JackClark

Another high volume threat exploiting the MS03-026 vulnerability.
Info here
This one is detected by the daily dats available here

Figment

Correct URL here

Am I correct in assuming that anyone who has already patched against msblaster should be safe(ish)?

JackClark

Thanks for the link.

You're correct, everyone should be safe'ish.

Figment

NP, and cheers

beemerboy

thanks for the headsup, Jack

BB

carl

TBH I'm astounded that anyone was caught by MSBlast. There must be people connected to the net without any sort of hardware or software firewall, and no AV software

stu200

iTrader: (1)

carl,

There's millions of them ... unfortunately

beemerboy

irrelevant at the time...

JackClark

Antivirus software is very relevant, we detected this threat on the 07/29/2003. Info

JackClark

Update: the virus also attempts to exploit an NTDLL.DLL vulnerability (MS03-007) via WebDav.

Time to get patching again.

SJ_Skyline

"The writer of the Nachi worm may want to be seen as the Dirty Harry of the internet world, cleaning up malicious Blaster code wherever it is found,"

said Graham Cluley, senior technology consultant at Sophos



PMSL

JackClark

Graham is such a funny man

fast bloke

Jack - Can you actually confirm that the Nachi payload attempts to clean up remnants of blaster code?

If so, does anyone else find this a bit freaky - sort of like biological warfare without the rotting flesh?

Nicks VR4

FB

http://vil.nai.com/vil/content/v_100559.htm