Microsoft Patches
It is imperative that infected systems are patched prior to disinfecting a system. As for the W32/Lovsan.worm, some systems may be in a “crash loop” where each time the system is restarted, SVCHOST.EXE crashes and the user has 60 seconds before the system restarts. This action can continue to happen even after the virus is removed if the patch is not applied. It may be necessary to install/configure a firewall prior to downloading/installing this patch. Microsoft has outlined the necessary steps to address Windows issues when removing this virus. These actions should be taken prior to removing the virus (see below).
DAT Files
Detection is included in the 4286 DAT files
. The 4.1.60 scan engine is capable of detection, however the 4.2.40+ scan engine is required for repair. Additionally, services removed by the cleaning process may still appear in the Services Control Panel / Snap In, until a reboot has occurred. This is not an indication that a reboot is required to delete the necessary files or registry keys, simply that Windows will still show the service as being present until after the reboot has happened. Run an On-demand
scan after applying the Microsoft patch and updating to the required DAT files.
Stand alone remover
Stinger
has been updated to include detection/removal of this threat.
Sniffer Customers:
A new filter
has been developed that will look for any traffic exploiting the RPC Exploit, plus traffic on port 4444 (Lovsan) and traffic on 707 (Nachi) (Sniffer Distributed 4.3 and Sniffer Portable 4.7.5).
Manual Removal Instructions
To remove this virus "by hand", follow these steps:
- Apply the MS03-039 patch
(includes MS03-026
patch)
- Terminate the following services
:
- WINS Client
- Network Connections Sharing
- Delete the DLLHOST.EXE
and SVCHOST.EXE
files from the WINS directory with your WINDOWS SYSTEM32 directory. For example, c:\winnt\system32\wins\svchost.exe.
Note:
a legitimate system file exists with the filename DLLHOST.EXE, which must not be deleted.
- Edit the registry to:
- Delete the "RpcPatch" key from
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
- Delete the "RpcTftpd" key from
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
Additional Windows ME/XP removal considerations
Desktop Firewall Users
The default McAfee Desktop Firewall policies will prevent Nachi from spreading, by blocking the ICMP request used by the virus to find other vulnerable systems and blocking the TFTP traffic generated by infected systems. Unless you have created specific rules to allow these types of traffic, systems are protected without any action required. If you do need to make a policy change, it can be done quickly and easily from a central location with ePolicy Orchestrator.
Threatscan Users
There are two ways of using ThreatScan with regards to the Nachi worm. The first is to detect the Vulnerability that the worm uses to exploit the machine. Finding the vulnerable machines and patching them will help prevent this worm from interfering with your business. To find machines that are vulnerable to being exploited by this worm, ensure that your ThreatScan installation is up to date and then follow the steps below under the heading: “To scan for the MS03-026 (Q823980) vulnerability”.
The other way is to detect machines that are already infected by this worm. To do this you will ensure that your ThreatScan installation is up to date, and then follow the steps below under the heading: “To scan for the Nachi virus infection”. This method will allow you to look for machines that are running the one of the services that this worm creates.
To update your ThreatScan installations with the latest signatures perform the following tasks:
-From within ePO open the “Policies” tab.
-Select “McAfee ThreatScan” and then select “Scan Options”
-In the pane below click the “Launch AutoUpdater” button.
-Using the default settings proceed through the dialogs that appear. Upon successful completion of the update a message will appear stating that; update 2003-08-12 has completed successfully.
- From within ePO create a new “AutoUpdate on Agent(s)” task.
-Go into the settings for this task and ensure that the host field is set to ftp.nai.com
, the path is set to /pub/security/tsc20/updates/winnt/
and that the user and password fields are both set to ftp
.Note that “tsc20” in the above path is used for ThreatScan 2.0 and 2.1.The correct path for ThreatScan 2.5 is “tsc25”.
-Launch this task against all agent machines.
-When the task(s) complete information will be available in the “Task Status Details” report.
To create and execute a new task to check for Nachi do the following:
To scan for the MS03-026 (Q823980) vulnerability:
-Create a new ThreatScan task.
-Edit the settings of this task.
-Edit the “Task option”, “Host IP Range” to include all desired machines to scan.
-Select the “Remote Vulnerability Detection” category and “Windows Client Vulnerabilities”template. -or-
-Select the “Remote Vulnerability Detection” category and “Sans/FBI List” template. -or-
-Select the “Other” category and “Scan all Vulnerabilities” template.
-Launch the scan.
To scan for the Nachi virus infection:
-Create a new Resource Discovery task.
-Edit the settings of this task.
-Edit the “Task option”, “Host IP Range” to include all desired machines to scan.
- Select only the “Windows Service Scan” option.
-Launch the scan.
For additional information regarding the vulnerability:
-Look for module number 29055 in generated ThreatScan report.
For additional information regarding possible infection:
- Export the generated Resource Discovery report and search for the following sentences:
“WINS Client”
“Network Connections Sharing”