Exploit-DcomRPC - Rischio 3 - Update

[Giorgius]

Molto simile al virus "LovSan"...



Aliases:
Win32:RPCexploit, Backdoor.Sdbot.au, TrojanDropper.Win32.Small.bd, Exploit-DcomRPC

Effetti:
This worm exploits the RPC DCOM BUFFER OVERFLOW, a vulnerability in the Windows Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) interface that allows an attacker to gain full access and execute any code on a target machine, leaving it compromised.
It further uses this exploit to drop and execute a copy of itself into the compromised machine.
This worm has been observed to continuously scan random ip addresses and send data to vulnerable systems on the network using port 135.
It also acts as a backdoor by connecting to a remote Internet Relay Chat (IRC) server where a malicious user sends commands that enable this malware to process on the affected system
For more information on the RPC DCOM Buffer Overflow, please visit the following Microsoft page:
Microsoft Security Bulletin MS03-026
This worm runs on Windows NT, 2000, and XP.

http://www.trendmicro.com/vinfo/viru...ORM_RPCSDBOT.A
http://vil.mcafee.com/dispVirus.asp?virus_k=100549


Aggiornamento AntiVirus al 12/08/03 e stessa Patch Microsoft per il Virus LovSan (Y)

[Giorgius]

17:47 VIRUS: SOPHOS SEGNALA W32/RPCSPYBOT-A

(ASCA) - Roma, 13 ago - Un virus identity file (Ide) che
fornisce protezione e' disponibile sul sito di Sophos e sara'
incluso nella versione di settembre 2003 di Sophos
Anti-Virus. Finora Sophos non ha ricevuto alcuna segnalazione
su W32/RpcSpybot-A, noto anche come Win32:RPCexploit,
Backdoor.Sdbot.au, TrojanDropper.Win32.Small.bd ed
Exploit-DcomRPC. Ha comunque rilasciato questo alert in
seguito alle richieste giunte alla sua unita' di assistenza.
Maggiori informazioni su W32/RpcSpybot-A sono disponibili
all'indirizzo
http://www.sophos.com/virusinfo/anal...pcspybota.html
E' possibile scaricare il file Ide da
http://www.sophos.com/downloads/ide/rpcsdb-a.ide Informazioni
su come usare i file Ide sono disponibili all'indirizzo
http://www.sophos.com/downloads/ide/using.html

[Giorgius]

E' stata rilasciata la nuova Release Stinger v1.8.2

Download:
Mirror: http://download.nai.com/products/mca...rt/stinger.exe

Rileva:
BackDoor-AQJ, Bat/Mumu.worm, Exploit-DcomRpc, IPCScan, IRC/Flood.ap, IRC/Flood.bi, IRC/Flood.cd, NTServiceLoader, PWS-Sincom, W32/Bugbear@MM, W32/Deborm.worm.gen, W32/Elkern.cav, W32/Fizzer.gen@MM, W32/FunLove, W32/Klez, W32/Lirva, W32/Lovgate, W32/Lovsan.worm, W32/Mimail@MM, W32/MoFei.worm, W32/Mumu.b.worm, W32/Nimda, W32/Sdbot.worm.gen, W32/SirCam@MM, W32/Sobig, W32/SQLSlammer.worm, W32/Yaha@MM

(Y)