校园网络病毒警报！Blaster and Welchia "worms"。

lianxu1014 · 发表于 2003-10-11 05:29

The infection of PCs by the Blaster and Welchia "worms" has severely degraded
the performance of the Lancaster University Student Network (LusNet) since
Friday. The Blaster and Welchia worms exploit a security weakness in selected
Microsoft Operating Systems (see: http://www.lancs.ac.uk/iss/a-virus/v-welchia.htm.)
The systems at risk are PCs running Windows NT4, Windows 2000 and Windows XP.

The LusNet CD issued at registration includes instructi##被过滤## and the "software
patch" that you need to apply to Microsoft Windows. The CD also includes "extractor
tools" to remove a Welchia or Blaster infection from a PC, however the extraction
tool is only effective if the appropriate "security patch" has been applied
beforehand.

Additionally, the LusNet CD also contains a licenced copy of the Norton Anti-Virus
software. If installed, this will alert you to future attaempts to infecti##被过滤##
by computer virus and worms.

ISS is progressively removing infected PC from LusNet so as to restore network
performance for everyone else.

Finally, please validate your computer for the residence network at http://www.lancs.ac.uk/net-reg/
Registering your computer provides youwith additional services, these are:

  * Access to Wing (university email)
  * Access to \\central-files
  * Access to exchange mail servers for postgraduates
  * Offsite access to POP servers, ssh, IRC, ICQ and some instant messengers

  * Unrestricted web access (unvalidated machines will soon be redirected to
the validation page) unrestricted local web access.

The validation is required so that we can contact you faster in theevent of
problems caused by your computer such as virus infection.

Although most of the network can handle worm infecti##被过滤## it has serious effects
on offsite access to anything other than web acccess, it poses major security
problems to any infected computer and lowers performance significantly, as
a result we have to take severe action against infected machines and remove
them from the network.

All replies should be directed to: resnet-faults@lancs.ac.uk
David Lomas (Head of User Services)

病毒分类 WINDOWS下的PE病毒  病毒名称 Worm.Welchia 　　
行为类型 WINDOWS下的木马程序　

通过RPC传播的蠕虫病毒采用VC++ 6.0编写，UPX压缩
1.程序将系统目录的dllcache\tftpd.exe拷贝到 wins\svchost.exe，注册为服务 "RpcTftpd"
把自己拷贝到wins\DLLHOST.EXE，注册为服务"RpcPatch"

2.终止内存中的msblast，并删除相应文件。

3.如果是2004年，卸载两个服务上述两个服务；并退出系统，将自己删除。

4.病毒通过检测本机的注册表来判断是否已经安装RPC漏洞补丁如果本地机器没有打补丁，
下载微软的补丁程序到本地 "RpcServicePack.exe"，加入参数“ -n -o -z -q”，运行补丁程序。
运行完后删除补丁文件，重起机器。

5.病毒随后通过Ping网络上的机器来进行传播
如果ping成功，则试图通过RPC漏洞和IIS漏洞侵入远程机器，进入下一次传播流程。
病毒进行ping操作时的IP地址是随机生成，但不对包含197和153.153的机器进行操作，
比如，病毒将不对以下地址攻击：
197.*.*.*
*.197.*.*
*.*.197.*
*.*.*.197
*.*.153.153
*.153.153.*
153.153.*.*

附加说明
IIS漏洞：
Microsoft Windows 2000支持World Wide Web Distributed Authoring and Versioning (WebDAV)
protocol.WebDAV是一套扩展的HTTP协议，是Internet上的文件管理、编辑的标准，它存在一个漏洞，攻击者
通过发送一个特定格式的HTTP请求给运行IIS的机器,导致server运行
失败，从而执行攻击者的代码.由于病毒的特殊传播方式，可能造成网络交通堵塞

冲击波（Worm.Blaster）病毒档案

警惕程度：★★★★
发作时间：随机
病毒类型：蠕虫病毒
传播途径：网络/RPC漏洞
依赖系统: Microsoft Windows NT 4.0 / Microsoft Windows 2000 / Microsoft Windows XP /Microsoft Windows Server 2003

病毒介绍：

该病毒于8月12日被瑞星全球反病毒监测网率先截获。病毒运行时会不停地利用IP扫描技术寻找网络上系统为Win2K或XP的计算机，找到后就利用DCOM RPC缓冲区漏洞攻击该系统，一旦攻击成功，病毒体将会被传送到对方计算机中进行感染，使系统操作异常、不停重启、甚至导致系统崩溃。另外，该病毒还会对微软的一个升级网站进行拒绝服务攻击，导致该网站堵塞，使用户无法通过该网站升级系统。在8月16日以后，该病毒还会使被攻