No replies to this topic

[AplusWebMaster]

FYI...from the Internet Storm Center:

- http://isc.sans.org/...date=2004-05-20
"A third Bobox variant has been discovered that now uses the RPC/DCOM vulnerability on TCP port 135 in addition to the existing probes on TCP ports 445 and 5000. The DCOM exploit code in Bobax.C contains offsets for both Windows 2000 and Windows XP so Bobax.C can now infect both of these OSes where Bobax.[AB] could only infect Windows XP."

>>> http://isc.sans.org/...ls.php?port=135 (see "Sources" spike - to 550K)