The Remote Procedure Call shutdown and msblast.exe

This has been going pretty strong today and may get worse before it gets better.

http://www.trendmicro.com/vinfo/viru...WORM_MSBLAST.A

Here is the manual removal information from the link:

Terminating the Malware Program

This procedure terminates the running malware process from memory.

1. Open Windows Task Manager press
CTRL+SHIFT+ESC, and click the Processes tab.
2. In the list of running programs*, locate the process:
MSBLAST.EXE
3. Select the malware process, then press either the the End Process button. (usually msblast.exe)
4. To check if the malware process has been terminated, close Task Manager, and then open it again.
5. Close Task Manager.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing during startup.

1. Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
2. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
”windows auto update" = MSBLAST.EXE
4. Close Registry Editor.

You need to apply the patch from Microsoft to prevent the buffer overflow that allows the virus into your system through DCOM. For XP users like me, the download is at this link:
http://download.microsoft.com/downlo...80-x86-ENU.exe
and the page with the details for XP users that link is located on:
http://microsoft.com/downloads/detai...displaylang=en

Here is Microsoft's general information page about this DCOM buffer overflow issue and the patches:
http://support.microsoft.com/default...b;en-us;823980

Ok, that was the worm fix, here is the solution to the computer-shutting-down problem:

Go to your Services panel (Control Panel -> Administrative Tools -> Services or Start->Run->type services.msc, click OK), find Remote Procedure Call, right-click and select Properties, click Recovery tab, change "Shut down" to "Take no action" and Apply, OK.

I'm amazed how fast these things spread and are then recognized as threats. This morning when it happened to me twice scans came up clean. Don't know what time today msblast.exe was added to virus definitions.

Norton has just released a "W32.Blaster.Worm Removal Tool" available at the link below.


http://securityresponse.symantec.com...oval.tool.html

Tufenuf

I've already had calls this morning and last night about this problem. This thread is the first I've seen that explains how to fix computer shutting down in easy to understand terms. ;)

Thanks Verlux.

Tufnuf, seen the symantec removal. but unless client can get computer to stay running, that isn't much help. :(

Thanks VerLux and Tufenuf, you both saved the day for me and probably many others as well! This is one of the first places I came for help, knew there would be something here if I could just stay online long enough to grab it. What a nightmare! Seems everyone I know got slammed with this one today. Followed VerLux's instructions first, to keep up and running long enough to get Symantec download from Tufenuf's link. Had to turn off Outpost Firewall (for whatever reason I could not and still can't access any web pages with firewall on). Machine still not acting quite right, so will probably run tool again per Symantec's advice to run it twice. Anyway, thanks for posting the pertinents! ;) -Kat

Katmac if you read Symatecs info on the removal tool you'll see that they also tell you run your virus protection tool after the removal tool. Mine caught and removed two versions of blaster virus and cleaned them out. Tought this might help.:cool: :)

Just thought I'd post the link below which has easy to follow instructions regarding the W32/Blaster that is running rampant and how to deal with it.

http://www.cert.org/tech_tips/w32_blaster.html


Tufenuf

Hi Chief,
Yes, thanks, updated Norton and scanned, nothing found. Have the Removal Tool and Patch on floppies, they will probably be worn thin before the day is out ;)

BTW, for XP users: M$ Patch offers 32 bit and 64 bit. I'm presuming average home user is 32 bit?

What I don't understand is why people are running to update their virus signatures and download fixes, when you have been able to get the patch from M$ for almost a month now.

Wouldn't installing the patch prevent the need for all of this other stuff or am I missing something?

Doc

Doc: Ideally, yes. But there are wide variety of users out there who aren't online or even booted up regularly: The casual home user who doesn't go online much in summer, it's more a wintertime distraction. Or others, like me, are so insanely busy with non-cyber life lately that they simply don't have time to get online on a regular basis. Then there's the extreme: My mother's PC is only booted up and/or online maybe a few times a year, usually when the grandkids come by (can't get Mom past the intimidation phase). So every couple months I blow the cobwebs off her PC and update Windows and Norton on her machine. Takes longer that way, but updating her PC weekly doesn't take priority over other things she needs my help with. (With her minimal use, she got the worm, too BTW.) So there's lots of things to consider. Also, the patch M$ released in July was revised 4 times since it's initial release, perhaps a good idea to redownload again?

Yes, both XP Home and Pro home users need the 32-bit download, not the 64-bit.

Just tried to get into the windows update site, and was unable to. Thought the DoS was set for the 16th. Perhaps too many people looking for the patch?

Symantec's sites are tough to get into also. I'm sure there are alot of busy people and servers today.

VIRUS ALERT: 'MSBlast' worm spreads around world


August 12, 2003



McAfee Security's Anti-Virus Emergency Response Team (AVERT) has issued a medium risk virus alert for the 'MSBlast' virus.


The MSBlast worm has infected as many as 100,000 computers in the past 24 hours. The worm, which security experts believe started spreading early Monday, scans for vulnerable computers so widely that an unpatched Windows XP computer on the Internet could be infected in as little as 25 minutes.
Read more about the virus:
http://g.msn.com/0NL33936/24


Virus profile:
http://g.msn.com/0NL33936/22


Microsoft virus patch:
http://g.msn.com/0NL33936/23

To all interested: If your wondering whether you have XP 32 or 64 bit, not to sweat.....M$ has not released XP 64 bit yet, I believe 64 bit has a release date of 18 Aug 03.....I think they decided to have a little advanced publicity on XP64...hehehe;) :rolleyes: :confused:

O ya, you guys were always lots of help.
Thanks a.

If you can't get into Windows Update to get the patch CNET has it available here-
http://download.com.com/3120-20-0.ht...search=+Go%21+

Wish we would have gotten into either VDr or MSupdate yesterday mornig when this happened...:rolleyes: - our whole 2000 system got hammered and some older NT machines broke down completely when attempting to run MSupate...

Running 98 DOES have advantages sometimes ;) - no prob at home :D

Hi everyone,

Just thought I would add a note that Eeye Digital Security released a free RPC DCOM vulnerability scanner that can be found here:

http://www.eeye.com/html/Research/To...=RetinaRPCDCOM

You have to fill out a form, but it is worth it!

It just makes it a lot easy to tell which systems still need the patch, and when you are done.

TIP: Today I attempted to scan a home users PC, which had no LAN IP, and therefore no IP when not connected to the Internet. If this is the case, scan 127.0.0.1. the name will resolve to LOCALHOST. Another good idea is to remove the default checkbox for "Show only vulnerable servers". That way you know it is working when everything is patched.

Slic, I tried a scan-got no results. Do I have to manually enter my IP address?

Windows 2000 Pro.

I've aplied the patch.

Just so I'm staright on this Blaster thing, Win98 machines are not affected, right? Also since this is a worm/trojan rather than an email virus, do you need an a/v program or a firewall or both to stop it?

I haven't read all posts before - but if somebody gets shutdown in 1min window just to prevent do it:

start >> run >> shutdown -a

Just wanted to give others a heads-up, as many will probably be making/receiving service calls. Download & carry a copy of Win 2000 SP4 (Network install, think about 129 MB) along with the patch.

Just got done working on a Win 2000 machine, and as with the majority of folks out there, the owner had not downloaded any service packs. Need at least SP2 in order to install the patch. I tried the Windows Update way of installing SP4 twice - after using the norton removal tool - and while the SP was downloading I got the worm again.

Finally got smart and downloaded SP4; then ran removal tool, SP4 and patch installs before getting online again. I was an idiot, but no idea how fast this thing is spreading at the time.

Quote:

---

Originally posted by f117nighthawk
Just so I'm staright on this Blaster thing, Win98 machines are not affected, right? Also since this is a worm/trojan rather than an email virus, do you need an a/v program or a firewall or both to stop it?

---

That's correct. It's a good idea to have a firewall and an antivirus installed, but not necessary to stop this worm for Windows 98 users. More technical explanation is available here: http://securityresponse.symantec.com...ster.worm.html - and if you want the in-depth technical analysis, it's in this .pdf document:
https://tms.symantec.com/members/Ana...t-DCOMworm.pdf (that last link from http://www.securityfocus.com/archive/1/332625 )

STEBEL, thanks for that info.

While I guess this is a good sign that everyone should keep up to date on the latest high-importance patches and security devices (really, how many reminders do we need? ;)) I think the worm author said it best, in the message embedded within msblast.exe:

Code:

---

billy gates why do you make this possible ? Stop making money and fix your software!!

---

I must say I'm impressed with Symantec's handling of this situation. They were on the ball from the get-go. I've been given reason to recommend other products (such as TrendMicro's) above theirs for a couple of years now, but this incident has restored my faith in how much they care about their user's systems. I'm glad this thread could be of assistance to people out there affected by this. :)

Well, the DoS attack is scheduled for tomorrow (8/16) - I hope it's somewhat contained by now.

I agree, Symantec has been impressive since the beginning (fast and accurate).

My understanding of Microsoft's reasoning in not originally mentioning Win 2000 (Gold, SP1 and SP2) is that they no longer support these versions (I may be wrong about SP2).

Blame for this infection obviously lies with the people who are creating and attempting to spread this worm and its varients, but I agree that Microsoft's culpability is strong for allowing the vulnerability in the first place. The fact that so many people where caught off guard, even though we've had plenty of warning, is probably understandable considering the different attitudes people have toward Microsoft's Updates. Also, there are a lot of people who pay little attention to their computers and computer news in general.

Murph: thanks for the heads up for Win2000 machines.

Quote:

---

Originally posted by ChiefE7
To all interested: If your wondering whether you have XP 32 or 64 bit, not to sweat.....M$ has not released XP 64 bit yet, I believe 64 bit has a release date of 18 Aug 03.....I think they decided to have a little advanced publicity on XP64...hehehe;) :rolleyes: :confused:

---

XP 64bit has been out for some time, for the IA64 Intel Chip, the AMD version is on it's way, so yes, some people do have the 64BIT version of windows, but only the ones with huge wallets

What would be the hardware requirements for a good 64 bit Windows machine? I could buy the parts and build it piecemeal. Would there be any way I could put 64 bit XP on my current machine?

Quote:

---

Originally posted by f117nighthawk
What would be the hardware requirements for a good 64 bit Windows machine? I could buy the parts and build it piecemeal. Would there be any way I could put 64 bit XP on my current machine?

---

http://www.microsoft.com/WindowsXP/6...n/overview.asp

You need a 64-bit processor, such as Intel's Itanium 2 (released in 2001 and way high end) or the Athlon 64 FX - which is coming out next month and more aimed at lower end users who want a smooth transition. The G5 will also be 64-bit. 64 bit computing will be fun once it's accessible to everyone with the ease 2GHz processors are currently available.



BTW

I don't do any help desk, so I'm not sure how long this thread is needed. If the need for this info has pretty much passed, please let me know so it can be de-stickified.. :)

Might as well as destickify this thread to make room for the next one.
http://www.microsoft.com/security/se...s/ms03-033.asp

I found that one and 822925 (another Cumulative Patch for IE6 SP1) waiting for me when I turned my computer on this morning.

MS03-033 is Security Update 823718 (I don't think MS has the KB out yet - I couldn't find it).

Quote:

---

Originally posted by Rainbow32
Might as well as destickify this thread to make room for the next one.
http://www.microsoft.com/security/se...s/ms03-033.asp

---

Ok, done.