Interesting and mildly amusing details about Nachi, aka Welchia, aka MSBlast.D, aka LoveSan.D:
http://www.sarc.com/avcenter/venc/data/w32.welchia.worm.html Aside from the fact that this worm does not have an administrative "off-button", I fail to see how this variant is "SCARY". IMHO, it's a needed auto-patcher for those people who lacked the fore-sight or capacity to patch against the RPC flaw in advance (just kidding ;-P). So, once everyone is patched, can we finally be done with all the hype surrounding this very poorly written excuse for an Internet Worm? JP -----Original Message----- From: X-Force [mailto:[EMAIL PROTECTED] Sent: Monday, August 18, 2003 1:20 PM To: [EMAIL PROTECTED] Subject: [ISSForum] ISS Security Brief: UPDATED MSRPC DCOM Worm Variants Propagating -----BEGIN PGP SIGNED MESSAGE----- ISS X-Force has updated the MS Blast Alert with information about the new MSRPC DCOM worm named, "Nachi". This worm is not a variant of LovSan/MS Blast. Please review the X-Force Alert linked below for more information: http://xforce.iss.net/xforce/alerts/id/150 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBP0EKADRfJiV99eG9AQFdswP/dxOSOkWIZPlln/2fHTCawE7oFCOPcrmk kbbIu6RzhI056C1afI871iFZEfs21ZB+IkwKYuvehI+3H4Qrg/kO+kMuRzTk9OsZ 5+6y0wG/sCrYKDKtwLnxllUBDwOxJO7PpJfUuvDfRQZoTa7njOGwMs0yNgItpNk8 raYgy6iv4FI= =rHLF -----END PGP SIGNATURE----- _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo
