RE: MSBLASTER Infecting despite 03-026 patch?

I have been using the Retina DCOM scanner and it is working very well. After patching some systems, they still scanned as vulnerable. On NT, we were using the presence of the registry key
HKLM\Software\Microsoft\Windows NT\Current Version\Hotfix\Q823980 to verify that the workstations were patched, but I found a workstation that had the registry key, but still scanned as vulnerable.

Apparently something interfered with the installation before the .dlls or .exe could be loaded but after the registry key was created. Repatching the affected systems fixed them.

This seemed to happen on workstations that were not up to service pack 6a. The hotfix would terminate and the user would reboot without noticing the error.

• Marc Maiffret <marc@eeye.com> wrote:
  > I cant speak for the other tools but Retina's latest
  

  ---

  
  > | ---
  > |
  >
  

  ---

  
  > | ----
  > |
  > |
  > |
  >
  

  ---

  
  > | ---------
  > |
  >
  

  ---

  
  > | ----------
  > |
  > |
  >
  >
  >
  

  ---

  
  >
  

  ---

  
  >
  >
  >
  

  ---