full-disclosure - rpc worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <003501c3607f$6158aba0$7c04c80a@villanm>
From: villain at protonic.com (ViLLaN)
Subject: rpc worm

The new NAV defnitions started replication roughly 30 minutes ago.. They
should be out to all the servers by now.. Running LiveUpdate should get
you the defs that detect msblaster. 

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Arcturus
Sent: Tuesday, 12 August 2003 10:57 AM
To: 'Jerry Heidtke'; 'Jordan Wiens'; 'Jason Coombs'
Cc: full-disclosure@...ts.netsys.com; Spurlin, Tony
Subject: RE: [Full-Disclosure] rpc worm
Importance: High

I am running NAV Corporate Edition 8.00.9374 with Scan Engine 4.1.0.15,
and Definitions 8/11/2003 rev.19.

It provides the following upon the scan of the infected zip of
mblast.exe

Scan type:  Manual Scan
Event:  Virus Found!
Virus name: W32.Blaster.Worm
File:  C:\Documents and Settings\jnoble\Desktop\msblast.zip>>msblast.exe
Location:  Quarantine
Computer:  LT001-010254
User:  jnoble
Action taken:  Clean failed : Quarantine succeeded : 
Date found: Mon Aug 11 20:53:35 2003

I recommend a complete update of all scan engines and virus defs...

Good Luck.

-
Jim Noble
Network & Security Director
INFO1
CISSP, CCSE+, CNX

770-416-6877 x342 (Tel)
770-355-5049 (Cell)
404-318-8467 (Pager) 

===================================
CONFIDENTIALITY===================================
This E-mail is confidential. It should not be read, copied, disclosed or
used 
by any person other than the intended recipient. Unauthorized use,
disclosure or 
copying by whatever medium is strictly prohibited and may be unlawful.
If you have 
received this E-mail in error please contact the sender immediately and
delete 
the E-mail from your system. 
===================================
CONFIDENTIALITY===================================

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html