Re: [Full-disclosure] NT4 worm
- From: Juha-Matti Laurio <juha-matti.laurio@xxxxxxxx>
- Date: Wed, 30 Aug 2006 18:11:45 +0300 (EEST)
Are the machines you have experience especially NT4.0 machines?
It appears that one of the PoC's (public on Monday 28th Aug) lists the following information:
"Systems Affected:
* Microsoft Windows 2000 SP0-SP4
* Microsoft Windows XP SP0-SP1
* Microsoft Windows NT 4.0"
but reportedly it is tested against XPSP1 and W2KSP4 systems.
I believe that fully patched NT4SP6a/SRP shipped with Netapi32.dll is affected.
- Juha-Matti
"Geo." <geoincidents@xxxxxxx> wrote:
Has anyone seen a writeup on this new NT4 worm that's spreading via port 139
MS06-040 yet? I'm seeing customers getting hit by it but I haven't seen any
real mention of it anywhere yet. It appears to run two CMD.EXE hidden
windows and sucks up all the cpu in the infected systems trying to spread.
I've also seen one customer who found csrsc.exe on the machine after the
worm hit them.
I did manage to find out once it exploits a machine it uses ftp.exe to
connect back to the infecting host and transfer something but I've not had
time to really dig into this thing. Hoping someone else has already. Looks
like it's spreading pretty quick
http://isc.incidents.org/port_details.php?port=139&repax=1&tarax=2&srcax=2&p
ercent=N&days=40
Geo.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Follow-Ups:
- Re: [Full-disclosure] NT4 worm
- From: H D Moore
- RE: [Full-disclosure] NT4 worm
- From: Geo.
- Re: [Full-disclosure] NT4 worm
- Prev by Date: Re: [Full-disclosure] Re: Re: George Bush appoints a 9 year old to be the chairperson of the Information Security Deportment
- Next by Date: Re: [Full-disclosure] Re: Re: George Bush appoints a 9 year old to be the chairperson of the Information Security Deportment
- Previous by thread: [Full-disclosure] [SECURITY] [DSA 1163-1] New gtetrinet packages fix arbitrary code execution
- Next by thread: RE: [Full-disclosure] NT4 worm
- Index(es):
Relevant Pages
|
