RPC worms

[CubanCorona]

I live in an apartment building with about 30 different rooms. Each room is sharing a single DSL connection. Recently the network has been unbelievably slow. At some times, it does not seem to work at all. The management of the apartment claims that it is due to the blaster worm and its variants. However, they don?t seem to have any resolution in mind. Since I?m paying for this DSL service in my rent, I feel like this needs to be resolved! I also need the internet to complete a lot of my assignments (college student). I read up on the worm a little bit, and downloaded the patch scanning tool from Microsoft. I found the unpatched computers and obtained their MAC addresses. Here is my question/dilemma:

Even if I telnet into the router and filter traffic from the unpatched computers, how do I know that the patched computers aren?t already infected? In other words, if the worm infects an unpatched computer and the computer is then patched, is the worm still active? If it is, then I need to find a way to detect the computers on the network which are infected. Is there any way to do this? My thought was scanning the network for traffic on the ports which the worms use to spread (135, 139.. are there others?). Is there an automated tool to do this? If I block all in/out traffic on these ports on the router, will that stop the infected computers from trying to spread internally on the network? Or will it only filter those packets which are going in/out of the WAN interface? (It?s a generic Netgear cable/DSL router) If I do block those ports, will it affect normal operation at all?

Thanks for the help! Any other input or explanations are MORE than welcome. I want to find out as much as I can about this!

Willow
CCNA

P.S. If any of you are network administrators and have found a way to deal with this problem I would REALLY appreciate it if you drop me a PM. Thanks!

 

[spidey07]

Originally posted by: CubanCorona
I live in an apartment building with about 30 different rooms. Each room is sharing a single DSL connection. Recently the network has been unbelievably slow. At some times, it does not seem to work at all. The management of the apartment claims that it is due to the blaster worm and its variants. However, they don?t seem to have any resolution in mind. Since I?m paying for this DSL service in my rent, I feel like this needs to be resolved! I also need the internet to complete a lot of my assignments (college student). I read up on the worm a little bit, and downloaded the patch scanning tool from Microsoft. I found the unpatched computers and obtained their MAC addresses. Here is my question/dilemma:

Even if I telnet into the router and filter traffic from the unpatched computers, how do I know that the patched computers aren?t already infected? In other words, if the worm infects an unpatched computer and the computer is then patched, is the worm still active? If it is, then I need to find a way to detect the computers on the network which are infected. Is there any way to do this? My thought was scanning the network for traffic on the ports which the worms use to spread (135, 139.. are there others?). Is there an automated tool to do this? If I block all in/out traffic on these ports on the router, will that stop the infected computers from trying to spread internally on the network? Or will it only filter those packets which are going in/out of the WAN interface? (It?s a generic Netgear cable/DSL router) If I do block those ports, will it affect normal operation at all?

Thanks for the help! Any other input or explanations are MORE than welcome. I want to find out as much as I can about this!

Willow
CCNA

P.S. If any of you are network administrators and have found a way to deal with this problem I would REALLY appreciate it if you drop me a PM. Thanks!

If a machine was patched, but already infected then it will stay infected until cleaned. Visit antivirus sites for a cleaner.
You've already got a method to scan for unpatched machines, microsoft also has a scanning tool.

To locate machines that have the worm you'll need to look at firewall logs for scanning like activity on port 135 and pinging.

 

[scorpioLP]

strange setup.

Anyway, the only way to be completely sure will require you to have access to all the PCs that use this DSL line.

Since it's unlikely that everyone would willingly give you access to their PCs, I would start looking for alternatives to using this.

Can't you do cable modem or get your own DSL line ??

 

[colinstoner]

I'd be curious to know if the DSL ISP knows that your apartment is reselling their service at what can be an assumed profit. I might bring that into one of my conversations with your landlord.

Colin

 

[CubanCorona]

I could get my own cable or DSL line, but the DSL I have is inlcuded in my rent. Why pay extra?

As far as scanning the logs... I figured I would have to do that. Does anyone know of a free packet sniffer that would allow me to see only traffic with a specified destination port?

I'm surprised no one has developed a sniffer that sits and listens for worms. There's a good project for anyone who's bored.

If anyone knows of a tool like this, LMK!

Thanks for the help guys

Willow

 

[colinstoner]

Originally posted by: CubanCorona
I could get my own cable or DSL line, but the DSL I have is inlcuded in my rent. Why pay extra?

As far as scanning the logs... I figured I would have to do that. Does anyone know of a free packet sniffer that would allow me to see only traffic with a specified destination port?

I'm surprised no one has developed a sniffer that sits and listens for worms. There's a good project for anyone who's bored.

If anyone knows of a tool like this, LMK!

Thanks for the help guys

Willow

Ethereal should allow you to do this.

Colin

 

[CubanCorona]

Does anyone have a list of all the ports which these worms use?

I assume I would be look for packets with the specified destination port?

Is there any other activity which I should look for? I already noticed on computer flooding the network with NDPS packets with the same destination IP.

Thanks!

Willow

 

[CubanCorona]

bump

 

[spidey07]

you should look for any kind of range pinging - this is the welchia worm

Any scanning on sequential IP addresses on port 135 would be blaster.