MSBlast Copycat hits the net

***Zardon*** · Aug 13, 2003, 05:23 PM

A crazy week for viruses, worms and whatever else the idiots with too much time decide to unleash on us all. Alot of people have been affected by the recent MSblast worm and now we have another one to content with, thanks to board member wildchild for making me aware of this

It didn't take long for a quick copycat of MSBlast to show its face. Wednesday, Moscow-based security firm Kaspersky Labs detected a variation of the MSBlast worm loose in the wild.

The worm, which has not yet been named, is a near doppelganger of MSBlast, with only slight changes. The name of the primary worm-carrier file--MSBLAST.EXE in the original--is now TEEKIDS.EXE. The variation's code has also been compressed with FSG rather than UPX, and a new string of text buried within the code takes different potshots at both Microsoft and anti-virus developers.

The danger is that while the two worms are very similar--and exploit the same RPC vulnerability in Windows--it's possible for both to co-exist on the same computer.

"In other words, all computers infected by the original will soon be attacked by its revamped version," said Eugene Kaspersky, the head of anti-virus research at the Russian company.

ivan300 · Aug 13, 2003, 05:56 PM

my firewall has been going nuts this week lol

Zenith · Aug 13, 2003, 06:02 PM

My firewalls been going mad too

I average 1 attack on port 135 a minute though most of the day.

digerati · Aug 13, 2003, 06:16 PM

My recruiter got hit by this thing, his computer's out of commision.

WildChild · Aug 13, 2003, 08:49 PM

Every lil bit helps....just doing my part ....

Murdock · Aug 15, 2003, 08:02 AM

Quote:

Originally posted by ^_^
My recruiter got hit by this thing, his computer's out of commision.

I agree with you it kept out the first one from my system, i scanned with the symantec tool
I hope it Can Block the other ones too.
I Use Zone Alarm Pro latest version.

Greetz Murdock

Murdock · Aug 15, 2003, 08:05 AM

Quote:

Originally posted by Zenith
My firewalls been going mad too I average 1 attack on port 135 a minute though most of the day.

I agree with Zenith it kept out the first one from my system, i scanned with the symantec tool
I hope it Can Block the other ones too.
I Use Zone Alarm Pro latest version.

Greetz Murdock

I hit the first replay button accedently It was a Reply For Zenith , excuse me for that.