Re: Worms and CScript/WScript

[Ryan Russell <ryan () securityfocus com>]

On Tue, 21 May 2002, Blake Frantz wrote:

> A majority of the worms (even SQLsnake) that have been going around
> lately take advantage of cscript and wscript.  What ramifications would
> be felt on vanilla installs of common services (MS SQL, Exchange, IIS,
> etc.) if these two files were moved or deleted?  It seems like a fairly
> easy way to help mitigate the 'success' of Internet worms.  Any
> thoughts?

Tried that once.  The next IE upgrade will just put them back, and you
might not even notice... was kinda counterproductive.

                                        Ryan


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com