System TipThis article applies to a different operating system than the one you are using. Article content that may not be relevant to you is disabled.
On August 11, 2003, Microsoft began investigating a worm
that was reported by Microsoft Product Support Services (PSS), and the
Microsoft PSS Security Team issued an alert to inform customers about the new
worm. A worm is a type of computer virus that generally spreads without user
action and that distributes complete copies (possibly modified) of itself
across networks (such as the Internet). Generally known as "Blaster," this new
worm exploits the vulnerability that was addressed by Microsoft Security
Bulletin MS03-026 (823980) to spread itself over networks by using open Remote
Procedure Call (RPC) ports on computers that are running any of the products
that are listed at the beginning of this article.
This article
contains information for network administrators and IT professionals about how
to prevent and how to recover from an infection from the Blaster worm and its
variants. The worm and its variants are also known as W32.Blaster.Worm,
W32.Blaster.C.Worm, W32.Blaster.B.Worm, W32.Randex.E (Symantec),
W32/Lovsan.worm (McAfee), WORM_MSBLAST.A (Trendmicro), and Win32.Posa.Worm
(Computer Associates). For additional information about recovering from this
worm, contact your antivirus software vendor.
For additional information about
antivirus software vendors, click the following article number to view the
article in the Microsoft Knowledge Base:
49500
(http://support.microsoft.com/kb/49500/
)
List of Antivirus Software Vendors
If you are a home user, visit the following
Microsoft Web site for steps to help you protect your computer and to recover
if your computer has been infected with the Blaster worm:
For additional information
about a worm that is similar to the Blaster worm and that exploits the
vulnerabilities that were addressed by Microsoft Security Bulletins MS03-026
(823980) and MS03-007 (815021), click the following article number to view the
article in the Microsoft Knowledge Base:
826234
(http://support.microsoft.com/kb/826234/
)
Virus Alert About the Nachi Worm
Your computer is not vulnerable to the Blaster worm if you
installed the 823980 security patch (MS03-026) before August 11, 2003 (the date
that this worm was discovered). You do not have to do anything else if you
installed the 823980 security patch (MS03-026) before August 11,
2003.
Microsoft tested Windows NT Workstation 4.0, Windows NT
Server 4.0, Windows NT Server 4.0, Terminal Server Edition, Windows 2000,
Windows XP, and Windows Server 2003 to assess whether they are affected by the
vulnerabilities that are addressed by Microsoft Security Bulletin MS03-026
(823980). Windows Millennium Edition does not include the features that are
associated with these vulnerabilities. Previous versions are no longer
supported, and they may or may not be affected by these vulnerabilities. For
additional information about the Microsoft Support Life Cycle, visit the
following Microsoft Web site:
The features that are associated with these vulnerabilities are
also not included with Windows 95, Windows 98, or Windows 98 Second Edition,
even if DCOM is installed. You do not have to do anything if you are using any
of these versions of Windows.
Your computer is not vulnerable to the Blaster worm if you
installed Windows XP Service Pack 2 or Update Rollup 1 for Windows 2000 Service
Pack 4. Security update 824146 is included in these service packs. You do not
have to do anything else if you installed these service packs.
For more information, click the following article
numbers to view the articles in the Microsoft Knowledge Base:
322389
(http://support.microsoft.com/kb/322389/
)
How to obtain the latest Windows XP service pack
891861
(http://support.microsoft.com/kb/891861/
)
Update Rollup 1 for Windows 2000 Service Pack 4 and known issues
If your computer is infected with this worm, you may not
experience any symptoms, or you may experience any of the following symptoms:
You may receive the following error messages:
The Remote Procedure Call (RPC) service terminated
unexpectedly. The system is shutting down. Please save all work in
progress and log off. Any unsaved changes will be lost. This
shutdown was initiated by NT AUTHORITY\SYSTEM.
The computer may shut down, or may restart repeatedly, at
random intervals.
On a Windows XP-based or on a Windows Server 2003-based
computer, a dialog box may appear that gives you the option to report the
problem to Microsoft.
If you are using Windows 2000 or Windows NT, you may
receive a Stop error message.
You may find a file that is named Msblast.exe,
Nstask32.exe, Penis32.exe, Teekids.exe, Winlogin.exe, Win32sockdrv.dll, or
Yuetyutr.dll in the Windows\System32 folder.
You may find unusual TFTP* files on your computer.
For technical details about the changes that this worm makes to
your computer, contact your antivirus software vendor.
To detect
this virus, search for a file that is named Msblast.exe, Nstask32.exe,
Penis32.exe, Teekids.exe, Winlogin.exe, Win32sockdrv.dll, or Yuetyutr.dll in
the Windows\System32 folder, or download the latest antivirus software
signature from your antivirus vendor, and then scan your computer.
To search for the these files:
Click Start, click Run,
type cmd in the Open box, and then
click OK.
At the command prompt, type dir
%systemroot%\system32\filename.ext /a
/s, and then press ENTER, where
filename.ext is Msblast.exe, Nstask32.exe,
Penis32.exe, Teekids.exe, Winlogin.exe, Win32sockdrv.dll, or
Yuetyutr.dll.
Note Repeat step 2 for each of these file names: Msblast.exe,
Nstask32.exe, Penis32.exe, Teekids.exe, Winlogin.exe, Win32sockdrv.dll, and
Yuetyutr.dll. If you find any of these files, your computer may be infected
with the worm. If you find one of these files, delete the file, and then follow
the steps in the "Recovery" section of this article. To delete the file, type
del %systemroot%\system32\filename.ext
/a at the command prompt, and then press ENTER.
To prevent this virus from infecting your computer, follow these
steps:
Turn on the Internet Connection Firewall feature (ICF) in
Windows XP, Windows Server 2003, Standard Edition, and in Windows Server 2003,
Enterprise Edition; or use Basic Firewall, Microsoft Internet Security and
Acceleration (ISA) Server 2000, or a third-party firewall to block TCP ports
135, 139, 445, and 593; UDP ports 69 (TFTP), 135, 137, and 138; and TCP port
4444 for remote command shell.
To turn on the ICF in Windows XP or
Windows Server 2003, follow these steps:
Click Start, and then click
Control Panel.
In Control Panel, double-click Networking and
Internet Connections, and then click Network
Connections.
Right-click the connection where you want to turn on
Internet Connection Firewall, and then click Properties.
Click the Advanced tab, and then
click to select the Protect my computer or network by limiting or
preventing access to this computer from the Internet check box.
Note Some dial-up connections may not appear in the Network Connection
folders. For example, AOL and MSN dial-up connections may not appear. In some
cases, you can use the following steps to turn on ICF for a connection that
does not appear in the Network Connection folder. If these steps do not work,
contact your Internet Service Provider (ISP) for information about how to
firewall your Internet connection.
Start Internet Explorer.
On the Tools menu, click
Internet Options.
Click the Connections tab, click the
dial-up connection that you use to connect to the Internet, and then click
Settings.
In the Dial-up settings area, click
Properties.
Click the Advanced tab, and then click
to select the Protect my computer or network by limiting or preventing
access to this computer from the Internet check box.
For more
information about how to turn on Internet Connection Firewall in Windows XP or
in Windows Server 2003, click the following article number to view the article
in the Microsoft Knowledge Base:
283673
(http://support.microsoft.com/kb/283673/
)
How to turn on or turn off the firewall in Windows XP
Note ICF is only available on Windows XP, Windows Server 2003,
Standard Edition, and Windows Server 2003, Enterprise Edition. Basic Firewall
is a component of Routing and Remote Access that you can enable for any public
interface on a computer that is running both Routing and Remote Access and a
member of the Windows Server 2003 family.
This worm uses a previously announced vulnerability as part
of its infection method. Because of this, you must make sure that you have
installed the 823980 security patch on all your computers to address the
vulnerability that is identified in Microsoft Security Bulletin MS03-026. Note
that the 824146 security patch replaces the 823980 security patch. Microsoft
recommends that you install the 824146 security patch that also includes fixes
for the issues that are addressed in Microsoft Security Bulletin MS03-026
(823980)
For more information about the 824146 security
patch, click the following article number to view the article in the Microsoft
Knowledge Base:
824146
(http://support.microsoft.com/kb/824146/
)
MS03-039: A buffer overrun in RPCSS could allow an attacker to run malicious programs
For more information about the 823980
security patch and any prerequisites (such as a service pack for your version
of Windows), click the following article number to view the article in the
Microsoft Knowledge Base:
823980
(http://support.microsoft.com/kb/823980/
)
MS03-026: Buffer overrun in RPC may allow code execution
To download the 824146 security patch, click the
appropriate link for your operating system:
Best practices for security suggest that you perform a complete
"clean" installation on a previously compromised computer to remove any
undiscovered exploits that can lead to a future compromise. For additional
information, visit the following Cert Advisory Web site:
However, many antivirus companies have written tools to remove
the known exploit that is associated with this particular worm. To download the
removal tool from your antivirus vendor, use the following procedures depending
on your operating system
Recovery for Windows XP, Windows Server 2003, Standard Edition, and Windows Server 2003, Enterprise Edition
Turn on the Internet Connection Firewall feature (ICF) in
Windows XP, Windows Server 2003, Standard Edition, and Windows Server 2003,
Enterprise Edition; or use Basic Firewall, Microsoft Internet Security and
Acceleration (ISA) Server 2000, or a third-party firewall.
To turn
on ICF, follow these steps:
Click Start, and then click
Control Panel.
In Control Panel, double-click Networking and
Internet Connections, and then click Network
Connections.
Right-click the connection where you want to turn on
Internet Connection Firewall, and then click Properties.
Click the Advanced tab, and then
click to select the Protect my computer or network by limiting or
preventing access to this computer from the Internet check box.
Notes
If your computer shuts down or restarts repeatedly when
you try to follow these steps, disconnect from the Internet before you turn on
your firewall. If you connect to the Internet over a broadband connection,
locate the cable that runs from your external DSL or cable modem, and then
unplug that cable either from the modem or from the telephone jack. If you use
a dial-up connection, locate the telephone cable that runs from the modem
inside your computer to your telephone jack, and then unplug that cable either
from the telephone jack or from your computer. If you cannot disconnect from
the Internet, type the following line at the command prompt to configure RPCSS
not to restart your computer when the service fails:
sc failure rpcss reset= 0 actions= restart
To reset RPCSS to default recovery setting after you complete
these steps, type the following line at the command prompt:
sc failure rpcss reset= 0 actions= reboot/60000
If you have more than one computer sharing an Internet
connection, use a firewall only on the computer that is directly connected to
the Internet. Do not use a firewall on the other computers that share the
Internet connection. If you are running Windows XP, use the Network Setup
Wizard to turn on ICF.
Using a firewall should not affect your e-mail service
or Web browsing, but a firewall can disable some Internet software, services,
or features. If this behavior occurs, you may have to open some ports on your
firewall for some Internet feature to work. See the documentation that is
included with the Internet service that is not working to determine which ports
you must open. See the documentation that is included with your firewall to
determine how to open these ports.
For more information,
click the following article number to view the article in the Microsoft
Knowledge Base:
308127
(http://support.microsoft.com/kb/308127/
)
How to manually open ports in Internet Connection Firewall in Windows XP
In some cases, you can use the following steps to turn
on ICF for a connection that does not appear in the Network Connections folder.
If these steps do not work, contact your Internet Service Provider (ISP) for
information about how to firewall your Internet connection.
Start Internet Explorer.
On the Tools menu, click
Internet Options.
Click the Connections tab, click
the dial-up connection that you use to connect to the Internet, and then click
Settings.
In the Dial-up settings area,
click Properties.
Click the Advanced tab, and then
click to select the Protect my computer or network by limiting or
preventing access to this computer from the Internet check box.
For more
information about how to turn on Internet Connection Firewall in Windows XP or
in Windows Server 2003, click the following article number to view the article
in the Microsoft Knowledge Base:
283673
(http://support.microsoft.com/kb/283673/
)
How to turn on or turn off the firewall in Windows XP
Note ICF is only available on Windows XP, Windows Server 2003,
Standard Edition, and Windows Server 2003, Enterprise Edition. Basic Firewall
is a component of Routing and Remote Access that you can enable for any public
interface on a computer that is running Routing and Remote Access and is a
member of the Windows Server 2003 family.
Download the 824146 security patch, and then install it on
all your computers to address the vulnerability that is identified in Microsoft
Security Bulletins MS03-026 and MS03-039. To download the 824146 security
patch, click the appropriate link:
Windows XP Home Edition, Windows XP Professional, Windows XP Tablet PC Edition, and Windows XP Media Center Edition
Note that the 824146 security patch replaces the 823980 security
patch. Microsoft recommends that you install the 824146 security patch that
also includes fixes for the issues addressed in Microsoft Security Bulletin
MS03-026 (823980)
For more information about the 824146 security
patch, click the following article number to view the article in the Microsoft
Knowledge Base:
824146
(http://support.microsoft.com/kb/824146/
)
MS03-039: A buffer overrun in RPCSS could allow an attacker to run malicious programs
For more information about the
823980 security patch, click the following article number to view the article
in the Microsoft Knowledge Base:
823980
(http://support.microsoft.com/kb/823980/
)
MS03-026: Buffer overrun in RPC
interface may allow code execution
Install or update your antivirus signature software, and
then run a complete system scan.
Download and run the worm-removal tool from your antivirus
vendor.
Recovery for Windows 2000 and Windows NT 4.0
The Internet Connection Firewall feature is not available in
Windows 2000 or Windows NT 4.0. If Microsoft Internet Security and Acceleration
(ISA) Server 2000 or a third-party firewall is not available to block TCP ports
135, 139, 445 and 593, UDP ports 69 (TFTP), 135, 137, and 138, and TCP port
4444 for remote command shell, follow these steps to help block the affected
ports for local area network (LAN) connections. Note that TCP/IP Filtering is
not available for Dial-up connections. If you are using a Dial-up connection to
connect to the Internet, you should enable a firewall.
Configure TCP/IP security. To do this, use the procedure
for your operating system.
Windows 2000
In Control Panel, double-click Network and
Dial-up Connections.
Right-click the interface that you use to access the
Internet, and then click Properties.
In the Components checked are used by this
connection box, click Internet Protocol (TCP/IP), and
then click Properties.
In the Internet Protocol (TCP/IP)
Properties dialog box, click Advanced.
Click the Options tab.
Click TCP/IP filtering, and then click
Properties.
Click to select the Enable TCP/IP Filtering
(All adapters) check box.
There are three columns with the following labels:
TCP Ports
UDP Ports
IP Protocols
In each column, click the Permit Only
option.
Click OK.
Notes
If your computer shuts down or restarts repeatedly
when you try to follow these steps, disconnect from the Internet before you
turn on your firewall. If you connect to the Internet over a broadband
connection, locate the cable that runs from your external DSL or cable modem,
and then unplug that cable either from the modem or from the telephone jack. If
you use a dial-up connection, locate the telephone cable that runs from the
modem inside your computer to your telephone jack, and then unplug that cable
either from the telephone jack or from your computer.
If you have more than one computer sharing an
Internet connection, use a firewall only on the computer that is directly
connected to the Internet. Do not use a firewall on the other computers that
share the Internet connection.
Using a firewall should not affect your e-mail
service or Web browsing, but a firewall can disable some Internet software,
services, or features. If this behavior occurs, you may have to open some ports
on your firewall for some Internet feature to work. See the documentation that
is included with the Internet service that is not working to determine which
ports you must open. See the documentation that is included with your firewall
to determine how to open these ports.
These steps are based on a modified excerpt from
Microsoft Knowledge Base article 309798.
For more information,
click the following article number to view the article in the Microsoft
Knowledge Base:
309798
(http://support.microsoft.com/kb/309798/
)
How to configure TCP/IP filtering in Windows 2000
Windows NT 4.0
In Control Panel, double-click
Network.
Click the Protocol tab, click
TCP/IP Protocol, and then click
Properties.
Click the IP Address tab, and then
click Advanced.
Click to select the Enable Security
check box, and then click Configure.
In the TCP Ports, UDP
Ports, and IP Protocols columns, click to select the
Permit only setting.
Click OK, and then close the Network
tool.
Download the 824146 security patch, and then install it on
all your computers to address the vulnerability that is identified in Microsoft
Security Bulletins MS03-026 and MS03-039. To download the 824146 security
patch, click the appropriate link:
Note that the 824146 security patch replaces the 823980 security
patch. Microsoft recommends that you install the 824146 security patch that
also includes fixes for the issues addressed in Microsoft Security Bulletin
MS03-026 (823980)
For more information about the 824146 security
patch, click the following article number to view the article in the Microsoft
Knowledge Base:
824146
(http://support.microsoft.com/kb/824146/
)
MS03-039: A buffer overrun in RPCSS could allow an attacker to run malicious programs
For more information about the 823980
security patch and any prerequisites (such as a service pack for your version
of Windows), click the following article number to view the article in the
Microsoft Knowledge Base:
823980
(http://support.microsoft.com/kb/823980/
)
MS03-026: Buffer overrun in RPC may allow code execution
Install or update your antivirus signature software, and
then run a complete system scan.
Download and run the worm-removal tool from your antivirus
vendor.
For additional technical details about the Blaster worm from
antivirus software vendors who are participating in the Microsoft Virus
Information Alliance (VIA), visit any of the following third-party Web sites:
Note If you do not have to use TCP filtering, you may want to disable
TCP filtering after you apply the fix that is described in this article and you
have verified that you have successfully removed the worm.
For
additional technical details about known variants of the Blaster worm, visit
the following Symantec Web sites:
For additional information about how to recover from this worm,
contact your antivirus vendor.
Microsoft provides third-party
contact information to help you find technical support. This contact
information may change without notice. Microsoft does not guarantee the
accuracy of this third-party contact information.
For the most current information from Microsoft about this worm, visit the Microsoft Virus Solution and Security Center
(http://go.microsoft.com/fwlink/?LinkId=242148)
for resources and tools to keep your PC safe and healthy. If you are having issues with installing the update itself, visit Support for Microsoft Update
(http://go.microsoft.com/fwlink/?LinkId=242149)
for resources and tools to keep your PC updated with the latest updates.
office. To
obtain support for virus-related issues, visit the following Microsoft Virus
Support Newsgroup Web site:
Windows Live
Facebook
Twitter
Linkedin
Digg it
Yahoo
Delicious
StumbleUpon
Yammer
Reddit
Technorati
FriendFeed
Email
Back to the top
