Worm Hits Windows 2000 in China

Despite issuing a preemptive patch two weeks ago and another warning late last week, Redmond is now investigating a bug exploiting Windows Server Service for Windows 2000 that reportedly originated in China.

The problem stems from a worm that Symantec Corp. is calling Wecorl. It's also been dubbed "MS08-67.g" by Kaspersky Lab and Microsoft. The MS08-67.g name derives from a patch tag number for the out-of-cycle bulletin issued on October 23.

Symantec security response said that the worm, which was discovered late Monday, can install a Trojan downloader and rootkit code to mask it from security software.

The latest bug affects Windows 2000 and has thus far been seen on Chinese PCs running Windows. Wecorl is similar to the bug that Microsoft was supposed to be patching two weeks ago. At that time, Microsoft described weaknesses in server service mechanisms in the Windows 2000, Windows XP and Windows Server 2003 operating systems. The weaknesses could allow for remote code execution exploits through the use of a "specially crafted" remote procedure call request.

The vulnerability can enable automatic remote interactions or subroutines between CPUs in a shared processing environment. If the worm manages to bore through into one Windows-based PC, it can also make attempts to weave its way through other workstations connected on the same subnet.

The nature of the bug, means it can get around the firewall-level blocks that Microsoft touted in its patch release, according to Andrew Storms, director of security at nCircle.

On the positive side, Microsoft knew the bug was coming, they were prepared for it and the word was out, Storms added.

"As security professionals, we have signatures for this sort of thing when it's already in play" he said. "Had it gone undetected, there wouldn't have been any baseline from which enterprises can begin to assess the threat."

That said, he cautioned that those who have not already patched the affected systems should still do so "ASAP."

Symantec assessed the worm as a "very low" risk because it originated from overseas and only affected Windows 2000. But the company also encourages installation of the previous patch and is continuing to take its cue from Microsoft's inclination that the bug constituted an emergency. For that reason, Symantec is still classifying the bug with a level 2 rating via its ThreatCon global threat rating system.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Microsoft and SAP Enhance Partnership with Teams Integration

    Microsoft and SAP this week described continuing partnership efforts on Microsoft Azure, while also planning a Microsoft Teams integration with SAP's enterprise resource planning product and other solutions.

  • Blue Squares Graphic

    Microsoft Previews Azure IoT Edge for Linux on Windows

    Microsoft announced a preview of Azure IoT Edge for Linux on Windows, which lets organizations tap Linux virtual machine processes that also work with Windows- and Azure-based processes and services.

  • How To Automate Tasks in Azure SQL Database

    Knowing how to automate tasks in the cloud will make you a more productive DBA. Here are the key concepts to understand about cloud scripting and a rundown of the best tools for automating code in Azure.

  • Microsoft Open License To End Next Year for Government and Education Groups

    Microsoft's "Open License program" will end on Jan. 1, 2022, and not just for commercial customers, but also for government, education and nonprofit organizations.

comments powered by Disqus