It Sounds like you don't have to have port 135 open to the wild to be devastated by this possible worm.

You could have an e-mail that installs it on one machine inside your network.
That machine would then have access to port 135 on of any number of computers on the protected network, say 1 or 2 or thousands of computers.

The virus could then simply infect all computers and then set themselves to format all the computers after a certain time has past.

The infected machine could infect others through port 135, The machines that are protected by anti-virus could simply be formatted without using programs that would alert the ant-virus program.

Make sure local users only have 'user' rights and not 'admin' or 'power user' rights since this will limit the formatting ability of the logged on user or worm program.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/174/20967#20967