PPRuNe Forums - View Single Post - RPC/Blast worm virus
View Single Post
Old 19th August 2003 | 22:41
  #25 (permalink)  
Naples Air Center, Inc.
The Oracle
 
Joined: Aug 2001
Posts: 2,902
Likes: 0
From: Naples, Florida U.S.A.
It did not take long:

There is a new variant of the Worm that is destructive.

The new variant also copies the file TFTPD.EXE to the %System%\Wins folder as SVCHOST.EXE and then creates a service for it with the display name "Network Connections Sharing".

TFTPD.EXE or SVCHOST.EXE is a TFTP (Trivial File Transfer Protocol) server that is used by this worm to set the affected system as a download site for its copy. This worm is then able to propagate by instructing remote systems into downloading it using TFTP.


Looks like this one will be around for a long while,

Richard
Naples Air Center, Inc. is offline