New RPC worm

only this one does some interesting things. it appears to infect via the RPC vulnerability like lovesan/blaster, only it removes them and then deletes itself.
http://vil.nai.com/vil/content/v_100559.htm
interesting.

 

Cool, but there are other variants of Blaser etc... But still cool, I remember there was a virus that deleted Yaha, but it failed... it was a while ago...

 

is this really a problem? all the virus does it patch your computer and delete blaster, sounds like more of a help then a hurt to me

then deletes itself on jan. 1st 2004

 

yes it is a problem becuase it causes an increase in traffic. That can cause slowdowns on networks. Besides, you just never know when someone comes and alters that one to be malicious... again.

 

Well it patches itself so the net should be patch up in the nexxt month so not too many worries, it deletes itself...

 

So what would this kind of worm be called? An anti-body? A white worm?

Amusing, since it should actually patch the 20% of computers out there that will never be fixed and perpetually infected.

Undesirable, but not malicious.

 

http://securityfocus.net/archive/1/333876/2003-08-16/2003-08-22/0

Since I hope to be at toorcon it's gonna be cool 'cause I'll try to hear him speak

EDIT: Oh, and I'd call it a white hat worm...

 

or WHORM for short
I made that up just now .. credit

 

Yes, you're given credit for making me cringe at such a horrible horrible name

 

i think of it like this. these systems that are being infeted by it likely would never be patched up, if they havn't by now
So at least their patched

 

how strange... hee hee

 

The date should have been sooner, January 1st is a while away and lots of bandwidth...

 

Iamien brought it to my attention how smart it was to create such a worm. I have to agree... it was pretty smart. It may cause more traffic and cause slow downs or congestion, but it was a brilliant idea. Has there ever been something like this done before? It's sort of like an "antivirus virus". Oxymoron!

 

Links at the bottom, it can't be done for everything, for example [1] slammer couldn't be stopped and I bet now virus and worm writers will wisen up and patch the system too

[1] http://securityfocus.com/archive/1/333900/2003-08-16/2003-08-22/0