Updated Security Threat: Msblast.exe

**iMartin** · 08-12-2003, 08:41 PM

From Mess.be:

Updated: D'z warned me about this earlier on and now Symantec released a security report regarding the W32.Blaster.Worm.

This worm will exploit the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. It will attempt to download and run the file Msblast.exe.

You should block access to TCP port 4444 at the firewall level, and block the following ports, if they do not use the applicaitons listed:

TCP Port 135, "DCOM RPC"
UDP Port 69, "TFTP"

The worm also attempts to perform a Denial of Service on windowsupdate.com. This is an attempt to disable your ability to patch you computer against the DCOM RPC vulnerability.

To find out whether you're infected, press Ctrl+Alt+Del and verify if the process 'MsBlast.exe' is running. If it is, kill the process MsBlast.exe from the task manager. Next, execute regedit.exe and search for the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Delete "windows auto update"="msblast.exe" from the right pane.

Final step: delete msblast.exe from either the Windows System and/or System32 folders.

Update #2: Do these instructions stupefy you? D'z was one of the very first to create an auto-cleaner for this worm, and now Symantec released a removal tool.

[Detailed removal instructions: Symantec.com]

**MetroStars** · 08-12-2003, 09:05 PM

nice tip

**chris9902** · 08-12-2003, 10:22 PM

i found this

http://asia.reuters.com/newsArticle.jhtml?...storyID=3266448

**iMartin** · 08-13-2003, 12:03 AM

which specifically targets computers running Windows XP and Windows 2000

Well i guess im safe.

**Adster** · 08-13-2003, 01:09 AM

yes well I tryed that but didnt work

so i formated a fluked upgrading teh patch before it go me a 4th time

**Rip The Jacker** · 08-13-2003, 01:20 AM

Originally posted by [-Crono-]@12 August 2003 - 16:03

which specifically targets computers running Windows XP and Windows 2000

Well i guess im safe.

I have Win2000. Everything is working great here, no probs.