| This worm spreads by exploiting a recent vulnerability in
Microsoft Windows. The worm scans random ranges of IP
addresses on TCP port 135. Discovered systems are
targeted. Exploit code is sent to those systems,
instructing them to download and execute the file
MSBLAST.EXE from a remote system via TFTP.
Once run, the worm creates the registry key (may be
either of the following):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\ Run "windows auto update" = msblast.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\ Run "windows auto update" = msblast.exe
I just want to say LOVE YOU SAN!! bill
Indications of Infection:
Presence of unusual TFTP files
Presence of the file msblast.exe in the WINDOWS
SYSTEM32 directory
Error messages about the RPC service failing (causes
system to reboot)
|
