Check your firewalls!

[Nuvo]

Guys, I just wanted to give you all heads up what appears to be a nasty worm that is in circulation right now.

I notice that the SVCHOST file for launching DCOM Terminal Services was SYN flooding (Denial of Service Attack) random websites and mail servers using TCP and SMTP respectively. It will increment the port adress as it goes about it evil business.
It will try to run ActiveX, VB and Java scripts when connected to some of these random sites.

Most antivirus and anti-malware software cannot detect this.

First thing to do is run ProcessExplorer which can be downloaded from here.

Run ProcessExplorer and drill down the process chain from System to services.exe. You'll see a number of instances of svchost.exe running which is normal. Mouse over each until you see one which mentions the DCOM Server and Terminal Services.

Select it and then click on the right mouse button and select Properties. Once you've done that, click on the TCP/IP tab. There should only be one entry and that should be in the LISTENING state.

If you see multiple connection and disconnections being made then the chances are you've been infected.

The file which I found to be causing this was C:\WINDOWS\system32\bnts32.dll.
Boot from a clean system disc to delete this file and reboot to remove the problem.

I think the infection might be a product of the latest vulnerability outlined here.

Also be sure to install the latest MS06-040 update for your machine.

Happy computing and stay safe.

[Fat Audi 80]

I did not understand ANY of that!

Sonic, can you translate that into English for me please?

Cheers,

Steve.

[Sonic]

I did not understand ANY of that!

Sonic, can you translate that into English for me please?

Another "virus" which appears to use denial of service attacks on accessible web and mail servers.

[Jamo]

It's a new variation on an old exploit that has been around for donkey years, but yes install the new mircosoft update.

If you have autoupdates enabled then you will most likely have got a notification to download it recently.

[hiltoa]

Cheers Nuvo, good info, if a little in depth for most

In the middle of doing an emegency roll-out at work now - only just done this month's patches as it is. Pain in th'****!

For normal people, if you're running Windows, keep patching when it tells you to, and don't use P2P. There be nasties out there!

[S2central.net]

Funny - my machine has been asking me to let it install the latest update it just swallowed... So I guess I may as well let it gerronwifit !

[Nuvo]

It's a new variation on an old exploit that has been around for donkey years, but yes install the new mircosoft update.

If you have autoupdates enabled then you will most likely have got a notification to download it recently.

Granted, Service host attacks aren't new, but this exploit is.
My auto updates are always enabled and I always install them after reviewing them. It's most likely that it found its way on to my machine before any critical patches were released.
I'm still surprised it my other security software didn't catch it which is updated frequently and has been very effective until now.

[Sonic]

Granted, Service host attacks aren't new, but this exploit is.
My auto updates are always enabled and I always install them after reviewing them. It's most likely that it found its way on to my machine before any critical patches were released.
I'm still surprised it my other security software didn't catch it which is updated frequently and has been very effective until now.

What made you pull out process explorer? System running slowly or something more obvious?

[Jamo]

The problem with all security software is they are reactive and if something new comes out that isn't in their database it slips through, it's pot luck if you get the update before you get infected.

I'm still on the old conspiracy side when it comes to viruses and exploits, no viruses, no need for anti virus software therefore who keeps releasing new viruses?

Signing off Mulder

[Fat Audi 80]

Cheers Nuvo, good info, if a little in depth for most

In the middle of doing an emegency roll-out at work now - only just done this month's patches as it is. Pain in th'****!

For normal people, if you're running Windows, keep patching when it tells you to, and don't use P2P. There be nasties out there!

Does that mean I should stop watching Footie on www.footie4u.com over Sopcast???

Or is it too late?

Thanks,

Steve.

[Fat Audi 80]

The problem with all security software is they are reactive and if something new comes out that isn't in their database it slips through, it's pot luck if you get the update before you get infected.

I'm still on the old conspiracy side when it comes to viruses and exploits, no viruses, no need for anti virus software therefore who keeps releasing new viruses?

Signing off Mulder

I can see you thinking there...

[Nuvo]

What made you pull out process explorer? System running slowly or something more obvious?

No, the system was running fine. My firewall was reported a number of port scans and attemps to runs scripts. It was then I took at look at my recent DNS cache and saw it was full of web addresses I'd never heard of let alone visited.

Then taking a look at the suspicious network activity confirmed that all was not well.
ProcessExplorer is an ideal tool for digging that bit deeper to see what is going on "under the hood".

[ericd]

good old 1's & 0's causing problems again, years ago we exploited holes in virus scanning software and similar franchised auto update mechanisms (all in the aid of security of course), I'm suprised nobody "tests" them more often , it's not like it's written in Ada or owt .

[Nuvo]

The problem with all security software is they are reactive and if something new comes out that isn't in their database it slips through, it's pot luck if you get the update before you get infected.

That is certainty true yes, although this particular exploit I believe uses ports TCP/139 (NetBIOS) and TCP/445(Direct hosted SMB). I would have expected that these ports were previously blocked. If not then it is down to the rules (database) of the firewall and if they are aware of this threat. I'll need to check this to be sure.

I'm still on the old conspiracy side when it comes to viruses and exploits, no viruses, no need for anti virus software therefore who keeps releasing new viruses?
Signing off Mulder

Yes, I've heard it suggested on a few occasions that it is the antivirus developers that are writing the viruses too. It is certainly possible, although I'm not wholly convinced.

Most conspiracies of this sort tend to point the finger at the experts as they have the best knowledge to do so. It not impossible, although from memory, people in the past convicted of writing a virus have been teenagers.

[shark_90]

What security software do you use Nuvo?