W32.Blaster.Worm - RPC vulnerability causes reboots in Windows NT, 2K, and XP.

[AnandTech Moderator]

Info:

http://www.cert.org/advisories/CA-2003-19.html
http://www.cert.org/tech_tips/win-UNIX-system_compromise.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

This worm hits your TCP port 135, and it is the cause of the reboot problems many have posted about in Windows NT, 2K, and XP. Firewalls like Zone Alarm, etc. appear to trap the port hits.

If you use Windows NT, 2K or XP, visit the Windows Update site. This worm does NOT attack Windows 98 or ME, but your firewall may report
hundreds of port probes per hour.

Symantec's site says, if you find MSBLAST.EXE on your system, you have been infected.

 

[Electrode]

My router reports about 80 hits on port 135 over the last 20 minutes.

 

[NesuD]

also routers stop it cold and the built in xp firewall will also block it out as well according to MS.

Best practices recommend blocking all TCP/IP ports that are not actually being used, and most firewalls including the Windows Internet Connection Firewall (ICF) block those ports by default. For this reason, most machines attached to the Internet should have RPC over TCP or UDP blocked.

RPCvulnerability Microsoft Knowledgebase

Here is what to look for and how to neutralize MSBlast

 

[speed01]

Thanks..

Speed

 

[xcript]

What fun.

Looks like the perfect excuse for everyone to switch to linux right now.

 

[NesuD]

can't rebooting every 60 sec doesn't leave enough time to download the ISOs

 

[xcript]

Originally posted by: NesuD
can't rebooting every 60 sec doesn't leave enough time to download the ISOs

Excuses, excuses.

 

[healtheworld]

RPC Shutdown Xp Security flaw
Well experts,,
Thanks cnn for providing early alerts about the xp rpc flaw. I hv read the whole thread . Really impressed by response. I m working for Dell tech Support. Dell support lines are jammed becoz of issue. Nearly 85% of dell systems( Home and small business) are infected by this . Now we have received a lot of mails from dell experts . I just want to know from u guys which one of them is the best solution.

I KNOW DOWNLOADING THE LATEST PATCH, BUT WHICH ONE OF THEM IS BEST TO PREVENT ABNORMAL SHUTDOWN.


i hv gone thru these threads also

http://www.security-forums.com/foru...opic.php?t=7266

http://www.security-forums.com/foru...opic.php?t=7105


Some Fixes
========
1. <http://vil.mcafee.com/dispVirus.asp?virus_k=100499>
****
2.
****
Run Dcomcnfg.exe.

If you are running Windows XP or Windows Server 2003, perform these additional steps:

Under Console Root, click Component Services.
Open the Computers subfolder.
For a local computer, right-click My Computer, and then click Properties.
For a remote computer, right-click the Computers folder, point to New, and then click Computer. Type the computer name. Right-click the computer name, and then click Properties.
Click the Default Properties tab.
Click to select (or click to clear) the Enable Distributed COM on this Computer check box.
If you will be setting more properties for this computer, click the Apply button to enable (or to disable) DCOM. Otherwise, click OK to apply the changes.

3.
****
Try this goto safe mode disable all under startup and then also under services. Recheck Plug and play , RPC and RPC locater, and system restore services.

Then reboot to normal mode.
This is not a Virus it is a hacking attempt.
removing the cable for the cable modem and the phone line will help.

5.
*****
Disconnect the system from the internet.
Reboot the system
Enable the Internet Connection Firewall ( XPs inbuilt firewall-- Advanced settings in the properties of the LAN or the Dial up connection)

Reconnect to the internet
Then download the patch from http://microsoft.com/technet/treevi...in/MS03-026.asp

Apply the patch.

6
*****

http://securityresponse.symantec.co...aster.worm.html


7
*******

Boot in Safe Mode-->Go to Start>Control Pannel.
Click on the Switch to Classic veiw.
Goto Administrative tools
Go to Service.
Select the Remote Procedure Call and Double click on the service.
Go to Recovery.
Go to First Failure: Change it to take no action.
Click on Apply and ok.
Click on the network connections
right click on the LAN or the dial up Connection.
Click on the Properties.
Click on the check box which enables the XP-Firewall.
Click on Apply and Ok.
Reboot the system in the normal mode.

Then Guide the customer to download the patch from microsoft site.
http://microsoft.com/downloads/deta...&displaylang=en

==============================================
Sometimes it gives an error regarding TFTP

**************************************************
*****
Any answer for tftp error
Some IMP Info from a newsgroup
=====================

FYI, the presence of the files Dcomx.exe or the other files mentioned below along with a "Remote Procedure Call" or TFTP popup message on your system and/or system lockups or reboots are signs you may have been hacked by a tool such as Autorooter. [TFTP.EXE is a normal file that comes with many versions of Windows, but it should usually not be running on most systems.]

To fix this:
4. Click on "Start, Find/Search, Files or Folders" to search your hard drive
for any of the following file names. If any of the files below are found,
you may need additional help getting rid of them and determining what else
if anything was changed on your computer.
rpc.exe
rpctest.exe
tftpd.exe
dcomx.exe
lolx.exe
worm.exe

I do believe there may be new variants of Autorooter that possibly have not yet been fully discovered. Unlike an automated event like a worm, this event may indicate that someone personally ran a tool against you and may have done things to your computer.

There are a number of posts mentioning a quick "registry fix" to close "port 135." This does very little to secure your computer, as it only closes one of the 130,000 ports on your computer. Get a firewall first, even a free one.

Also, note that the presence of new files such as TFTPxxxx or DCOMX.EXE etc. means that just installing the latest Microsoft patches, editing the registry, etc. may no longer be sufficient. Installing the Microsoft patch, editing the registry, closing ports, disabling services, etc. do absolutely nothing to block the back door that has probably now been installed, so that your computer can still be compromised using other ports.

Once your computer has been hacked, these are some things I might recommend
doing are here:

http://securityadmin.info/faq.htm#hacked
http://securityadmin.info/faq.htm#re-secure
http://securityadmin.info/faq.htm#harden

The Autorooter Trojan has been given several different names by various
anti-virus
companies [although I believe some people are being attacked by something
that is similar but not exactly the same as Autorooter]:

RPC Worm (F-Secure)
Downloader-DM (McAfee)
Autorooter (Panda)
Worm.Win32.Autorooter (AVP)
Backdoor.IRC.Cirebot (Symantec)

References:

http://www.europe.f-secure.com/v-descs/rpc.shtml
http://vil.nai.com/vil/content/v_100524.htm
http://securityresponse.symantec.co...oor.irc.cirebot
..html
http://news.com.com/2100-1009-5059263.html
http://www.microsoft.com/technet/se...in/MS03-026.asp
http://www.microsoft.com/security/s...ns/MS03-026.asp
http://support.microsoft.com/?kbid=823980


Here are some signs of infection, though these do not necessarily match all
the variants that might be out there:

"Signs of infection:
- the existence of one or more of the following files:
rpc.exe
rpctest.exe
tftpd.exe
dcomx.exe
lolx.exe
worm.exe

Signs that a network is being attacked:
- traffic on port 445 to sequential IP addresses.

Signs that an attack has succeeded (allowing a remote shell and downloading
of the backdoor):
- port 57005 open;
- an ftp [tftp] connection on port 69."

 

[Kinesis]

Nesud that MSBlast Neutralization link doesn't help much if you are not a MicroTrend user!

This the link for Norton's Removal Tool : HERE

 

[saxamophone]

Trend-Micro has a link to a free online scanner on that page. Only thing is, it takes a while to use, because it scans for any virus.

McAfee has a 700k download here which they claim should take care of it.

 

[heffe734]

Hey guys,


My friend just brought over his lappy...it was infected....i installed norton on his computer and it detected it. Funny thing was...i had to manually remove it...that tool that symantec has for download didn't detect it....anyone else have this problem? The virus was gone after i quarantined and deleted it. Make sure you also end the msblast.exe process in the processes tab of task manager to stop the trojan.

 

[Macro2]

RE:"the built in xp firewall will also block it out as well according to MS"

Thats questionable

 

[Macro2]

RE:"that tool that symantec has for download didn't detect it....anyone else have this problem?"

Norton is weak.

 

[NesuD]

Originally posted by: Kinesis
Nesud that MSBlast Neutralization link doesn't help much if you are not a MicroTrend user!

This the link for Norton's Removal Tool : HERE

Erm look a little closer. there is a downloadable tool for nonusers

For Non-Users of Trend Micro Products please download the Trend Micro System Cleaner Package.

it is called sysclean.com with a link to download it. please look closer before you crap on me.

 

[NesuD]

Originally posted by: Macro2
RE:"the built in xp firewall will also block it out as well according to MS"

Thats questionable

Why do you say that? I have had it work for several people here already. Do you just didtrust MS? Unless you have definitive prrof that it does not help at all which i know it does do not confuse an already frustrating problem with your misinformation.

 

[NesuD]

Originally posted by: saxamophone
Trend-Micro has a link to a free online scanner on that page. Only thing is, it takes a while to use, because it scans for any virus.

McAfee has a 700k download here which they claim should take care of it.

Read the page people there is a downloadable tool that you can use. plus instructions to stop it from starting up. For christs sakes look at the damn page. Click the Trend micro system cleaner link there are two downloads on that page one for trendmicro users and another for non users.

 

[Macro2]

Once it's on your computer how does a firewall stop it?
Never trust Microsoft? hummm...good idea.

wormguard or a router is your best defense, IMHO.

http://wormguard.diamondcs.com.au/

 

[Macro2]

test

 

[xcript]

Originally posted by: NesuD

Originally posted by: Macro2
RE:"the built in xp firewall will also block it out as well according to MS"

Thats questionable

Why do you say that? I have had it work for several people here already. Do you just didtrust MS? Unless you have definitive prrof that it does not help at all which i know it does do not confuse an already frustrating problem with your misinformation.

The built-in firewall only prevents incoming connections.

So if you've got Msblast.exe running, it'll continue to do it's job.

Edit:

Looks like the DoSing doesn't begin until the 16th though.

 

[Macro2]

This has to be the worst hit of Anandtech users I've ever seen.

I'm surprised such savy users weren't more protected.

 

[drag]

I am not suprised. Technically savy isn't going to protect you from crappy software.

Just remember, a man's only as good as the tools he uses.

Stuff like this will continue to happen. For instance remember the exploit that could affect all MS OSes back unto win98 and up thru 2003? (xp at least.) how many years was this exploit hidden before white-hats figured it out.

This means that the likelyhood that black-hats already knew about this for a long time is fairly decent. That means untill recently all MS OSes were vunerable and no matter how you patched your OS some people could get thru. And these would be the ones you realy have to worry about. Professionals hired for coporate cloak and dagger stuff, crackers that break systems for a living and so on. Not the little script kiddies that plague firewall logs everywere.

Think about this virus writer. Do you think he figured out the exploit and wrote the virus on his own? How long was this known, did he learn this exploit from someone else? What group first figured it out, how long have they known it and what did they do with this knowledge? Could they write this virus as a cover for some company or grand sceme or something... Remember crackers (pros) will often work on a single target for months on end until they get what they want, they are tenasious with little or no scruples and would be happy to cover themselves up with mis-direction.

You know that this isn't going to be the last threat to all windows users. What other attacks are people working on right now, how many more patches will be released for XP or 2000/3 in the next couple years, how many more viruses?

It's actually pretty scary if you think about it. A person or a company can stand a lot to loose frome stuff like this.

 

[xcript]

Originally posted by: drag
Think about this virus writer. Do you think he figured out the exploit and wrote the virus on his own?

Most definitely not.

The shell binds itself to port 4444 (as in the concept-code),
so it's fairly obvious whoever wrote it ripped the shellcode directly.

Details of the DCOM/RPC vulnerability were first released by LSD I believe.

Damn copy/paste kiddies. :frown:

 

[Mavtech]

I have heard a lot of people just blaming Microsoft over this worm issue. The fact is, if you are using broadband and are unprotected, it's your fault also. Even if Windows was perfect, I would still use a firewall. I work for Dell as a sales rep. I got about 30 calls yesterday on this issue. I told them all the same thing about why they were infected and why they couldn't get through to Tech Support.

 

[Kilrsat]

Another link for information:
http://www.cert.org/advisories/CA-2003-20.html

Originally posted by: Mavtech
I have heard a lot of people just blaming Microsoft over this worm issue. The fact is, if you are using broadband and are unprotected, it's your fault also. Even if Windows was perfect, I would still use a firewall. I work for Dell as a sales rep. I got about 30 calls yesterday on this issue. I told them all the same thing about why they were infected and why they couldn't get through to Tech Support.

I have to kind of agree. Running windowsupdate once every two weeks isn't too much to ask in the first place, and coupled with the lack of a firewall on a broadband connection is asking for trouble. Most people have learned not to use "weak" passwords, and now they need to learn that locking down unused ports on their machines is necessary just like the locks on their front doors.

 

[Flatline]

Very true. Even a software-based firewall would block it quite neatly (as long as it's locked down a bit).