(Accompanying <a href="http://www.cert.org/advisories/CA-2003-20.html">CERT Advisory CA-2003-20</a>)
<br>
<h3>Steps to recover from W32/Blaster</h3>
<p>
These instructions are designed for Windows XP. Under some circumstances, these instructions may not completely disable the worm or protect the system from re-infection. See <a href="#notes">Notes</a>.
</p>
<a name="1"></a>
<ol>
<p><li>Physically disconnect the computer from the network (remove phone/network cable, wireless card).
</li></p>
<a name="2"></a>
<p><li>Kill the worm process using Task Manager. Known variants of this worm may show up as "msblast.exe", "teekids.exe", or "penis32.exe".
<ol type="a">
<li>Press Ctrl-Alt-Delete key combination.</li>
<li>Click "Task Manager" button.</li>
<li>Select "Processes" tab.</li>
<li>Highlight "msblast.exe".</li>
<li>Click "End Process" button, answer "Yes" to warning dialog.</li>
<li>Repeat previous two steps for "teekids.exe" and "penis32.exe".</li>
</ol>
</li></p>
<a name="3"></a>
<p><li>Delete any files named "msblast.exe", "teekids.exe", or "penis32.exe" on the computer.
<ol type="a">
<li>Click "Start", "Search", and select "All files and folders".</li>
<li>Search for "msblast.exe".</li>
<li>Right-click each file and delete it.</li>
<li>Repeat previous two steps for "teekids.exe" and "penis32.exe".</li>
</ol>
</li></p>
<a name="4"></a>
<p><li>Enable Internet Connection Firewall (ICF).<br>
From Microsoft Knowledge Base Article <a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;283673">283673</a>:
<ol type="a">
<li>In Control Panel, double-click Networking and Internet Connections, and then click Network Connections.</li>
<li>Right-click the connection on which you would like to enable ICF, and then click Properties.</li>
<li>On the Advanced tab, click the box to select the option to Protect my computer or network.</li>
<li>If you want to enable the use of some applications and services through the firewall, you need to enable them by clicking the Settings button, and then selecting the programs, protocols, and services to be enabled for the ICF configuration.</li>
</ol>
</li></p>
<a name="5"></a>
<p><li>(Optional) Disable DCOM.<br>
From <a href="http://microsoft.com/technet/security/bulletin/MS03-026.asp">MS03-026</a>:
<ol type="a">
<li>Run Dcomcnfg.exe.<br>
If you are running Windows XP or Windows Server 2003 perform these additional steps:
<ul type="disc">
<li>Click on the Component Services node under Console Root.</li>
<li>Open the Computers sub-folder.</li>
<li>For the local computer, right click on My Computer and choose Properties.</li>
<li>For a remote computer, right click on the Computers folder and choose New then Computer. Enter the computer name. Right click on that computer name and choose Properties.</li>
</ul>
<li>Choose the Default Properties tab.</li>
<li>Select (or clear) the Enable Distributed COM on this Computer check box.</li>
<li>If you will be setting more properties for the machine, click the Apply button to enable (or disable) DCOM. Otherwise, click OK to apply the changes and exit Dcomcnfg.exe.</li>
</ol>
</li></p>
<a name="6"></a>
<p><li>Reboot your computer and reconnect to the network.
</li></p>
<a name="7"></a>
<p><li>Install the patch from <a href="http://windowsupdate.microsoft.com/">Windows Update</a> or <a href="http://microsoft.com/technet/security/bulletin/MS03-026.asp">MS03-026</a>.
<ol type="a">
<li>Using Internet Explorer, go to <a href="http://windowsupdate.microsoft.com/">Windows Update</a> and follow the instructions there to install any available patches.</li>
<li>After installing the patch, reboot your computer.</li>
</ol>
</li></p>
<a name="8"></a>
<p><li>Read and apply the clean up measures outlined in <a href="http://microsoft.com/technet/security/bulletin/MS03-026.asp">MS03-026</a>.
<ol type="a">
<li>If you disabled DCOM in step <a href="#5">5</a>, you will probably want to re-enable it.</li>
</ol>
</li></p>
</ol>
<a name="notes"></a>
<h4>Notes</h4>
<p>
<ul>
<li>It is possible to stop the shutdown process by typing the following at a command prompt:<br>
<font face="courier">shutdown -a</font></li>
<li>If you are unable to run the Task Manager (step <a href="#2">2</a>) or the Search function (step <a href="#3">3</a>), type the following at a command prompt:<br>
<font face="courier">taskkill.exe /im msblast.exe</font><br>
<font face="courier">del %windir%\system32\msblast.exe</font><br>
Replace "msblast.exe" with other process/file names as necessary.
</li>
<li>You may not find the processes (step <a href="#2">2</a>) and files (step <a href="#3">3</a>) listed above, in which case your computer is not infected. If you are connected to the network, your computer may still be rebooting due to scan/attack traffic. If you do not find the processes and files, continue with step <a href="#4">4</a>.</li>
<li>The worm may exist as processes and files with names other than "msblast.exe", "teekids.exe", or "penis32.exe.".</li>
<li>It may be necessary to <a href="http://www.microsoft.com/technet/prodtechnol/winxppro/Plan/FAQSRWXP.asp?frame=true#b">disable System Restore</a> in order to successfully delete worm files.</li>
<li>Save yourself the trouble next time by blocking 135, 137, 138, 139, and 445 tcp and udp inbound and outbound. This will block most MS networking traffic. Leaving ICF enabled will stop unsolicited inbound network traffic. Unless it breaks something, leave ICF enabled.</li>
<li>Another type of host-based or network firewall can be used to block 135/tcp.</li>
<li>Use anti-virus software and maintain updated signatures. Many <a href="http://www.cert.org/other_sources/viruses.html#VI">anti-virus vendors</a> have developed removal tools for this worm.</li>
<li>The worm is started by a registry key in HKLM\Software\Microsoft\Windows\CurrentVersion\Run. The key is typically named "windows auto update" or "Microsoft Inet xp.." and has a value of "msblast.exe", "teekids.exe", or "penis32.exe". If you are comfortable editing the registry, delete this key.</li>
<li>Disabling DCOM may break things and may be unnecessary (assuming that the worm is completely disabled and ICF is enabled).</li>
<li>It has been reported that AOL network connections do not display an option to use ICF.</li>
</ul>
</p>
<h4>More Information</h4>
<p>
<ul>
CERT Advisory CA-2003-20 <<a href="http://www.cert.org/advisories/CA-2003-20.html">http://www.cert.org/advisories/CA-2003-20.html></a><br>
Anti-Virus Vendors <<a href="http://www.cert.org/other_sources/viruses.html#VI">http://www.cert.org/other_sources/viruses.html#VI</a>><br>
Trend Micro WORM_MSBLAST.GEN <<a href="http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.GEN">http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST.GEN</a>><br>
</ul>
</p>
<!-- end faq content -->
<hr noshade>
Copyright 2003 Carnegie Mellon University<br>
CERT<sup>®</sup> and CERT Coordination Center<sup>®</sup> are
registered in the U.S. Patent
and Trademark office.<br><br><small>
<font face="arial, geneva, helvetica"><a
href="/legal_stuff/legal_stuff.html">Disclaimers and copyright
information</a></small><br><br>
<small><small>
Last updated August 14, 2003
</small></small>
|