Re: [Full-Disclosure] Windows Dcom Worm Killer

From: Nick FitzGerald (nick@virus-l.demon.co.uk)
Date: Wed Aug 13 2003 - 03:01:05 PDT

Next message: morning_wood: "Re: [Full-Disclosure] DameWare Mini-RC Shatter"

Previous message: ashat_private: "[Full-Disclosure] DameWare Mini-RC Shatter"
In reply to: Joey: "Re: [Full-Disclosure] Windows Dcom Worm Killer"
Next in thread: w g: "Re: [Full-Disclosure] Windows Dcom Worm Killer and source code"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

joey2coolat_private wrote:

> I suggest that you also disable DCOM completely with
> the dcomcnfg utility. More info is available at the
> address below. Be sure to remove all of the DCOM
> "Default Protocols" including TCP to stop windows from
> listening on port 135

I agree in general, but also be aware that using dcomcnfg, or manually 
tweaking the associated registry setting and restarting, to disable 
DCOM does not work on Win2K for SP0 - SP2 inclusive and may not work on 
some other OSes.

Regards,

Nick FitzGerald

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Next message: morning_wood: "Re: [Full-Disclosure] DameWare Mini-RC Shatter"
Previous message: ashat_private: "[Full-Disclosure] DameWare Mini-RC Shatter"
In reply to: Joey: "Re: [Full-Disclosure] Windows Dcom Worm Killer"
Next in thread: w g: "Re: [Full-Disclosure] Windows Dcom Worm Killer and source code"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Aug 13 2003 - 03:49:15 PDT