Whittler Trying to Carve Out a Living   |   ARCHIVES   |   Meteor Shower Lights the Skies in Comet's Trail >>

 

Irrational News Internet Storm Center: RPC DCOM WORM (MSBLASTER) BAR-ENDER
Posted by: on Aug 12, 03 | 9:03 am

Names and Aliases: W32.Blaster.Worm (symantec),W32/Lovsan.worm (McAfee), WORM_MSBLAST.A (Trend Micro),Win32.Posa.Worm (CA),Lovsan (F-secure), MSBLASTER,Win32.Poza.

The name of the binary is msblast.exe. It is packed with UPX and will self extract. The size of the binary is about 11kByte unpacked, and 6kBytes packed.

Strings of interest:

msblast.exe
I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!
windowsupdate.com
start %s
tftp -i %s GET %s
%d.%d.%d.%d
%i.%i.%i.%i
BILLY
windows auto update
SOFTWARE\Microsoft\Windows\CurrentVersion\Run







Read More...

permalink


Comments
name
Email
Location
Homepage


Show email   Remember me

Notify me when someone replies to this post?