Virus alert about the Blaster worm and its variants (826955)


The information in this article applies to:

  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Datacenter Edition
  • Microsoft Windows Server 2003, 64-Bit Enterprise Edition
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Home Edition
  • Microsoft Windows XP Media Center Edition
  • Microsoft Windows XP Tablet PC Edition
  • Microsoft Windows XP 64-Bit Edition Version 2003
  • Microsoft Windows XP 64-Bit Edition Version 2002
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Datacenter Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows NT Server
  • Microsoft Windows NT Advanced Server
  • Microsoft Windows NT Server, Enterprise Edition
  • Microsoft Windows NT Workstation 4.0
  • Microsoft Windows NT Server 4.0 Terminal Server Edition

SUMMARY

On August 11, 2003, Microsoft began investigating a worm that was reported by Microsoft Product Support Services (PSS), and the Microsoft PSS Security Team issued an alert to inform customers about the new worm. A worm is a type of computer virus that generally spreads without user action and that distributes complete copies (possibly modified) of itself across networks (such as the Internet). Generally known as "Blaster," this new worm exploits the vulnerability that was addressed by Microsoft Security Bulletin MS03-026 (823980) to spread itself over networks by using open Remote Procedure Call (RPC) ports on computers that are running any of the products that are listed at the beginning of this article.

This article contains information for network administrators and IT professionals about how to prevent and how to recover from an infection from the Blaster worm and its variants. The worm and its variants are also known as W32.Blaster.Worm, W32.Blaster.C.Worm, W32.Blaster.B.Worm, W32.Randex.E (Symantec), W32/Lovsan.worm (McAfee), WORM_MSBLAST.A (Trendmicro), and Win32.Posa.Worm (Computer Associates). For additional information about recovering from this worm, contact your antivirus software vendor. For additional information about antivirus software vendors, click the following article number to view the article in the Microsoft Knowledge Base:

49500 List of Antivirus Software Vendors

If you are a home user, visit the following Microsoft Web site for steps to help you protect your computer and to recover if your computer has been infected with the Blaster worm:

http://www.microsoft.com/security/incident/blast.mspx

For additional information about a worm that is similar to the Blaster worm and that exploits the vulnerabilities that were addressed by Microsoft Security Bulletins MS03-026 (823980) and MS03-007 (815021), click the following article number to view the article in the Microsoft Knowledge Base:

826234 Virus Alert About the Nachi Worm

Notes

  • Your computer is not vulnerable to the Blaster worm if you installed the 823980 security patch (MS03-026) before August 11, 2003 (the date that this worm was discovered). You do not have to do anything else if you installed the 823980 security patch (MS03-026) before August 11, 2003.
  • Microsoft tested Windows NT Workstation 4.0, Windows NT Server 4.0, Windows NT Server 4.0, Terminal Server Edition, Windows 2000, Windows XP, and Windows Server 2003 to assess whether they are affected by the vulnerabilities that are addressed by Microsoft Security Bulletin MS03-026 (823980). Windows Millennium Edition does not include the features that are associated with these vulnerabilities. Previous versions are no longer supported, and they may or may not be affected by these vulnerabilities. For additional information about the Microsoft Support Life Cycle, visit the following Microsoft Web site:

    http://support.microsoft.com/default.aspx?scid=fh;en-us;lifecycle

    The features that are associated with these vulnerabilities are also not included with Windows 95, Windows 98, or Windows 98 Second Edition, even if DCOM is installed. You do not have to do anything if you are using any of these versions of Windows.
  • Your computer is not vulnerable to the Blaster worm if you installed Windows XP Service Pack 2 or Update Rollup 1 for Windows 2000 Service Pack 4. Security update 824146 is included in these service packs. You do not have to do anything else if you installed these service packs. For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

    322389 How to obtain the latest Windows XP service pack

    891861 Update Rollup 1 for Windows 2000 Service Pack 4 and known issues

MORE INFORMATION

Symptoms of Infection

If your computer is infected with this worm, you may not experience any symptoms, or you may experience any of the following symptoms:
  • You may receive the following error messages:
    The Remote Procedure Call (RPC) service terminated unexpectedly.
    The system is shutting down. Please save all work in progress and log off.
    Any unsaved changes will be lost.
    This shutdown was initiated by NT AUTHORITY\SYSTEM.
  • The computer may shut down, or may restart repeatedly, at random intervals.
  • On a Windows XP-based or on a Windows Server 2003-based computer, a dialog box may appear that gives you the option to report the problem to Microsoft.
  • If you are using Windows 2000 or Windows NT, you may receive a Stop error message.
  • You may find a file that is named Msblast.exe, Nstask32.exe, Penis32.exe, Teekids.exe, Winlogin.exe, Win32sockdrv.dll, or Yuetyutr.dll in the Windows\System32 folder.
  • You may find unusual TFTP* files on your computer.

Technical Details

For technical details about the changes that this worm makes to your computer, contact your antivirus software vendor.

To detect this virus, search for a file that is named Msblast.exe, Nstask32.exe, Penis32.exe, Teekids.exe, Winlogin.exe, Win32sockdrv.dll, or Yuetyutr.dll in the Windows\System32 folder, or download the latest antivirus software signature from your antivirus vendor, and then scan your computer.

To search for the these files:
  1. Click Start, click Run, type cmd in the Open box, and then click OK.
  2. At the command prompt, type dir %systemroot%\system32\filename.ext /a /s, and then press ENTER, where filename.ext is Msblast.exe, Nstask32.exe, Penis32.exe, Teekids.exe, Winlogin.exe, Win32sockdrv.dll, or Yuetyutr.dll.

    Note Repeat step 2 for each of these file names: Msblast.exe, Nstask32.exe, Penis32.exe, Teekids.exe, Winlogin.exe, Win32sockdrv.dll, and Yuetyutr.dll. If you find any of these files, your computer may be infected with the worm. If you find one of these files, delete the file, and then follow the steps in the "Recovery" section of this article. To delete the file, type del %systemroot%\system32\filename.ext /a at the command prompt, and then press ENTER.

Prevention

To prevent this virus from infecting your computer, follow these steps:
  1. Turn on the Internet Connection Firewall feature (ICF) in Windows XP, Windows Server 2003, Standard Edition, and in Windows Server 2003, Enterprise Edition; or use Basic Firewall, Microsoft Internet Security and Acceleration (ISA) Server 2000, or a third-party firewall to block TCP ports 135, 139, 445, and 593; UDP ports 69 (TFTP), 135, 137, and 138; and TCP port 4444 for remote command shell.

    To turn on the ICF in Windows XP or Windows Server 2003, follow these steps:
    1. Click Start, and then click Control Panel.
    2. In Control Panel, double-click Networking and Internet Connections, and then click Network Connections.
    3. Right-click the connection where you want to turn on Internet Connection Firewall, and then click Properties.
    4. Click the Advanced tab, and then click to select the Protect my computer or network by limiting or preventing access to this computer from the Internet check box.
    Note Some dial-up connections may not appear in the Network Connection folders. For example, AOL and MSN dial-up connections may not appear. In some cases, you can use the following steps to turn on ICF for a connection that does not appear in the Network Connection folder. If these steps do not work, contact your Internet Service Provider (ISP) for information about how to firewall your Internet connection.
    1. Start Internet Explorer.
    2. On the Tools menu, click Internet Options.
    3. Click the Connections tab, click the dial-up connection that you use to connect to the Internet, and then click Settings.
    4. In the Dial-up settings area, click Properties.
    5. Click the Advanced tab, and then click to select the Protect my computer or network by limiting or preventing access to this computer from the Internet check box.
    For more information about how to turn on Internet Connection Firewall in Windows XP or in Windows Server 2003, click the following article number to view the article in the Microsoft Knowledge Base:

    283673 How to turn on or turn off the firewall in Windows XP

    Note ICF is only available on Windows XP, Windows Server 2003, Standard Edition, and Windows Server 2003, Enterprise Edition. Basic Firewall is a component of Routing and Remote Access that you can enable for any public interface on a computer that is running both Routing and Remote Access and a member of the Windows Server 2003 family.
  2. This worm uses a previously announced vulnerability as part of its infection method. Because of this, you must make sure that you have installed the 823980 security patch on all your computers to address the vulnerability that is identified in Microsoft Security Bulletin MS03-026. Note that the 824146 security patch replaces the 823980 security patch. Microsoft recommends that you install the 824146 security patch that also includes fixes for the issues that are addressed in Microsoft Security Bulletin MS03-026 (823980) For more information about the 824146 security patch, click the following article number to view the article in the Microsoft Knowledge Base:

    824146 MS03-039: A buffer overrun in RPCSS could allow an attacker to run malicious programs

    For more information about the 823980 security patch and any prerequisites (such as a service pack for your version of Windows), click the following article number to view the article in the Microsoft Knowledge Base:

    823980 MS03-026: Buffer overrun in RPC may allow code execution

    To download the 824146 security patch, click the appropriate link for your operating system:
  3. Use the latest virus-detection signature from your antivirus vendor to detect new viruses and their variants.

Recovery

Best practices for security suggest that you perform a complete "clean" installation on a previously compromised computer to remove any undiscovered exploits that can lead to a future compromise. For additional information, visit the following Cert Advisory Web site:

http://www.cert.org/tech_tips/win-UNIX-system_compromise.html

However, many antivirus companies have written tools to remove the known exploit that is associated with this particular worm. To download the removal tool from your antivirus vendor, use the following procedures depending on your operating system

Recovery for Windows XP, Windows Server 2003, Standard Edition, and Windows Server 2003, Enterprise Edition

  1. Turn on the Internet Connection Firewall feature (ICF) in Windows XP, Windows Server 2003, Standard Edition, and Windows Server 2003, Enterprise Edition; or use Basic Firewall, Microsoft Internet Security and Acceleration (ISA) Server 2000, or a third-party firewall.

    To turn on ICF, follow these steps:
    1. Click Start, and then click Control Panel.
    2. In Control Panel, double-click Networking and Internet Connections, and then click Network Connections.
    3. Right-click the connection where you want to turn on Internet Connection Firewall, and then click Properties.
    4. Click the Advanced tab, and then click to select the Protect my computer or network by limiting or preventing access to this computer from the Internet check box.
    Notes
    • If your computer shuts down or restarts repeatedly when you try to follow these steps, disconnect from the Internet before you turn on your firewall. If you connect to the Internet over a broadband connection, locate the cable that runs from your external DSL or cable modem, and then unplug that cable either from the modem or from the telephone jack. If you use a dial-up connection, locate the telephone cable that runs from the modem inside your computer to your telephone jack, and then unplug that cable either from the telephone jack or from your computer. If you cannot disconnect from the Internet, type the following line at the command prompt to configure RPCSS not to restart your computer when the service fails:

      sc failure rpcss reset= 0 actions= restart

      To reset RPCSS to default recovery setting after you complete these steps, type the following line at the command prompt:

      sc failure rpcss reset= 0 actions= reboot/60000

    • If you have more than one computer sharing an Internet connection, use a firewall only on the computer that is directly connected to the Internet. Do not use a firewall on the other computers that share the Internet connection. If you are running Windows XP, use the Network Setup Wizard to turn on ICF.
    • Using a firewall should not affect your e-mail service or Web browsing, but a firewall can disable some Internet software, services, or features. If this behavior occurs, you may have to open some ports on your firewall for some Internet feature to work. See the documentation that is included with the Internet service that is not working to determine which ports you must open. See the documentation that is included with your firewall to determine how to open these ports. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

      308127 How to manually open ports in Internet Connection Firewall in Windows XP

    • In some cases, you can use the following steps to turn on ICF for a connection that does not appear in the Network Connections folder. If these steps do not work, contact your Internet Service Provider (ISP) for information about how to firewall your Internet connection.
      1. Start Internet Explorer.
      2. On the Tools menu, click Internet Options.
      3. Click the Connections tab, click the dial-up connection that you use to connect to the Internet, and then click Settings.
      4. In the Dial-up settings area, click Properties.
      5. Click the Advanced tab, and then click to select the Protect my computer or network by limiting or preventing access to this computer from the Internet check box.
    For more information about how to turn on Internet Connection Firewall in Windows XP or in Windows Server 2003, click the following article number to view the article in the Microsoft Knowledge Base:

    283673 How to turn on or turn off the firewall in Windows XP

    Note ICF is only available on Windows XP, Windows Server 2003, Standard Edition, and Windows Server 2003, Enterprise Edition. Basic Firewall is a component of Routing and Remote Access that you can enable for any public interface on a computer that is running Routing and Remote Access and is a member of the Windows Server 2003 family.
  2. Download the 824146 security patch, and then install it on all your computers to address the vulnerability that is identified in Microsoft Security Bulletins MS03-026 and MS03-039. To download the 824146 security patch, click the appropriate link:

    Windows XP Home Edition, Windows XP Professional, Windows XP Tablet PC Edition, and Windows XP Media Center Edition

    http://download.microsoft.com/download/C/D/D/CDD7AC92-E4CC-4B1E-BC2F-7A61B46B23BF/WindowsXP-KB824146-x86-ENU.exe

    Windows XP 64-Bit Version 2002

    http://download.microsoft.com/download/A/C/E/ACE7FE00-4BF7-4421-8CCF-2913395500AA/WindowsXP-KB824146-ia64-ENU.exe

    Note that the 824146 security patch replaces the 823980 security patch. Microsoft recommends that you install the 824146 security patch that also includes fixes for the issues addressed in Microsoft Security Bulletin MS03-026 (823980) For more information about the 824146 security patch, click the following article number to view the article in the Microsoft Knowledge Base:

    824146 MS03-039: A buffer overrun in RPCSS could allow an attacker to run malicious programs

    For more information about the 823980 security patch, click the following article number to view the article in the Microsoft Knowledge Base:

    823980 MS03-026: Buffer overrun in RPC interface may allow code execution

  3. Install or update your antivirus signature software, and then run a complete system scan.
  4. Download and run the worm-removal tool from your antivirus vendor.

Recovery for Windows 2000 and Windows NT 4.0

The Internet Connection Firewall feature is not available in Windows 2000 or Windows NT 4.0. If Microsoft Internet Security and Acceleration (ISA) Server 2000 or a third-party firewall is not available to block TCP ports 135, 139, 445 and 593, UDP ports 69 (TFTP), 135, 137, and 138, and TCP port 4444 for remote command shell, follow these steps to help block the affected ports for local area network (LAN) connections. Note that TCP/IP Filtering is not available for Dial-up connections. If you are using a Dial-up connection to connect to the Internet, you should enable a firewall.
  1. Configure TCP/IP security. To do this, use the procedure for your operating system.

    Windows 2000
    1. In Control Panel, double-click Network and Dial-up Connections.
    2. Right-click the interface that you use to access the Internet, and then click Properties.
    3. In the Components checked are used by this connection box, click Internet Protocol (TCP/IP), and then click Properties.
    4. In the Internet Protocol (TCP/IP) Properties dialog box, click Advanced.
    5. Click the Options tab.
    6. Click TCP/IP filtering, and then click Properties.
    7. Click to select the Enable TCP/IP Filtering (All adapters) check box.
    8. There are three columns with the following labels:
      • TCP Ports
      • UDP Ports
      • IP Protocols
      In each column, click the Permit Only option.
    9. Click OK.

      Notes
      • If your computer shuts down or restarts repeatedly when you try to follow these steps, disconnect from the Internet before you turn on your firewall. If you connect to the Internet over a broadband connection, locate the cable that runs from your external DSL or cable modem, and then unplug that cable either from the modem or from the telephone jack. If you use a dial-up connection, locate the telephone cable that runs from the modem inside your computer to your telephone jack, and then unplug that cable either from the telephone jack or from your computer.
      • If you have more than one computer sharing an Internet connection, use a firewall only on the computer that is directly connected to the Internet. Do not use a firewall on the other computers that share the Internet connection.
      • Using a firewall should not affect your e-mail service or Web browsing, but a firewall can disable some Internet software, services, or features. If this behavior occurs, you may have to open some ports on your firewall for some Internet feature to work. See the documentation that is included with the Internet service that is not working to determine which ports you must open. See the documentation that is included with your firewall to determine how to open these ports.
      • These steps are based on a modified excerpt from Microsoft Knowledge Base article 309798. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

        309798 How to configure TCP/IP filtering in Windows 2000

    Windows NT 4.0
    1. In Control Panel, double-click Network.
    2. Click the Protocol tab, click TCP/IP Protocol, and then click Properties.
    3. Click the IP Address tab, and then click Advanced.
    4. Click to select the Enable Security check box, and then click Configure.
    5. In the TCP Ports, UDP Ports, and IP Protocols columns, click to select the Permit only setting.
    6. Click OK, and then close the Network tool.
  2. Download the 824146 security patch, and then install it on all your computers to address the vulnerability that is identified in Microsoft Security Bulletins MS03-026 and MS03-039. To download the 824146 security patch, click the appropriate link:

    Windows NT Workstation 4.0

    http://download.microsoft.com/download/3/0/c/30cff3cd-414d-4754-b9db-276de8161eef/WindowsNT4Workstation-KB824146-x86-ENU.EXE

    Windows NT Server 4.0

    http://download.microsoft.com/download/6/2/1/6216d162-1283-4e05-a505-3dc67b70155c/WindowsNT4Server-KB824146-x86-ENU.EXE

    Windows NT Server 4.0, Terminal Server Edition

    http://download.microsoft.com/download/8/b/5/8b534384-5ce7-482d-8886-7c3dac565f51/WindowsNT4TerminalServer-KB824146-x86-ENU.EXE

    Windows 2000

    http://download.microsoft.com/download/0/A/6/0A634E35-F29A-4F26-B006-D315E898EDEF/Windows2000-KB824146-x86-ENU.exe

    Note that the 824146 security patch replaces the 823980 security patch. Microsoft recommends that you install the 824146 security patch that also includes fixes for the issues addressed in Microsoft Security Bulletin MS03-026 (823980) For more information about the 824146 security patch, click the following article number to view the article in the Microsoft Knowledge Base:

    824146 MS03-039: A buffer overrun in RPCSS could allow an attacker to run malicious programs

    For more information about the 823980 security patch and any prerequisites (such as a service pack for your version of Windows), click the following article number to view the article in the Microsoft Knowledge Base:

    823980 MS03-026: Buffer overrun in RPC may allow code execution

  3. Install or update your antivirus signature software, and then run a complete system scan.
  4. Download and run the worm-removal tool from your antivirus vendor.
For additional technical details about the Blaster worm from antivirus software vendors who are participating in the Microsoft Virus Information Alliance (VIA), visit any of the following third-party Web sites:Note If you do not have to use TCP filtering, you may want to disable TCP filtering after you apply the fix that is described in this article and you have verified that you have successfully removed the worm.

For additional technical details about known variants of the Blaster worm, visit the following Symantec Web sites:For more information about the Microsoft Virus Information Alliance, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/alerts/info/via.mspx

For additional information about how to recover from this worm, contact your antivirus vendor.

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

REFERENCES

For the most current information from Microsoft about this worm, visit the following Microsoft Web site:

http://www.microsoft.com/security/incident/blast.mspx

If you have any questions about this alert, contact your Microsoft representative or call 1-866-727-2338 (1-866-PCSafety) in the United States. Outside the United States, contact your local Microsoft office. To obtain support for virus-related issues, visit the following Microsoft Virus Support Newsgroup Web site:

news://msnews.microsoft.com/microsoft.public.security.virus

For additional security-related information about Microsoft products, visit the following Microsoft Web site:

http://www.microsoft.com/security/default.asp

For additional security-related information about Microsoft Security Bulletins MS03-026 and MS03-039, visit the following Microsoft Web sites:

http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/ms03-026.asp
http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS03-039.mspx

Modification Type:MinorLast Reviewed:6/13/2006
Keywords:kbdownload kbvirus kbSECAntiVirus kberrmsg KB826955 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.