I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems?
-Jack
The following came through dshield which warns about new worm:
http://isc.sans.org/diary.html?date=2003-08-11
The worm uses the RPC DCOM vulnerability to propagate. One it finds a
vulnerable system, it will spawn a shell and use it to download the actual
worm via tftp.
The name of the binary is msblast.exe. It is packed with UPX and will self
extract. The size of the binary is about 11kByte unpacked, and 6kBytes
packed:
I left an 2k box open last night without firewall. 1 Hour following boot
time it was hit and manifested the svchost crashing. I haven't had a chance
to dig deeper to see if any sort of infection is involved but I'm leaning
towards DOS.
/micah
Sean Donelan wrote:
SANS.edu Internet Storm Center - SANS Internet Storm Center
The worm uses the RPC DCOM vulnerability to propagate. One it finds a
vulnerable system, it will spawn a shell and use it to download the actual
worm via tftp.The name of the binary is msblast.exe. It is packed with UPX and will self
extract. The size of the binary is about 11kByte unpacked, and 6kBytes
packed:
That shows what I'm seeing. 10% of all outbound packets are tcp/135. Currently blocked both directions at edges in my network until further notice. Keeping an eye on other ports, but this is the only one causing any amount of load to draw concern.
-Jack
Has anyone seen/heard of this virus propagating through email in any way?
We appear to have been infected on a network that is very heavily
firewalled from the outside, and are trying to track down possibly entry
methods the worm might have had...
- d.
"Dominic J. Eidson" wrote:
> Sean Donelan wrote:
>
> > SANS.edu Internet Storm Center - SANS Internet Storm Center
> > The worm uses the RPC DCOM vulnerability to propagate. One it finds a
> > vulnerable system, it will spawn a shell and use it to download the actual
> > worm via tftp.
> >
> > The name of the binary is msblast.exe. It is packed with UPX and will self
> > extract. The size of the binary is about 11kByte unpacked, and 6kBytes
> > packed:Has anyone seen/heard of this virus propagating through email in any way?
We appear to have been infected on a network that is very heavily
firewalled from the outside, and are trying to track down possibly entry
methods the worm might have had...
Haven't heard of that.
Dial-up?
VPN?
Notebook that goes home at night or on the road, attaches to Internet or
other hostile network, then comes in and connects up to your network the
next business day?
Thank you for all the responses, being in the middle of the fray fried my
brain a fair bit.
Possible vectors described so far: VPN, dialup, roving laptops - all of
which it could have been.
Again, thank you all.
- d.