is it even possible for a worm with dcom vuln?

["Victor Pereira" <vpereira () modulo com br>]

<H D Moore>

A highly-effective worm would be not be difficult to write for the reasons
below. Residential ISP's should start blocking 445 and 135 immediately.
Corporate networks should block these ports in both directions at every
major gateway as soon as possible.
....
</H D Moore>

Don't forget all wireless lans without access restrictions around the world.
It is a good target to start a worm propagation using microsoft services,
because a lot of companies close it in they're  internet firewalls, but in a
LAN enviroment, everything is open.
I can't figure out the damage.. can you ? ;-)

Reguards,

______________________________________________
Victor Pereira - LPI, CCSA, CCSE

http://www.modulo.com.br
http://getdata.codigolivre.org.br