Re: All the symptoms no worm yet
From: Bob McCoy [MSFT] (bobmccoy_at_online.microsoft.com)
Date: 08/18/03
- Next message: Kory: "accessing website"
- Previous message: MS: "windows update vs. MS Baseline Security Analyzer"
- In reply to: Michael legge: "All the symptoms no worm yet"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 17 Aug 2003 21:34:00 -0500
Here's the one thing you didn't say ... did you install the patch?
Here's the catch -- you can be affected but not infected. The tries to
guess which target operating system it's going to infect (80% chance of it
being XP, 20% Window 2000). If it guesses wrong, it could very well crash
the RPC service, but not infect the system. So the payload (msblast.exe or
one of the variants) was never installed on your system, therefore it
couldn't be found.
By all means, install the patch. That fixes the DCOM.RPC vulnerability.
-- Bob McCoy Microsoft Corporation * This posting is provided "AS IS" with no warranties, and confers no rights. * Please note I cannot respond to email questions. Please use these newsgroups. "Michael legge" <mlegge967@hotmail.com> wrote in message news:004601c362d6$2e864260$a001280a@phx.gbl... > I have all of the symptoms of this worm on my xp machine > the computer restarts, the generic host process for Win32 > crashes. I was able to change the rpc settings so the > computer would stop restarting that worked, i also went > to the registry key through the directions off > Microsoft.com but the entry was not there. there is also > not a program (blaster etc)running in the task manager I > have downloaded 3 different scan tools from Trend > micro,symantec,and computer associats and all 3 scans > came up with no worm. has anyone had this same problem or > is this a feature of one of the new strains that i have > been hearing about. please reply if you have any > info/ideas that might help > thanks
- Next message: Kory: "accessing website"
- Previous message: MS: "windows update vs. MS Baseline Security Analyzer"
- In reply to: Michael legge: "All the symptoms no worm yet"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
