New Virus hitting hard and furious!!!

http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html ^ | 08/11/03 | self

[STFrancis]

All,

Here a scoop to Freepers which is just now hitting us security pro's.

There is a first vulnerability that uses the MS Bug that MS addressed with MS 03-026 two weeks ago.

It is calling itself MSBLAST.exe and is spreading in the wild unbelievably fast. http://isc.sans.org/diary.html?date=2003-08-11

A first advisory from McAffee has just been published: http://us.mcafee.com/virusInfo/defa...&virus_k=100547 Once it finds a vulnerable system, it will spawn a shell on port 4444 and use it to download the actual worm via tftp. The exploit itself is very close to 'dcom.c' and so far appears to use the "universal Win2k" offset only.

In other words we need to make sure port 4444 is blocked inbound AND outbound.

Of course this is in addition to the MS03-026 patch being installed which Microsoft released two weeks ago (more info regarding the patch here: http://www.microsoft.com/technet/tr...n/MS03-026.asp.

Another advisory was JUST posted by Symantec: http://www.symantec.com/avcenter/ve...aster.worm.html

Just thought everyone ought to know.

Thanks...

[CHICAGOFARMER]

Thanks I am on it.!!!!!

[cmsgop]

Sounds bad.

[Ben Bolt]

Bump for IT folks !

[STFrancis]

Symantec link did not come thu right: http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html

[countrydummy]

thanks!

[STFrancis]

From my focus-virus list this nugget:

message follows...
*****
i've just got a copy of this Windows DCOM Worm from a nice fellow on another
list.

it matches the MD5 at http://isc.sans.org/diary.html?date=2003-08-11 of
5ae700c1dffb00cef492844a4db6cd69. that's the EXE's MD5, not the unpacked
EXE version or the MD5 of the ZIP i received it in. i have not launched it
yet, but i did note it made its way past three layers of virus protection
without being detected.

yes, we do use the same AV for all parts of our network, but that's 'cause
we're a small company with limited resources. so don't bitch at me about
it. :)

we've got NAV Corporate 8.00.0.9374 with scan engine 4.1.0.15 and
definitions of 06/08/2003 rev. 4 (the most current at this time) and it is
not detected.

****

[Ernest_at_the_Beach]

Thanks!

OFFICIAL BUMP(TOPIC)LIST

[Brad’s Gramma]

BTTT...thanks for the info!!

[petuniasevan]

Thanks for the heads-up!

[SengirV]

OH MY GOD!!!!!!! Another virus!!!! What do I do?!?!?!?!? Oh wait, I have a Mac. Nevermind.

[Focault's Pendulum]

New Virus hitting hard and furious!!!

You really should have included the word computer in the title......I thought my ex-wife was on the loose again.

[ironwill]

I just finished cleaning my computer of this stupid virus. What a P.I.T.A. that was.

[LenS]

It's a good thing that you use a computer that only five other people use.


*weg*

[LurkedLongEnough]

Thanks. Saint Francis pulls through again.

[myprecious]

OK. Can someone translate this to a techno-idiot? Can I search for a file or something? Should I install the patch from MS? Will this require duct tape and my old cans of Spam?

[LynnHam]

here's the fix for it
Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability


A buffer overrun vulnerability has been reported in Microsoft Windows that can be exploited remotely via a DCOM RPC interface that listens on TCP/UDP port 135. The issue is due to insufficient bounds checking of client DCOM object activation requests. Exploitation of this issue could result in execution of malicious instructions with Local System privileges on an affected system.
This issue may be exposed on other ports that the RPC Endpoint Mapper listens on, such as TCP ports 139, 135, 445 and 593.



Resolution for Windows XP
Shut down PC
Unplug Cable Modem.
Start up PC
Click Start -> Settings -> Control Panel
Double Click Network Connections
Right Click the Local Area Connection used to access Internet. Example: Local Area Connection 1
Select Properties
Click the Advanced Tab
Enable the Windows XP Firewall
Click OK, Close out of open windows.
Plug in the Cable Modem.
Ensure Block Sync is established.
Open Internet Explorer
Go to the following URL: http://www.microsoft.com/technet/default.asp
Click the Link toward the middle of the page titled: Action: Read Security Bulletin MS03-026 and Install the Security Patch Immediately
Scroll Down Page about half way to Patch Availability
Click Windows XP 32 bit Edition
Click Download in the upper right of the screen.
Save the file to the desktop
Run the downloaded file.
The patch will install and prompt the customer to reboot.
Once the patch is installed and the computer rebooted, the Windows XP firewall can be disabled and the customer can surf normally.
Temporary Resolution for Windows 2000 Users
Have them go to http://download.microsoft.com/download/0/1/f/01fdd40f-efc5-433d-8ad2-b4b9d42049d5/Windows2000-KB823980-x86-ENU.exe and install the file from there. URL is not case sensitive.

[LowOiL]

Odd, port 4444 is the port that AdSubtract uses.

AdSubtract is a popular program for removing ads, pop-ups, sound, ect from your surfing.

[FourPeas]

Never, I repeat NEVER, use duct tape. It leaves fingerprints. The old can of Spam OTOH....

[FourPeas]

Yup. Mr. FourPeas is working fast and furious. What a nice 'welcome home' on his first day back from vacation.