martin f krafft <[EMAIL PROTECTED]> wrote: > Does anyone know what happens if you run msblast.exe on an > uninfected system?
It becomes infected and infective. There is nothing especially magical about the features of the worm program -- run it and it starts trying to spread (or to DoS windowsupdate.com depending on the date). Its function is certainly not affected by the way it gets onto a machine or whether it is launched by the exploit code or not (well, it may depend on some elevated privileges such as the those it gets as local system from the RPC exploit code running, as it does, as part of a system service). -- Nick FitzGerald Computer Virus Consulting Ltd. Ph/FAX: +64 3 3529854 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
