The worm spread quite quickly huh (well as far as I know many people I know their gateway has got the worm and they don't run a firewall?)? you would think after the worm breakouts that don't require you to run a program to be infected people would install a personal firewall but oh well...
This site should actually scan your computer and say "HEY did you know that you don't have a firewall :wink: " but I'm sure that would have some privacy issues.
as Chris said thanks 4 the info Bishop (should have posted the removal tool link in the news post eh? )
Interestingly Neon, Chris and I have been discussing allowing security scans from teh website using nmap in a PHP script.. just like what you're talking about
Alright if anyone has access to an infected PC could you please please mail me the binary before you clean the system. I want a copy of the worm itself.. (avserve.exe) so that I can run it in a controlled environment and disassemble it.. then perhaps I can cook up a little cleanup tool of our own.
So if you have it.. Personal Message me, or reply to this post and I'll give you an address to mail it to.
Does any one actually use LSASS in the real world?
Do you remember the days when unix boxes had all those fun services running on them, like wall and chargen? Seems to me that now it's a case of just have the ports open that you actually want to use, and shut the rest off. That's common practice in a unix environment, but what about Windows? I know that a personal firewall blocks them, but should we be actually hardening our boxes by shutting down some of the surplus services on them? You never know, the things might run better! Any opinions, and which services would be candidates for the chop? :twisted: