposure. The following details have been released from SANS, please visit http://isc.sans.org/diary.html?date=2003-08-11 for the entire release:

 

Technical Details:

 

Names and Aliases: W32.Blaster.Worm (symantec), W32/Lovsan.worm (McAfee), WORM_MSBLAST.A (Trend Micro), Win32.Posa.Worm (CA), Lovsan (F-secure), MSBLASTER,Win32.Poza.

 

Infection sequence:

 

SOURCE sends packets to port 135 tcp with variation of dcom.c exploit to TARGET

this causes a remote shell on port 4444 at the TARGET

the SOURCE now sends the tftp get command to the TARGET, using the shell on port 4444,

the target will now connect to the tftp server at the SOURCE. The name of the binary is msblast.exe. It is packed with UPX and will self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed:

MD5sum packed: 5ae700c1dffb00cef492844a4db6cd69 (6176 Bytes)

So far we have found the following properties:

 

Scans sequentially for machines with open port 135, starting at a presumably random IP address

uses multiple TFTP servers to pull the binary

adds a registry key to start itself after reboot

[Nugg]

Same here, on the 26th July, but done all the same.

[MrWiggly]

Thanks Newt ... Top Man !

[Riley]

Sorry getting a page unavailable message, and I get the uidea this is something I should have, what am i looking for under downloads?

[dogfish]

Try Windows.com/security.

Or follow the links on Freeserve homepage if you have it.