# MA-054.082003: MyCERT Advisory - W32.Blaster Worm

**Date:** 12 Aug 2003  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-054.082003  
**Advisory ID:** MA-054.082003

---

1.0 Description
#### 1.1 Overview
MyCERT has received reports of a new worm infection which propagates through network.This worm exploits the Microsoft Windows DCOM RPC vulnerability announced July 16, 2003 (EST).
The worm scans the network through TCP port 135 for the RPC vulnerability. Once a host is infected, it sends packets to port 135 tcp with variation of dcom.c exploit to a target vulnerable system. A remote shell on port 4444 is established on the vulnerable system. The infected host now sends the tftp get command to the target machine via the shell on port 4444. The viral binary is then loaded on to the system.
The worm also attempts to launch a Denial of Service to windowsupdate.com on date later than 15th August and prior to December 31. Once the Denial of Service is launched, it is possible that users will have difficulty to download the patch. Thus is highly recommended to have all vulnerable systems be patched as soon as possible.
#### 1.2 System Affected
- Microsoft Windows NT 4.0
- Microsoft Windows 2000
- Microsoft Windows XP
- Microsoft Windows Server 2003
#### 1.3 Aliases
W32/Lovsan. worm
Lovsan
Poza
Blaster
MSBlaster
### 2.0 Technical Matters
The worm's binary is msblast.exe. It is packed with UPX and self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed: MD5sum packed: 5ae700c1dffb00cef492844a4db6cd69 (6176 Bytes) The worm scans for machines which has port 135 listening, at random IP addresses. It uses multiple TFTP servers to pull the viral binary and adds a registry key to start itself after reboot.
#### 2.1 Impact
The worm will cause system to reboot on Windows XP and affects the system performance on Win2000. It also opens a hidden remote cmd.exe session. It may also cause a Denial of Service effect within the network if removal is not done immediately.
### 3.0 Possible Steps
#### 3.1 Prevention
**3.1.1 Network**
Sites are encouraged to block network access to the following relevant ports at network gateways. This can minimize the potential of denial-of-service attacks originating from outside or within the perimeter. The specific services that should be blocked include:
- 69/UDP
- 135/TCP
- 135/UDP
- 139/TCP
- 139/UDP
- 445/TCP
- 445/UDP
- 4444/TCP
Sites should consider blocking both inbound and outbound traffic to these ports, depending on network requirements, at the host and network level. For example some networks may require port 445 to be open for https connection. Ensure such traffic destined to only the designated servers.
Sites should consider blocking both inbound and outbound traffic to these ports, depending on network requirements, at the host and network level. For example some networks may require port 445 to be open for https connection. Ensure such traffic destined to only the designated servers.
**3.1.2 System/Host**
1. Apply the patch provided by Microsoft at:
<http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp>
2. Depending on site requirements, you may wish to disable DCOM as described in:
<http://microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp>
Disabling DCOM will help protect against this vulnerability but may also cause undesirable side effects. Additional details on disabling DCOM and possible side effects are available in Microsoft Knowledge Base
Article:
<http://support.microsoft.com/default.aspx?scid=kb;en-us;825750>
#### 3.2 Detection
There are several ways of confirming if your host or network is infected:
1. The worm may reside in windows system directory such as at:
c:\windows\system32\msblaster.exe
2. Checking registry using
1. Open Registry Editor. To do this, click Start > Run, type Regedit, then press Enter.
2. In the left panel, double-click the following:
HKEY\_LOCAL\_MACHINE>Software>Microsoft>Windows>CurrentVersion>Run
3. In the right panel, if you find the following, your host is infected.
"windows auto update" = MSBLAST.EXE
3. An indication of a system being infected is that a pop -up message will appear on the screen of the machine with content as " Windows must restart now Remote Procedure Call (RPC) service" and will terminate unexpectedly.
4. If you are using Intruder Detection System in your network, you may apply the relevant filter to detect worm traffic within your network. You may then need to locate the infected system to apply the removal steps.
Snort filter for this worm is:
alert tcp $EXTERNAL\_NET any -> $HOME\_NET 135 (msg:"NETBIOS DCERPC ISystemActivator bind attempt"; flow:to\_server,established; content: "|05|"; distance:0; within:1; content:"|0b|"; distance:1; within:1; byte\_test:1,&,1,0,relative; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00 46|"; distance:29; within:16; reference:cve, CAN-2003-0352; classtype:attempted-admin; sid:2192; rev:1;)
5. ISS has produced a command-line tool that scans for systems that might be vulnerable to the MS03-026 RPC DCOM vulnerability which is available at:
<http://www.iss.net/support/product_utilities/ms03-026rpc.php>
6. Microsoft has released a KB823980 Scanning Tool that can be used to scan networks to identify host computers that do not have the 823980 Security Patch (MS03-026).
The tool is available at:
<http://support.microsoft.com/default.aspx?scid=kb;en-us;823980>
7. Retina RPC DCOM Vulnerability Scanner
<http://www.eeye.com/html/Research/Tools/Download.asp?file=RetinaRPCDCOM>
8. Foundstone RPCScan v1.01
<http://www.foundstone.com/resources/termsofuse.htm?file=rpcscan.zip>
#### 3.3 Removal and Recovery
Upon detection of the worm, you are advised to do the followings:
- Disconnect from the network
- Patch the system as described in 3.1.2a
- Remove the worm using the automated or the manual procedures provided by any one of the below:
1. Symantec security response:
<http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html>
2. Trendmicro provides a fixtool cleaner which can scan and clean individual systems:
<http://www.trendmicro.com/download/tsc.asp>
### 4.0 More Information
More information on this worm can be obtained from the following sites:
4.1 CERT/CC Advisory
<http://www.cert.org/advisories/CA-2003-20.html>
4.2 Trend Micro
<http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.A>
4.3 Symantec
<http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html>
4.4 SANS
<http://isc.sans.org/diary.html?date=2003-08-11>
4.5 F-Secure
<http://www.f-secure.com/v-descs/msblast.shtml>
4.6 ISS
<http://xforce.iss.net/xforce/alerts/id/150>