Full Disclosure mailing list archives
Re: New Windows worm?
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Tue, 12 Aug 2003 13:24:32 +1200
dickcox () quepasa com wrote:
5 of our office computers recently started behaving strangly. Simptoms include -can't view logs in Event Viewer -can't transfer files over the network -can't view contents of directories (Windows directory and Program Files) -disable of copy/paste in Microsoft word -Lots of svchost errors Anybody know what this might be caused by? It all started today. 2 of the computers are located here in the States, and 3 of them are located in Mexico. I've already eliminated the new MSBlast worm.
Are you sure they are not possible exposing DCOM/RPC services to a potentially "hostile" network? They may not have been infected, but that may be because they are the wrong OS (or "odd" in some way such that the offset the worm uses doesn't work for those machines). In such cases I'd expect you to see all kinds of weirdnesses of the sort you describe as the machine's RPC services will all be shot to bits internally. Expect crashes. Regards, Nick FitzGerald _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- New Windows worm? dickcox (Aug 11)
- Re: New Windows worm? Nick FitzGerald (Aug 11)
- <Possible follow-ups>
- RE: New Windows worm? Altheide, Cory B. (Aug 11)
- Re: New Windows worm? Paul Szabo (Aug 11)