Full Disclosure mailing list archives
Re: dobble-clicking msblast.exe
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Wed, 13 Aug 2003 03:20:16 +1200
martin f krafft <madduck () madduck net> wrote:
Does anyone know what happens if you run msblast.exe on an uninfected system?
It becomes infected and infective. There is nothing especially magical about the features of the worm program -- run it and it starts trying to spread (or to DoS windowsupdate.com depending on the date). Its function is certainly not affected by the way it gets onto a machine or whether it is launched by the exploit code or not (well, it may depend on some elevated privileges such as the those it gets as local system from the RPC exploit code running, as it does, as part of a system service). -- Nick FitzGerald Computer Virus Consulting Ltd. Ph/FAX: +64 3 3529854 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- dobble-clicking msblast.exe martin f krafft (Aug 12)
- Re: dobble-clicking msblast.exe Nick FitzGerald (Aug 12)
- RE: dobble-clicking msblast.exe gml (Aug 13)
- <Possible follow-ups>
- RE: dobble-clicking msblast.exe Dowling, Gabrielle (Aug 12)
- RE: dobble-clicking msblast.exe Christopher Lyon (Aug 13)
- Re: dobble-clicking msblast.exe Nick FitzGerald (Aug 12)