http://story.news.yahoo.com/news?tmpl=story&u=/cmp/20030819/tc_cmp/13100535New 'Good' Worm Attempts To Repair Security On Infected Systems
Tue Aug 19, 3:35 AM ET Add Technology - TechWeb to My Yahoo!
Marcia Savage, CRN
A new worm takes a different twist by trying to repair systems infected by Blaster and patch the vulnerability it exploits, antivirus vendors said Monday.
The worm, called Nachi or MSBlast.D, tries to delete Blaster from some infected systems and install patches, according to Trend Micro. Last week's Blaster worm, also called MSBlast and Lovsan, infected hundreds of thousands of systems by exploiting a Remote Procedure Call (RPC) flaw in Microsoft Windows.
Nachi exploits the same flaw but can delete the MSBlast.exe file left by Blaster on machines running Windows 2000 (news - web sites) and Windows XP (news - web sites) and download Microsoft patches to fix the flaw, according to Trend Micro.
The company rated the new worm as a medium risk. Computer Associates ranked the worm as medium-on-watch, while Network Associates called it a medium risk.
more..............