Re: [SLUG] Stopping W32.Welchia with Linux?

From: Levi Bard (levi@bard.sytes.net)
Date: Wed Aug 20 2003 - 11:23:25 EDT


> All right. Now /this/ worm is cool!
>
> According to the following:
> http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html
>
> This worm only replicates itself, and get this, attempts to remove the
> W32.Blaster worm, apply Microsoft's security patches, and reboot the
> machine (once) to allow the changes to take effect. You don't see that
> every day, and you've gotta love it!
>
> Of course it causes massive amounts of ping traffic and whatnot, and
> should be killed, but only after it fixes all of your Blaster problems.
> ;-)

Maybe this will be the new trend in MS upgrade cycle enforcement. They
implement a worm that exploits one of the many existing security holes (of
which they're aware but haven't fixed), installs the latest versions of
all your software, reboots the requisite number of times (depending on
moon phase, weasel mating season, and the current trading price of 3M),
then generates a bill (or possibly initiates legal action upon
nonpayment).

Levi
-----------------------------------------------------------------------
This list is provided as an unmoderated internet service by Networked
Knowledge Systems (NKS). Views and opinions expressed in messages
posted are those of the author and do not necessarily reflect the
official policy or position of NKS or any of its employees.



This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 17:51:01 EDT