Sounds like it was poorly written, and very bulky. Tftp server alone = 470 Kb. Where does it get Worm.exe from, meaning which server does it download from? We can see if it is downloading from some public server, then see who uploaded it ... maybe???
--Justin Shin -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of mobly99 Sent: Saturday, August 02, 2003 2:04 PM To: [EMAIL PROTECTED] Subject: [Full-Disclosure] RE: possible MS03-026 worm? I forwarded the files I found to neohapsis and securityfocus. I'm not equipped with the knowledge to disassemble the code hopefully they can shed some light. The rpctest.exe appears to determine the remote system's OS and spawns a shell, which you can then telnet to. Tftpd.exe is this tftp server : http://www.hanewin.de/e-tftp.htm Worm.exe is a SFX that has rpc.exe tftpd.exe and rpctest.exe in them, extracts and launches them.... -Dave Hopper _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
