lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
From: lists at onryou.com (Cael Abal) Subject: RE: Probable new MS DCOM RPC worm for Windows > I'm thinking that there *has* to be a variant of Nachi/Welchia in the > wild. We have machines that were patched for MS03-026 (verified by > scanning with multiple scanners) but not patched for MS03-039 (ditto) > and they have been infected by something that triggers my Nachi rule in > snort. This should *not* be possible with the "original" Nachi/Welchia, > so my assumption is that either something new has been released or the > worm has mutated somehow. > > Mind you, this is anecdotal and a very small incidence (only three > machines so far), but it still bears watching IMHO. I've been surprised > to not see any discussion on the lists about a new variant. Perhaps no > one is looking? Hi Paul, Did you use a third-party tool to verify the patches were actually successfully installed on the infected machines, before detecting the infection? Cael
Powered by blists - more mailing lists