It looks like Microsoft needs to go back and look at their code again. There is a new virus in the wild that is exploiting port 135. Security people have yet another reason to be upset at the Redmond giant. As seen on full disclosure: From: "3APA3A" <3APA3A@SECURITY.NNOV.RU> To: <firstname.lastname@example.org>; <email@example.com>; <NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM> Cc: <Secure@microsoft.com> Sent: Friday, October 10, 2003 6:48 PM Subject: Bad news on RPC DCOM vulnerability Dear firstname.lastname@example.org, There are few bad news on RPC DCOM vulnerability: 1. Universal exploit for MS03-039 exists in-the-wild, PINK FLOYD is again actual. 2. It was reported by exploit author (and confirmed), Windows XP SP1 with all security fixes installed still vulnerable to variant of the same bug. Windows 2000/2003 was not tested. For a while only DoS exploit exists, but code execution is probably possible. Technical details are sent to Microsoft, waiting for confirmation. Dear ISPs. Please instruct you customers to use personal fireWALL in Windows XP.