[Dshield] New Worm
barkerjr at barkerjr.net
Tue Aug 19 01:09:03 GMT 2003
> Paul Marsh wrote:
> > It will be interesting to see if the 135 numbers start to drop.
> as the new worm is scanning for the same vulnerability as blaster
> we won't see any drop in the numbers of connects to 135 until 2004
> when 'melchia' removes itself from infected computers and may have
> patched all systems infected by blaster. Or the users get their
> systems patched without 'help' by the worm before next year.
> (I think the first one will happen, i still get CodeRed connections
> every day.)
I'm not really sure about that. Symantec's page says that it sends ICMP
pings first. So, if your firewall blocks ICMP pings, you shouldn't get a
135 from it. Am I reading too much into it?
More information about the list