[Full-Disclosure] Windows Dcom Worm Killer

[w g <xillwillx@yahoo.com>]

<DIV>1.6 kb assembly program to kill and remove the dcom worm</DIV>
<DIV>&nbsp;</DIV>
<DIV><A href="http://illmob.org/files/dcomkiller.zip";>http://illmob.org/files/dcomkiller.zip</A></DIV>
<DIV>&nbsp;</DIV>
<DIV>DETAILS:</DIV>
<DIV>&nbsp;</DIV>
<DIV>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DCOM worm killer (W32.Blaster.Worm) <BR>&nbsp;Aliases:&nbsp; W32/Lovsan.worm [McAfee], Win32.Poza [CA], Lovsan [F-Secure]<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; WORM_MSBLAST.A [Trend], W32/Blaster-A [Sophos], W32/Blaster [Panda]</DIV>
<DIV>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Coded in MASM by:<BR>&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; illwill&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <A href="mailto:xillwillx@yahoo.com";>xillwillx@yahoo.com</A>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <A href="http://www.illmob.org";>www.illmob.org</A>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <BR>&nbsp; <BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8/13/2003<BR>&nbsp;This program is a tool to remove the malicious worm<BR>&nbsp;th!
 at
 spreads through exploiting the DCOM RPC vulnerability using TCP port 135. <BR>&nbsp;This worm attempts to download the msblast.exe file to the %WinDir%\system32 directory and execute it.<BR>&nbsp;Once executed it creates a hidden Cmd.exe remote shell that will listen on TCP port 4444, <BR>&nbsp;allowing an attacker to issue remote commands on the infected system.<BR>&nbsp;This tool was made to Automate the process of removing the worm from memory and all files related to it.</DIV>
<DIV>-------------------------------------------------------------------------<BR>&nbsp;Directions:<BR>&nbsp;1. Execute the file called DCOMKill.exe<BR>&nbsp;&nbsp;&nbsp; This will automatically kill the worms process <BR>&nbsp;&nbsp;&nbsp; running in memory and remove the registry startup method<BR>&nbsp;&nbsp;&nbsp; and then it will erase any files left by the worm.<BR>&nbsp;<BR>&nbsp;2. All done&nbsp; :) ... next step <BR>&nbsp;&nbsp;&nbsp; W32.Blaster.Worm exploits the DCOM RPC vulnerability. This is described in Microsoft Security Bulletin MS03-026, <BR>&nbsp;&nbsp;&nbsp; and a patch is available there. You must download and install the patch.Also buy an antivirus and keep it <BR>&nbsp;&nbsp;&nbsp; updated weekly . Also I'd suggest getting a firewall to protect from any outside intruders.</DIV>
<DIV>-------------------------------------------------------------------------<BR>Tech Info:<BR>Startup registry key-<BR>&nbsp; HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run<BR>&nbsp; "windows auto update"="msblast.exe"</DIV>
<DIV>Dropped files-<BR>&nbsp;Windows system directory (c:\windows\system32 c:\winnt\system32)<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; msblast.exe</DIV>
<DIV>Note:<BR>if you are running Windows XP, it is recommended that you temporarily turn off System Restore. Windows XP uses this feature, </DIV>
<DIV>which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan </DIV>
<DIV>infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.</DIV>
<DIV>Source:<BR>available upon request.<BR></DIV><p><hr SIZE=1>
Do you Yahoo!?<br>
<a href="http://us.rd.yahoo.com/evt=10469/*http://sitebuilder.yahoo.com";>Yahoo! SiteBuilder</a> - Free, easy-to-use web site design software