Worm Hits Windows 2000 in China

Despite issuing a preemptive patch two weeks ago and another warning late last week, Redmond is now investigating a bug exploiting Windows Server Service for Windows 2000 that reportedly originated in China.

The problem stems from a worm that Symantec Corp. is calling Wecorl. It's also been dubbed "MS08-67.g" by Kaspersky Lab and Microsoft. The MS08-67.g name derives from a patch tag number for the out-of-cycle bulletin issued on October 23.

Symantec security response said that the worm, which was discovered late Monday, can install a Trojan downloader and rootkit code to mask it from security software.

The latest bug affects Windows 2000 and has thus far been seen on Chinese PCs running Windows. Wecorl is similar to the bug that Microsoft was supposed to be patching two weeks ago. At that time, Microsoft described weaknesses in server service mechanisms in the Windows 2000, Windows XP and Windows Server 2003 operating systems. The weaknesses could allow for remote code execution exploits through the use of a "specially crafted" remote procedure call request.

The vulnerability can enable automatic remote interactions or subroutines between CPUs in a shared processing environment. If the worm manages to bore through into one Windows-based PC, it can also make attempts to weave its way through other workstations connected on the same subnet.

The nature of the bug, means it can get around the firewall-level blocks that Microsoft touted in its patch release, according to Andrew Storms, director of security at nCircle.

On the positive side, Microsoft knew the bug was coming, they were prepared for it and the word was out, Storms added.

"As security professionals, we have signatures for this sort of thing when it's already in play" he said. "Had it gone undetected, there wouldn't have been any baseline from which enterprises can begin to assess the threat."

That said, he cautioned that those who have not already patched the affected systems should still do so "ASAP."

Symantec assessed the worm as a "very low" risk because it originated from overseas and only affected Windows 2000. But the company also encourages installation of the previous patch and is continuing to take its cue from Microsoft's inclination that the bug constituted an emergency. For that reason, Symantec is still classifying the bug with a level 2 rating via its ThreatCon global threat rating system.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Forklift Container

    A Better Way To Upgrade Hyper-V Storage

    It's time again for Brien to perform a major storage upgrade on his Hyper-V hosts. But this time, he's taking a new approach.

  • RAMBleed Side-Channel Attack Method Disclosed by Researchers

    Academic researchers this week published information about another side-channel attack method, called "RAMBleed," that can expose information from memory chips, including encryption key information.

  • Penguin

    Windows 10 Preview Build 18917 Shows Off New Linux Integration

    Microsoft's latest Windows 10 "fast-ring" preview release is showcasing a coming Delivery Optimization enhancement, along with the ability to try the newly emerged Windows Subsystem for Linux version 2.

  • Customizing Microsoft Office 365

    While the overall look and feel of Office 365 is pretty standard across organizations, there are several ways to personalize it and make it fit better with your company's specific needs.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.