Re: reports of DCOM worm on the loose...#3

From: Russ (Russ.Cooper_at_RC.ON.CA)
Date: 08/11/03

  • Next message: Dave Ahmad: "DCOM worm analysis report: W32.Blaster.Worm" 
    Date:         Mon, 11 Aug 2003 17:35:23 -0400
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Anyone infected with this worm should look for two things, and if found, send them to me.

    1. TFTP2576 in the System32 directory. Not sure what this file is, so be careful with it.

    2. A list of IP addresses, in any file, which contains any of the following addresses;

    204.210.57.87
    217.211.179.193
    24.147.64.171
    24.147.64.205
    24.147.64.208
    24.147.65.146
    24.147.65.45
    24.147.65.9
    61.254.65.159
    67.119.36.219
    68.112.65.38
    68.166.102.136
    68.166.107.21
    68.166.111.175
    68.166.120.34
    68.166.121.135
    68.166.123.4
    68.166.124.186
    68.166.124.93
    68.166.139.155
    68.166.139.210
    68.166.141.66
    68.166.142.194
    68.166.142.215
    68.166.36.178
    68.166.56.123
    68.166.60.51
    68.166.98.3

    Cheers,
    Russ - NTBugtraq Editor

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Are You "Certifiable"? Summer's Hottest Certification Just Got HOTTER!

    With a growth rate exceeding 110%, the TICSA security practitioner
    certification is one of the hottest IT credentials available. And now, for
    a limited time, you can save 33% off of the TICSA certification exam! To
    learn more about the TICSA certification, and to register as a TICSA
    candidate online, just go to

    http://www.trusecure.com/offer/s0100/

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

  • Next message: Dave Ahmad: "DCOM worm analysis report: W32.Blaster.Worm"

    Relevant Pages

    • Re: Alert: Microsoft Security Bulletin - MS03-039
      ... The way that Microsoft patched the new RPC Part II vulnerability ... Summer's Hottest Certification Just Got HOTTER! ... To learn more about the TICSA certification, ...
      (NT-Bugtraq)
    • WHERE ARE NT4 OLD PASSWORDS STORED
      ... Sorry if this bores many of you (being an NT4 question), ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)
    • Windows 2000 server issue
      ... accurately parse the lists of vulnerable machines produced by the scan ... of addresses directly on the script. ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification ...
      (NT-Bugtraq)
    • Firewalls and DCOM
      ... Never underestimate the lengths to which your users will inadvertently go through to infect a network;)" ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)
    • Re: Drivial Pursuit: Internet Explorer Browser & Your Files and Folders !
      ... The default Enhanced Security Configuration of IE ... access to files and folders on the local machine from the internet. ... With a growth rate exceeding 110%, the TICSA security practitioner certification is one of the hottest IT credentials available. ... And now, for a limited time, you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)