[Dshield] New Worm

BarkerJr barkerjr at barkerjr.net
Tue Aug 19 01:09:03 GMT 2003


> Paul Marsh wrote:
> ...
> > It will be interesting to see if the 135 numbers start to drop.
> ...
>
> Hi,
>
> as the new worm is scanning for the same vulnerability as blaster
> we won't see any drop in the numbers of connects to 135 until 2004
> when 'melchia' removes itself from infected computers and may have
> patched all systems infected by blaster. Or the users get their
> systems patched without 'help' by the worm before next year.
> (I think the first one will happen, i still get CodeRed connections
> every day.)

I'm not really sure about that.  Symantec's page says that it sends ICMP
pings first.  So, if your firewall blocks ICMP pings, you shouldn't get a
135 from it.  Am I reading too much into it?





More information about the list mailing list