Full Disclosure mailing list archives
SV: RE: Probable new MS DCOM RPC worm for Windows
From: "Peter Kruse" <kruse () krusesecurity dk>
Date: Thu, 25 Sep 2003 18:08:36 +0200
Hi Jonathan,
Is anyone seeing anything new out there, or is this just a resurgence of Welchia?
Not likely a new RPC DCOM worm. We will certainly know when it hits the Net. If you look at the amount of source adresses you will notice that the numbers are actually going down. The increase in trafic on port 135 could be because PoC code has been released and script kiddies are testing to see how many systems they can compromise. Med venlig hilsen // Kind regards Peter Kruse Kruse Security http://www.krusesecurity.dk _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Probable new MS DCOM RPC worm for Windows, (continued)
- Re: Probable new MS DCOM RPC worm for Windows Richard Johnson (Sep 24)
- RE: Probable new MS DCOM RPC worm for Windows Schmehl, Paul L (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows Cael Abal (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows Gregory A. Gilliss (Sep 25)
- RE: Probable new MS DCOM RPC worm for Windows Derek Vadala (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows Exibar (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows Cael Abal (Sep 25)
- RE: RE: Probable new MS DCOM RPC worm for Windows Robert Ahnemann (Sep 25)
- RE: Probable new MS DCOM RPC worm for Windows Williams Jon (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows Paul Farrow (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows Jordan Wiens (Sep 25)
- SV: RE: Probable new MS DCOM RPC worm for Windows Peter Kruse (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows Paul Farrow (Sep 25)
- RE: RE: Probable new MS DCOM RPC worm for Windows Schmehl, Paul L (Sep 25)
- RE: Probable new MS DCOM RPC worm for Windows Brian (Sep 25)
- Port 6881 scans - why? Paul Johnson (Sep 25)
- Re: Port 6881 scans - why? Blue Boar (Sep 25)
- Port 6881 scans - why? Paul Johnson (Sep 25)
- RE: Probable new MS DCOM RPC worm for Windows Carey, Steve T GARRISON (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows lists (Sep 27)
- Re: RE: Probable new MS DCOM RPC worm for Windows Paul Schmehl (Sep 27)
- Re: RE: Probable new MS DCOM RPC worm for Windows Karl DeBisschop (Sep 27)
- Re: RE: Probable new MS DCOM RPC worm for Windows Paul Schmehl (Sep 27)
- Re: RE: Probable new MS DCOM RPC worm for Windows Karl DeBisschop (Sep 27)