New Windows Worm on the Loose

Dynamoo writes "The Internet Storm Center has issued a Yellow Alert due to the spread of the Sasser worm exploiting Windows 2000 and XP machines through a documented flaw in the Local Security Authority Subsystem Service (LSASS) as described in Microsoft Bulletin MS04-011. Initial analysis seems to indicate classic Blaster-style worm behaviour. Right now I'm just getting a probe every 10 minutes or so on my firewall, but this is bound to escalate sharply as the pool of infected machines grows. Of course all good Windows-using Slashdotters visit Windows Update regularly and have a firewall, don't you? More information at Computer Associates, F-Secure, Symantec and McAfee."

Comments

Re:Days like this...

[DarkAce911]

Monday is going to suck if this gets inside our firewall at work. This is the patch we did not push due to it causes 100% processor useage in some machines(MS04-11). Oh well, I am not going in to work this weekend, this worm will have all weekend to grow.

DarkAce911

Re:Mutex Trapping

[Mr. Darl McBride]

Err, Startup Monitor does just that

Sexcellent! Thank you!

Re:This totally sucks.

[NuclearDog]

"It effectively slowed the speed of downloads by about half."

<bragging>
Well, doesn't bother me. Downloading at 600 kb/s still gets me my pr0n fast :)
</bragging>

Anyway. Sounds like the people at your ISP are real assholes. I've called my ISP with a similar problem before, and they said they could not help me (of course the hell-desk geek couldn't, but apparently letting customers talk to the sys admins is against their policy or something), but at least they didn't try and pin it on me. My firewall is configured to only let traffic from my windows box through if it's on specific ports which I use for games.

I really laugh at them, when I call and tell them I have no connection, somethings wrong with my modem or something, and they say, "Ok, go Start->Settings->Control Panel". Then when I tell them I don't run windows, I'm running linux, and connected to my gateway box through SSH, most go silent.

My other favourite is when I call them and they tell me, "Sir, I don't think you have your cable connected right, I can't ping you." First, I have no connection, of course you can't ping me you dumbass. Second, even if I did have a connection, of course you can't ping me, it's called a 'firewall' (more silence, usually).

I guess that's what I get for calling a helpdesk that thinks having an MCSE means you know how to use a computer.

Anyway, I'm pretty bored around here, so sorry for wasting everyone's time with my rambling. I'll go now...