AW: RE: Probable new MS DCOM RPC worm for Windo ws

["Neis, Mark" <Mark.Neis () enviam de>]

Ferris, Robin wrote:

> would it have been possable to actually replace these files manually and
the
> PC therefore be "patched" so to speak?

I'm not sure if that works - at least the hotfix package seems to make some
entries
to the registry as well. Can't tell you which ones, though.

Anyway, you have to find a way to circumvent the "file in use" problem,
e.g. by first copying the files to dllcache dir, then booting to a repair
console from an installation CD or similar and copy them to system32.

Mark

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html