Microsoft under attack... how to protect yourself

Colin Dunstan · 08-13-2003, 02:59 AM

As you've probably all heard in the news, W32.Blaster.Worm is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. This worm attempts to download and run the Msblast.exe file.

Block access to TCP port 4444 at the firewall level, and then block the following ports, if they do not use the applications listed:

TCP Port 135, "DCOM RPC"
UDP Port 69, "TFTP"

The worm also attempts to perform a Denial of Service (DoS) on Windows Update. This is an attempt to prevent you from applying a patch on your computer against the DCOM RPC vulnerability.

To scan your system and, if necessary, to remove the worm, download and run Symantec's removal tool.

Hammer · 08-28-2003, 08:16 AM

i got this mugger while i was downloading the patch. however the fixblaster is easily available and removed it. no real dramas!

08-13-2003, 02:59 AM	#1
Colin Dunstan Is papyrophobic! Posts: 1,926 Karma: 1009999 Join Date: Aug 2003 Location: USA Device: Dell Axim	Protect yourself from W32.Blaster.Worm As you've probably all heard in the news, W32.Blaster.Worm is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. This worm attempts to download and run the Msblast.exe file. Block access to TCP port 4444 at the firewall level, and then block the following ports, if they do not use the applications listed: TCP Port 135, "DCOM RPC" UDP Port 69, "TFTP" The worm also attempts to perform a Denial of Service (DoS) on Windows Update. This is an attempt to prevent you from applying a patch on your computer against the DCOM RPC vulnerability. To scan your system and, if necessary, to remove the worm, download and run Symantec's removal tool.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Protect Against Sand	StevenXL	Amazon Kindle	7	03-03-2010 02:57 PM
How do you protect your DR1000S when you carry it around?	patatan	iRex	32	12-03-2009 11:28 AM
Well I'm on my second reader now...how to better protect it this time?	frozenpeas43	Sony Reader	4	10-29-2007 03:50 PM

08-28-2003, 08:16 AM	#2
Hammer Member Posts: 18 Karma: 46 Join Date: Mar 2003 Device: TT	i got this mugger while i was downloading the patch. however the fixblaster is easily available and removed it. no real dramas!

Advert