Yes, as long as all four variants use a buffer overflow on the lsass process.
-----Original Message----- From: [EMAIL PROTECTED] On Behalf Of Brian Tan Sent: Tuesday, May 04, 2004 5:49 AM To: [EMAIL PROTECTED] Subject: [ISSForum] Can the latest 22.19 XPU detect and respond to Sasserworm?? If i have enabled both "MSRPC_LSASS_Bo" and "MSRPC_LSASS_Request_Detected",will it pick up and respond to all the 4 distinct variants of Sasser worm?? -- ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
