# MA-072.042004: MyCERT Alert - New Worm Thread Related to Microsoft Windows LSASS Vulnerability

**Date:** 30 Apr 2004  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-072.042004  
**Advisory ID:** MA-072.042004

---

#### On 13th April Microsoft Corporation released a series of security bulletins which affect most users of the Microsoft Windows operating system.
The Security Bulletin MS04-011: Security Update for Microsoft Windows (835732) addresses 14 vulnerabilities affecting the Windows systems.
Detail information on the Security Bulletin MS04-011 is available at:
> http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
Among the 14 vulnerabilities mentioned in the above bulletin is the Windows Local Security Authority Subsystem Service (LSASS) vulnerability which allows remote attackers could execute arbitrary code on vulnerable systems and may permit an attacker to the system-completely.
Details on the LSASS vulnerability is available at:
> CERT Incident Note
> http://www.kb.cert.org/vuls/id/753212
>
> Eeye Digital
> http://www.eeye.com/html/Research/Advisories/AD20040413C.html
With regards to the LSASS Vulnerability, MyCERT received latest information and reports regarding the spread of a possible thread of worm 
The Internet Storm Center, which is operated by the SysAdmin, Audit, Network, Security Institute (SANS), found evidence of a code that takes advantage of another, more widespread vulnerability. That flaw, in a Windows security component known as the Local Security Authority Subsystem Service (LSASS), is added to an automated attack agent, or bot, known as AgoBot. Such programs run invisibly on a compromised computer, giving an intruder full control over the system and the ability to use the PC in attacks.
Symantec confirmed that it has also captured a version of the AgoBot program, known as PhatBot. This program appears to have the ability to attack systems through the LSASS vulnerability.
More information on this possible new worm is available at:
1. **Symantec**
W32.Gaobot.AFC
http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.afc.html
*Note the file is: "%SysDir%wmiprvsw.exe"*
W32.Gaobot.AFJ
http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.afj.html
*Note the file is: "%SysDir%\msiwin84.exe"*
2. **McAfee**
Exploit-MS04-011
http://vil.nai.com/vil/content/v\_124974.htm
W32/Gaobot.worm.ali
http://vil.nai.com/vil/content/v\_125006.htm
http://us.mcafee.com/virusInfo/default.asp?id=description&virus\_k=125006
We have tested in our lab and below are some of the symptoms that will be noticed on infected machine screen:
Some foreign organizations observed hosts started scanning out for ports 2745, 135, 1025, 445, 80, 3127, 139, 1433, and 5000. MyCERT has not received any reports from local users/organizations regarding the attack yet. However, it keeps monitor on this activity closely and will release immediate alerts/advisories if necessary on its websites, MyCERT’s mailing lists, via SMS alert to subscribers and local newspapers.
MyCERT urged users/organizations to critically apply patches against the LSASS vulnerability as well as other vulnerabilities as listed in the Security Bulletin MS04-011. It is strongly advised for this effort to take place prior to the long break/holiday this weekend preventing any unwanted incidents from happening.
Nevertheless, MyCERT is available for assistance and can be reached even during weekends and public holidays at:
Tel: 03-89961901
Fax: 03-89960827
Email: [[email protected]](/cdn-cgi/l/email-protection)
https://www.mycert.org.my
Pager (24x7): https://www.mycert.org.my/report/pager/IRpager.html