full-disclosure - Nachi Worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BE95468933894D4D966D724C295E15A202370FFB@mcg-ex05.mcgov.org>
From: Sonny.Discini at montgomerycountymd.gov (Discini, Sonny)
Subject: Nachi Worm

Actually, if you scan for port 707 and it is open, you can be sure that
the box is infected. This is how we pinpoint Welchia/Nachia infections. 
 
 
Sonny Discini
Network Security Engineer
Department of Technology Services
Enterprise Infrastructure Division
Montgomery County Government
-----Original Message-----
From: Norman Girard [mailto:ngirard@...lys.com] 
Sent: Thursday, December 04, 2003 3:32 PM
To: David Loyd; isp-security@...-securtiy.com
Cc: full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] Nachi Worm


Dave,
 
You can scan but only through the registry access. You need to provide
the login credentials of the domain...

	-----Original Message-----
	From: David Loyd [mailto:2of2@...matrix01.us]
	Sent: Thursday, December 04, 2003 11:53 AM
	To: isp-security@...-securtiy.com
	Cc: full-disclosure@...ts.netsys.com
	Subject: [Full-Disclosure] Nachi Worm
	
	
	Does any one know if you can sacn of the nachi worm or the
rpc.dcom vulnerability with nessus
	 
	Thanks
	
	Dave

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031204/a7da387e/attachment.html