FussyPucker
08-13-2003, 07:01 AM
you might have read about it but this is a pretty sneaky virus since it doesn't need you to do anything other be connected to the internet to infect you and other computers. here's the info on it.....(fix and remove tools available from mcirosoft and symantec or me)
Based on the number of submissions received from customers and based on information from the Symantec's DeepSight Threat Management System, Symantec Security Response has upgraded this threat to a Category 4 from a Category 3 threat.
W32.Blaster.Worm is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. This worm attempts to download the msblast.exe file to the %WinDir%\system32 directory and execute it.
Block access to TCP port 4444 at the firewall level, and then block the following ports, if they do not use the applications listed:
TCP Port 135, "DCOM RPC"
UDP Port 69, "TFTP"
The worm also attempts to perform a Denial of Service (DoS) on Windows Update. This is an attempt to prevent you from applying a patch on your computer against the DCOM RPC vulnerability.
Click here for more information on the vulnerability that this worm exploits, and to find out which Symantec products can help mitigate risks from this vulnerability.
NOTE: This threat will be detected by virus definitions having:
Defs Version: 50811s
Sequence Number: 24254
Extended Version: 8/11/2003, rev. 19
Symantec Security Response has developed a removal tool to clean infections of W32.Blaster.Worm.
Anyone that uses a decent firewall system should be safe enough. This virus attacks systems running Windows 2000 and Windows XP it can infect NT 4 and windows 2003 systems too.
if don't want to search through the MS and Symantec websites for the fix and removal tools I've downloaded them they'll be on my web site for a couple of days.
http://www.fluffyknight.co.uk/fix.zip
Based on the number of submissions received from customers and based on information from the Symantec's DeepSight Threat Management System, Symantec Security Response has upgraded this threat to a Category 4 from a Category 3 threat.
W32.Blaster.Worm is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. This worm attempts to download the msblast.exe file to the %WinDir%\system32 directory and execute it.
Block access to TCP port 4444 at the firewall level, and then block the following ports, if they do not use the applications listed:
TCP Port 135, "DCOM RPC"
UDP Port 69, "TFTP"
The worm also attempts to perform a Denial of Service (DoS) on Windows Update. This is an attempt to prevent you from applying a patch on your computer against the DCOM RPC vulnerability.
Click here for more information on the vulnerability that this worm exploits, and to find out which Symantec products can help mitigate risks from this vulnerability.
NOTE: This threat will be detected by virus definitions having:
Defs Version: 50811s
Sequence Number: 24254
Extended Version: 8/11/2003, rev. 19
Symantec Security Response has developed a removal tool to clean infections of W32.Blaster.Worm.
Anyone that uses a decent firewall system should be safe enough. This virus attacks systems running Windows 2000 and Windows XP it can infect NT 4 and windows 2003 systems too.
if don't want to search through the MS and Symantec websites for the fix and removal tools I've downloaded them they'll be on my web site for a couple of days.
http://www.fluffyknight.co.uk/fix.zip