full-disclosure - ISS Security Brief: "MS Blast" MSRPC DCOM Worm Propagation (fwd)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <871080DEC5874D41B4E3AFC5C400611E03F60790@UTDEVS02.campus.ad.utdallas.edu>
From: pauls at utdallas.edu (Schmehl, Paul L)
Subject: ISS Security Brief: "MS Blast" MSRPC DCOM Worm Propagation (fwd)

Be careful of svchost.  ServUFTPD is often renamed svchost.exe to hide
it from less knowledgeable people.  To check to see if you have one
running, search for "svchost.exe" and check the file size.  If you find
one that around 496K, you're running a warez site.  (Normal size is 8 to
14k, depending upon file version.  Fully patched WinXP SP1 is 13k.)

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/

> -----Original Message-----
> From: Joey [mailto:joey2cool@...oo.com] 
> Sent: Wednesday, August 13, 2003 2:56 PM
> To: full-disclosure@...ts.netsys.com
> Subject: RE: [Full-Disclosure] ISS Security Brief: "MS Blast" 
> MSRPC DCOM Worm Propagation (fwd)
> 
> 
> svchost.exe listens on several ports on windows xp.
> If microsoft is saying that it should never be on the
> internet, couldn't there be more b0f's discovered in
> the future? One peculiar service "DNS Client",
> although listening on a few random ports just about
> 1024, also runs off of svchost.exe.