Preventing And Removing The Nachi Worm
News Nachi (w32.nachi.a, also known as Welchia, worm_msblast.d, and Sachi) exploits the same Microsoft DCOM RPC Windows flaw as MSBlast, but it removes traces of that worm and even downloads the correct version-specific DCOM RPC patch to prevent...
[August 20, 2003, 10:15]
Cleaning Up After The MSBlast Worm
News It is worth noting that an updated version of the worm could affect other Microsoft operating systems, so it is recommended that all systems are patched against the DCOM vulnerability. The worm exploits a widely publicised "DCOM" vulnerability...
[August 12, 2003, 14:59]
Why Did MSBlast Fail To Take Down Microsoft?
News MSBlast, like most other worms, came shortly after the announcement of a DCOM Remote Procedure Call (RPC) vulnerability in Windows NT, 2000, and XP systems. For example, blocking TCP port 135 on routers will stop MSBlast but also other software...
[August 28, 2003, 13:30]
Networks Must Counter Triple Threat
News When it finds one, it attempts to exploit the DCOM RPC buffer overflow, create a remote root shell on TCP port 4444, then use FTP to download a file called msblast.exe onto the infected computer. Blaster takes advantage of a DCOM RPC vulnerability...
[August 21, 2003, 12:40]
Protecting Yourself From The MSBlast Worm
News When it finds one, it attempts to exploit the DCOM RPC buffer overflow, create a remote root shell on TCP port 4444, then use FTP to download a file called msblast.exe onto the infected computer. The worm takes advantage of the Distributed...
[August 12, 2003, 10:15]
Code Mishmash Drives MSBlast
News That program, known as dcom.c, attempts to use a vulnerability in a widely used component of the operating system that allows other computers to ask Windows systems to perform an action or service. Moreover, even though MSBlast can detect whether a...
[August 13, 2003, 8:39]
Worm Detector Looks Out For Bad Behaviour
News Check Point's InterSpect supports, among others, the CIFS, MS SQL, DCOM, Sun RPC, DCE RPC and HTTP protocols. Lowe gave MSBlast as an example, where the vulnerability was announced in April 2003 and a patch was published in July.
[January 20, 2004, 14:15]
Experts Predict New Virus Rampage
News The flaw that led to the MSBlast worm affected another Windows service, known as the distributed component object model (DCOM), which allows components of the operating system to communicate. I think we are going to see a repeat of the (MSBlast...
[October 24, 2003, 8:45]
