McAfee is reporting an outbreak of a new worm that affects Windows 2000 and pre Windows XP SP2 users.
The worm creates 16 threads to scan for infectable systems. The worm targets random class B IP addresses, sending SYN packets to TCP Port 445. When a vulnerable system is found, buffer overflow and shellcode is sent to the remote system, creating an FTP script and launching FTP.EXE to download and execute the worm from the source system.
This worm exploits the MS05-039 vulnerability. There are at least 2 other W32/Sdbot based worms know to exist that also exploit this vulnerability. They may be seen with the filenames pnpsrv.exe or winpnp.exe.
View: Details & Fix Information @ McAfee
View: MS05-039 Bulletin & Fixes @ Microsoft
Source: Thanks Jon for posting this in Back Page News on our forums.
The worm creates 16 threads to scan for infectable systems. The worm targets random class B IP addresses, sending SYN packets to TCP Port 445. When a vulnerable system is found, buffer overflow and shellcode is sent to the remote system, creating an FTP script and launching FTP.EXE to download and execute the worm from the source system.
This worm exploits the MS05-039 vulnerability. There are at least 2 other W32/Sdbot based worms know to exist that also exploit this vulnerability. They may be seen with the filenames pnpsrv.exe or winpnp.exe.
View: Details & Fix Information @ McAfee View: MS05-039 Bulletin & Fixes @ MicrosoftSource: Thanks Jon for posting this in Back Page News on our forums.
try telling cisco that!
As for firewalls, yes you should have one, but what happens if someone brings an infected laptop inside your network? Perimeter security may work for very small networks, but you really need more (as we all found out with the Blaster).
And people STILL think there's nothing wrong with not installing SP2....
And you're basing this on MS05-039?
Let's take a look at which versions of Windows MS says are affected, shall we?
• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
• Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
Hey, look at that. Both XPsp1 AND XPsp2 are affected.
You know what that means, HoochieMama?
(I know; I'm just wondering if you do.)
Update: XP SP2 is affected, as much as w2ksp4 rollup 1 and w2k3 sp1 is.
Only if NULL Sessions have been manually enabled.
Check HKLMSYSTEMCurrentControlSetControlLsarestrictanonymoussam is set to 1. If it is, you should be ok.
I had two disks of Windows XP. One was my original copy with SP1 slipstreamed and a copy my college gave me with SP2.
I had problems with my computer so I formatted and accidently put the SP1 disk in to re-install. I then tried updating everything but I noticed my computer FILLED with spyware right away. I tried to remove it all but it wasn't working. Then, I noticed FTP.exe and I was like "WTF MATE!". Did virus scans and everything at the time but because it was new, couldn't clear it out.
I had to finally find my XP SP2 disk and install from there because my SP1 was WAY too infected.
Yes, an Anti-Virus is a must now-a-days, but so is a Firewall or Router in my humble opinion.
haha~ how long did his comp last I wonder... 30 secs?
He was on SP1 that time if I understand things correctly, and that version of XP is as we all know a swiss cheese when it comes to computer security. I feel a bit sorry for new XP users who haven't slipstreamed (it's far from an obvious and common procedure to do for novices).
Now I'm running Windows XP SP2 fully patched thank you very much. Clean as can be. No spyware and no viruses. It was just the wrong CD that I grabbed that's all.
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.