Shutdown Initiated by NT Authority /System 5

[bcastner]

To all:

This is a very hard one to figure out, only that there has been a flurry of these recently. I honestly believe it is a deliberate attack on port 139 that is being launched. This CNN Report of last week is typical of the warnings now being issued in the US:

http://www.cnn.com/2003/TECH/internet/07/31/internet.atttack.ap/index.html

There is a recent hotfix that addresses this RPC vulnerability:

http://www.microsoft.com/security/security_bulletins/ms03-026.asp

Install or enable a firewall immediately.

http://support.microsoft.com/?kbid=283673

Run an updated virus scan.
Or Scan for Viruses online:

http://security.symantec.com/ssc/home.asp?j=1&langid=ie&venid=sym&plfid=23&pkj=IRLFIZTYMWPAZTJWUFJ

Also be sure to update immediatly to prevert this in the future:

http://windowsupdate.microsoft.com/

This will tell you more:

http://www.microsoft.com/security/security_bulletins/ms03-026.asp

 

[bcastner]

If your system is continuously restarting with this error:

Try early and often pounding of the F8 key. You want to use the "Last Known Good" configuration option.

If that does not work, I can only guess. Some anti-virus software can run from a DOS session even with NTFS disks. If yours is able to do this start there.

If no joy, do a registry replacement. This requires booting from the XP CD and hitting the first R(epair) choice you receive in order to access the Recovery Console. See this site and print out all of the instructions found there:

http://www.digitalwebcast.com/2002/03_mar/tutorials/cw_boot_toot.htm

If still no joy you need to do a maintenance re-install of XP. You will not lose your data or applications but you will lose your Service Packs and Hotfixes:

http://support.microsoft.com:80/support/kb/articles/q315/3/41.asp&NoWebContent=1

 

[bcastner]

Stay tuned.

This is a very hot problem and other than the Hotfix other solutions should become clearer.

Avoid any drastic steps for now.

 

[linney]

PATCH IT - but if you can't, try these.

Workarounds (From Microsoft).


Are there any workarounds that can be used to block exploitation of this vulnerability while I am testing or evaluating the patch?

Yes. Although Microsoft urges all customers to apply the patch at the earliest possible opportunity, there are a number of workarounds that can be applied to help prevent the vector used to exploit this vulnerability in the interim.

It should be noted that these workarounds should be considered temporary measures as they just help block paths of attack rather than correcting the underlying vulnerability.

The following sections are intended to provide you with information to help protect your computer from attack. Each section describes the workarounds that you may want to use depending on your computer’s configuration.

Each section describes the workarounds available depending on your required level of functionality.


Block RPC interface ports at your firewall.
Port 135 is used to initiate an RPC connection with a remote computer. In addition, there are other RPC interface ports that could be used by an attacker to remotely exploit this vulnerability. Blocking the following ports at the firewall will help prevent systems behind that firewall from being attacked by attempts to exploit this vulnerability:

TCP/UDP Port 135
TCP/UDP Port 139
TCP/UDP Port 445

In addition, customers may have configured services or protocols that use RPC that might also be accessible from the Internet.

Systems administrators are strongly encouraged to examine RPC ports that are exposed to the Internet and to either block these ports at their firewall, or apply the patch immediately.


Internet Connection Firewall.
If you are using the Internet Connection Firewall in Windows XP or Windows Server 2003 to protect your Internet connection, it will by default block inbound RPC traffic from the Internet.

Disable DCOM on all affected machines
When a computer is part of a network, the DCOM wire protocol enables COM objects on that computer to communicate with COM objects on other computers. You can disable DCOM for a particular computer to help protect against this vulnerability, but doing so will disable all communication between objects on that computer and objects on other computers.

If you disable DCOM on a remote computer, you will not be able to remotely access that computer afterwards to reenable DCOM. To reenable DCOM, you will need physical access to that computer.

To manually enable (or disable) DCOM for a computer:

1. Run Dcomcnfg.exe.


If you are running Windows XP or Windows Server 2003 perform these additional steps:

Click on the Component Services node under Console Root.
Open the Computers sub-folder.
For the local computer, right click on My Computer and choose Properties.
For a remote computer, right click on the Computers folder and choose New then Computer. Enter the computer name. Right click on that computer name and choose Properties.
2. Choose the Default Properties tab.
3. Select (or clear) the Enable Distributed COM on this Computer check box.

4. If you will be setting more properties for the machine, click the Apply button to enable (or disable) DCOM. Otherwise, click OK to apply the changes and exit Dcomcnfg.exe.




Patch availability
Download locations for this patch for XP

http://microsoft.com/downloads/deta...6C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

 

[bcastner]

McAfee Comments and removal Instructions:

http://vil.nai.com/vil/content/v_100547.htm

Symantec Comments and Removal Instructions:

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

 

[bcastner]

Google News has started tracking the problem. See the Sci/Tech subsection on this Worm. Several articles already.

 

[bcastner]

MS newsgroups are flooded with complaints.

 

[bcastner]

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

Then click OK. (The Registry Editor opens.)


1. Apply the patch, NOW!

http://microsoft.com/downloads/deta...6C-C5B6-44AC-9532-3DE40F69C074&displaylang=en

2. Update your virus defintions

3. Do a virus scan

4. Check your registry:

Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


In the right pane, delete the value:

"windows auto update"="msblast.exe"

if you find it there.

Exit the Registry Editor.

 

[HansD]

hey people

If have the problem you write about here.

I found this out after i installed zonealarm: As soon as i started my computer 2 networks tried to connect with my pc and a program called msblast.exe tried to access the internet. I am not sure what msblast.exe is I cant find it anywhere on the internet. I have blocked access from these 2 networks and blaocked the access from msblast to the internet and the problem with RPC are gone

Hope this helps


Hans

 

[bcastner]

Explanation of msblast worm:

http://vil.nai.com/vil/content/v_100547.htm

A virus scan is really necessary, and you should check the registry as I discussed above. And patch it with the MS patch.

 

[HansD]

Yeah I allready downloaded it. But is it a virus? It is strange because when i had the problem i formatted my hdd and installed XP. As soon i was in Windows again there problem was there again (within 1 minute or so).

Well, maybe this is the attack from Osama they all talk about

 

[N11xxy]

i have the same problem, once win xp is loaded fully i only have about 1 min before the box comes up saying its going to shut down in 60 seconds, i need help as i am new to this so laymens terms a must, please

thank you

Mark

 

[HansD]

you just have to do what Bcastner wrote.

I am trying it now.

 

[bcastner]

Remember even the lowly XP native ICF "Internet Connection Firewall" is enough to block this worm.

 

[bcastner]

If the machine can boot at all do this quick patch:

(Do not access the Internet yet)

First open task manager, find and end the process 'msblast.exe'

Second, delete the registry key:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Find the value windows auto update
if its value in the right panel is C:\windows\system32\msblast.exe delete the key.

Finally, delete the file c:\windows\system32\msblast.exe

reboot.

You can access the internet now.

 

[bcastner]

And of course the first thing you should do after doing the quick fix above is:

1. Download and apply the patch
2. Update your virus definitions
3. Run a thorough virus scan

You should be fine now.

Note: It might be wise to view all restore points from the day you began having symptoms as suspect, and delete them.

 

[bcastner]

Some interesting things are being found by analyzing the code of this MSBLAST worm. This is snippets from Steve and others in the

http://www.broadbandreports.com

Security Forum:

1. The next target is Windows Update Service:

"Of particular note is that on 8/16, this worm will start attacking windowsupdate.com with random packets to 80/tcp. Still digging into the details of what's there, but it looks pretty aggressive."

2. Who is Billy?

"The string "BILLY" is in the code: this is the name of a mutex that is used to keep more than one version running at a time." In an case he loves SAN apparently.

3. Why do I see more local IPs in my firewall logs than IPs way far away?

"The worm exhibits the following behaviors:

Spawn a new thread, checks system clock and launches a TCP-based denial of service attack at windowsupdate.com if the date is on or after the 16th.

Add itself to registry so the worm restarts upon a reboot.

Initializes the attack vector for Windows 2000 or Windows XP based on a simple mathematical calculation. Each infected instance will only attack Windows XP or Windows 2000. One out of five worm infections will attack windows 2000, and the remaining four will target Windows XP.

There is a 40% probability that the worm picks a random IP and then scans sequentially from the starting point. There is a 60% probability that the worm scans sequentially from its own IP address.

If a vulnerable machine is found, the exploit is launched and the newly infected machine connects back to the scanning machine via TFTP to obtain the worm binary. The binary is executed and the process begins again."

So it "likes" XP more than Win2k, and scans sequentially from your IP sequentially. Thus more local scans than remote IPs in your logs.

 

[HansD]

Tnx Bcastner

I have everything working here again
There is a lot of info on the net now about this

but as i said tnx you have been a great help


Hans

 

[ZQiu]

bcastner, i did everything you said but i still can't delet the msblast.exe file, any idea?

 

[bcastner]

Make the registry change, very important.
Enable the native XP firewall (ICF). You do this from the properties of your Internet Connection, Advanced tab.
Now it is safe to reboot.

Boot into Safe Mode.
You should be able to delete it.
If you still have problems, check the links I provided above for McAfee and Symantec. Both offer detailed removal suggestions.

If you have a good anti-virus software, get the most recent updates and then have it do a scan. Most know about the problem now.

You will not be reinfected with the firewall active, and it will not run without the registry key active.