MSBlast/Lovsan worm is making the rounds

Post everything else here

Moderators: Website/Forum Admins, Other/Off Topic Moderators

User avatar
munky
Site Admin
Posts: 826
Joined: Wed Jul 02, 2003 4:54 pm
Location: Phoenix AZ
Contact:

MSBlast/Lovsan worm is making the rounds

Postby munky » Tue Aug 12, 2003 2:29 pm

It's important for all users (EFnet or otherwise) to patch their computers against the recent RPC/DCOM exploits.

This worm will exploit RPC, opening a shell to download (via tftp) the remainder of the worm. The worm then starts scanning (mostly) random IP's to furhter infect. When the shell is closed, RPC will crash, which may make it difficult to patch your machine.

If you are having problems patching because of RPC constantly crashing, follow the directions here. A tool for cleaning the worm is here, with directions for use.

For further information, read the following:
http://www.f-secure.com/v-descs/msblast.shtml
http://vil.nai.com/vil/content/v_100547.htm
In God we trust,
Everyone else must have an X.509 certificate.
User avatar
corrupt
Site Admin
Posts: 81
Joined: Wed Jul 02, 2003 1:08 pm
Location: Danville, KY
Contact:

Postby corrupt » Tue Aug 12, 2003 4:31 pm

Like munky said, it is CRUCIAL for you to patch this security hole if you are running Windows. It is perhaps the easiest hole to exploit that Microsoft has had in a while. You might even have drones running on your computer now. Update your virus definitions and operating systems!
Josh Baird
[corrupt]@EFNet
O: irc.choopa.net
User avatar
munky
Site Admin
Posts: 826
Joined: Wed Jul 02, 2003 4:54 pm
Location: Phoenix AZ
Contact:

Postby munky » Wed Aug 13, 2003 1:03 pm

In God we trust,
Everyone else must have an X.509 certificate.
User avatar
munky
Site Admin
Posts: 826
Joined: Wed Jul 02, 2003 4:54 pm
Location: Phoenix AZ
Contact:

Postby munky » Mon Aug 18, 2003 3:58 pm

an amusing update

http://lnks.us/?V31J5J
In God we trust,
Everyone else must have an X.509 certificate.
User avatar
Osc
Posts: 75
Joined: Mon Aug 11, 2003 8:08 pm
Location: Atlanta, GA

Postby Osc » Wed Aug 20, 2003 3:55 am

and the interesting fallout from such 'white worms'
http://smlnk.com/?DDNA3NGQ
irc.he.net Notice -- Osc (osc@irc.packetmonkeys.com) is now an operator
<CHANFIX> You're now logged in with the following flags: ADMIN.
<OCF> Authentication successful. Welcome, Osc.

Who is online

Users browsing this forum: No registered users and 0 guests