Re: Analysis/decompilation of main() of the msblast worm

[Helmut Hauser <helmut.hauser () intraplan de>]

In-Reply-To: <001a01c362a4$d523d600$b100a8c0@penetrator>

Sorry Dennis but the regards must go to E-Eye Security:

http://www.eeye.com/html/Research/Advisories/Blaster_Analysis.txt
(Done on August 12, 2003) btw very nice Disasm :)

There is another RPC Leak which is not fixed by the Microsoft Patch.


Helmut Hauser
Sysytemadministrator
Intraplan Consult GmbH