DCOM worm analysis report: W32.Blaster.Worm

From: Dave Ahmad (da_at_SECURITYFOCUS.COM)
Date: 08/11/03

  • Next message: Russ: "Any Windows 2000 SP2 with MS03-026 systems infected?" 
    Date:         Mon, 11 Aug 2003 15:38:35 -0600
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    A Bugtraq user has already pointed out that a worm has been
    discovered in the wild that exploits the Microsoft Windows DCOM RPC
    Interface Buffer Overrun Vulnerability (Bugtraq ID 8205) to infect
    host systems. Symantec has been tracking its activity and is
    currently conducting analysis/full disassembly of the malicious code,
    which has been named "Blaster". The results of our analysis are
    being made available to the public at the following location:

    https://tms.symantec.com/members/AnalystReports/030811-Alert-DCOMworm.pdf

    It is expected that this report will be updated frequently as more
    information is discovered. Readers are advised to download/refresh
    it throughout the day to ensure that any new information is not missed.

    David Mirza Ahmad
    Symantec

    PGP: 0x26005712
    8D 9A B1 33 82 3D B3 D0 40 EB AB F0 1E 67 C6 1A 26 00 57 12 

    --
The battle for the past is for the future.
We must be the winners of the memory war.
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Are You "Certifiable"? Summer's Hottest Certification Just Got HOTTER!
With a growth rate exceeding 110%, the TICSA security practitioner
certification is one of the hottest IT credentials available.  And now, for
a limited time, you can save 33% off of the TICSA certification exam! To
learn more about the TICSA certification, and to register as a TICSA
candidate online, just go to
http://www.trusecure.com/offer/s0100/
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
  • Next message: Russ: "Any Windows 2000 SP2 with MS03-026 systems infected?"

    Relevant Pages

    • Re: Alert: Microsoft Security Bulletin - MS03-039
      ... The way that Microsoft patched the new RPC Part II vulnerability ... Summer's Hottest Certification Just Got HOTTER! ... To learn more about the TICSA certification, ...
      (NT-Bugtraq)
    • WHERE ARE NT4 OLD PASSWORDS STORED
      ... Sorry if this bores many of you (being an NT4 question), ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)
    • Firewalls and DCOM
      ... Never underestimate the lengths to which your users will inadvertently go through to infect a network;)" ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)
    • Something changing DNS server settings
      ... When I looked in the registry of one of the affected computers, ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)
    • Windows 2000 server issue
      ... accurately parse the lists of vulnerable machines produced by the scan ... of addresses directly on the script. ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification ...
      (NT-Bugtraq)
    • Quantcast