Re: DCOM worm is out

From: Dominick S. <dsardina(at)si.rr.com>
Date: Mon Aug 11 2003 - 20:48:07 EDT

Thankfully I am patched way before today. But some people arent so lucky.

I have a friend who just let me know..he is infected and he wrote this.

>From what I've seen it launches processes with various names:
 firedamon, dll32, msblast, runserv48, runserv16, runserv, runserv2, etc.

Just a FYI.

Stay Safe!

DS-
http://www.infosecnyc.com

• Original Message ----- From: "Marc Fossi" <mfossi@securityfocus.com> To: "Focus-MS" <focus-ms@securityfocus.com> Sent: Monday, August 11, 2003 4:32 PM Subject: DCOM worm is out

> FYI
>
> http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
-
> Your network firewall and IDS products do not prevent Web application
-
>

---

Your network firewall and IDS products do not prevent Web application attacks - the most common form of online exploitation- resulting in Web defacement, data theft, sabotage and fraud. KaVaDo is the only company that provides a complete suite of Web application security products.
Download a FREE whitepaper on "Security Policy Automation for Web Applications":http://www.securityfocus.com/Kavado-focus-ms

---

Received on Tue Aug 12 09:49:54 2003