Member Avatar for Paladine

Here is the solution I found:

Removal Tool

Viri and those who create them pee me right off

:evil:

  • 3 Contributors
  • 3 Replies
  • 1K Views
  • 12 Years Discussion Span
  • Latest Post Latest Post by Manny_1

Dani AI

Generated

W32.Blaster (a.k.a. MSBlast / LovSan) exploited a DCOM/RPC buffer overflow (CVE-2003-0352, patched in MS03-026) on Windows NT/2000/XP/Server 2003. The worm used TCP/135 to trigger remote execution, retrieved a payload (commonly msblast.exe) via TFTP (UDP/69), rebooted infected hosts and included a timed SYN-flood attempt against windowsupdate.com. The historical incident underlines two constants: apply vetted vendor patches promptly, and isolate vulnerable legacy systems from the internet. (CVE-2003-0352). (nvd.nist.gov)

Immediate operational steps used successfully in 2003 and still relevant for legacy hosts: isolate the machine (physically disconnect or disable interfaces); check Task Manager for msblast.exe and — after backing up the registry — inspect and remove the Run key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows auto update if present; terminate the process, remove the binary from the system, then run up-to-date anti-malware tooling or vendor removal utilities and install the Microsoft patch (or apply offline updates / restore from a clean image if stability is poor). At the perimeter, temporarily block/filter 135/tcp, 135/udp, 139, 445, 69/udp and 4444/tcp until all hosts are patched. Exercise caution when editing the registry; prefer vendor tools where possible. (opennet.ru)

As already highlighted, vendor removal tools and the Microsoft patch are the correct starting points; 's acknowledgement is appropriate. In response to : distributing original worm binaries or exploit code on public forums is unsafe and inappropriate. Qualified researchers should work with accredited labs, CERT/CC, or anti-malware vendors for controlled samples and guidance. (opennet.ru)

Recommended Answers

All 3 Replies

Member Avatar for whipaway

Thanks for the info & the links.

Member Avatar for Manny_1

This link does not ever exist, where can I get the first code you wrote

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.