Full Disclosure mailing list archives
RE: exploit-dcomrpc.gen
From: "Ferris, Robin" <R.Ferris () napier ac uk>
Date: Tue, 17 Feb 2004 15:53:43 -0000
further to last info, does any one have any packet information about this? best info would be used to cretae a packets filter using etherpeak so we can find source of infection. TIA -----Original Message----- From: Ferris, Robin [mailto:R.Ferris () napier ac uk] Sent: 17 February 2004 14:59 To: full-disclosure () lists netsys com Subject: [Full-disclosure] exploit-dcomrpc.gen Hi folks a couple of quick questions, has any one else seen this infection recently exploit-dcomrpc.gen, you would proably be using mcafee to see it detected as this. I what is odd is that these machines that are infected are patched with ms03-007/026/039 waswondering if any one had seen this at all. * infection goes to c:\windows\system32\drivers\svchost.exe * infected file is in IE temp folder labelled as WksPatch[1].exe Any info would be appreciated. Thanks Robin
Current thread:
- exploit-dcomrpc.gen Ferris, Robin (Feb 17)
- <Possible follow-ups>
- RE: exploit-dcomrpc.gen Ferris, Robin (Feb 17)
- RE: exploit-dcomrpc.gen Ferris, Robin (Feb 23)