[clug] Latest worm

[Kim Holburn]

At 1:07 PM +1000 03/8/12, Darren Freeman wrote:
>List,
>
>I was laughing this morning at the latest worm attacking Windows boxes
>(pretty much everything from Win2K onwards although I suspect that the
>older boxes are at risk too, but unpatchable). If you don't know what
>worm I mean, check out /.
>
>I thought that port 135 would *have* to be blocked off for the computers
>around me. How wrong I was. According to the logs, the firewall nearest
>to me in RSPhysSE, ANU, is registering heaps of hits from infected
>machines in our building.
>
>So if you're on campus, be aware that the infection is probably
>campus-wide.
>
>And take the time out to be glad that there are so many people running
>Windows, after all now we get to mop up the tears.
>
>And why oh why is port 135 open? Anyone know of a sane reason for there
>to be a clear path from the outside world all the way in here?

Heheh!
from :
http://isc.sans.org/diary.html?date=2003-08-11
RPC DCOM WORM (MSBLASTER)

....

Strings of interest:
msblast.exe
I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!

Kim
-- 
--
Kim Holburn 
Network Consultant - Telecommunications Engineering
Research School of Information Sciences and Engineering
Australian National University - Ph: +61 2 61258620 M: +61 0417820641
Email: kim.holburn at anu.edu.au  - PGP Public Key on request

Life is complex - It has real and imaginary parts.
     Andrea Leistra (rec.arts.sf.written.Robert-jordan)