[Dshield] Mydoom (A, B) and Doomjuice.A Worm Removal Tool (KB836528), 2/13/2004

Joseph Stahley 3rd jestahley3 at cox.net
Sat Feb 14 22:03:56 GMT 2004


Gee a day late and a lot of dollars short..How long has Mydoom been out? And
MS just released a tool to fix it yesterday..Kinda makes you wonder what
they are really doing at MS..Sad part is that it does not show up in windows
update..Now how many people really know where to look for it besides admins.
If you're the average consumer windows update is your vehicle for getting
updates and if it ain't there, then all those systems remain bugged. Didn't
MS develop a strategy for getting windows update, sus, shavlik's hfnet check
and mbsa to be on the same page when it came to updates..Wonder what is
taking so long?

Joe   

-----Original Message-----
From: list-bounces at dshield.org [mailto:list-bounces at dshield.org] On Behalf
Of Micheal Patterson
Sent: Saturday, February 14, 2004 9:08 AM
To: dshield
Subject: [Dshield] Mydoom (A, B) and Doomjuice.A Worm Removal Tool
(KB836528),2/13/2004

Oh, this is nice. MS has a removal tool for *doom* trojans. It only shows up
if you need to remove the item. It's also available for the SUS servers as
well. This is actually not a bad move in my opinion, with the exception of
one small item.

On the SUS servers that I'm running, I can synchronize to get the update,
select the tool item, go to approve, and of course as normal, the legal
acceptance notice comes up. You know, where you can't install unless you
accept the item. Well, the problem is, that there's nothing to allow you to
accept or decline. So, you can't accept it, can't install it, and without
approving it, you can't use it in a SUS environment. Even though, MS has
sent a notice out saying that SUS content has been updated.

"You have received this message because Software Update Services has made
updated content available. Please synchronize your server running Software
Update Services with the Windows Update download servers. By synchronizing
your server, you will gain access to the most current list of updates"

Anyone else seen this yet?

--

Micheal Patterson
Network Administration
TSG Incorporated
405-917-0600


_______________________________________________
list mailing list
list at dshield.org
To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list





More information about the list mailing list