RE: possible MS03-026 worm?

["mobly99" <dhopper () ameritech net>]

FYI: Symantec's analysis
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.cir
ebot.html

-Dave

> > puts these files in %systemdrive%
> > rpc.exe
> > rpctest.exe
> > tftpd.exe
> > worm.exe
> > lolx.exe
> >
> > also in %windir%\system32
> > lolx.exe
> > dcomx.exe
> >
> > rpc.exe and dcomx.exe appear in the running tasks.
> >
> >
> > I pulled samples of them and submitted to SARC.
> >
> >
> > -Dave

Attachment: smime.p7s
Description: