Worms and Bots

Lab 6: Worms and Bots

The goal of this lab is to get you more familiar with worms and bots.

1. A worm has been detected on a network under your administrative control. Information about this worm can be found at http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Worm%3AWin32%2FMorto.A . Read the above information and answer the following questions.

a. Based on the summary written about this worm, what is the main effect of this worm? _____________________________________________________________________________

b. From the different malware terms that we learned last week, what kind of malware does that make this (more specific than a worm)? _____________________________________

______________________________________________________________________

c. How does this worm spread? ______________________________________________

______________________________________________________________________

d. What suggestions does Microsoft have for preventing infection?

______________________________________________________________________

e. What suggestions does Microsoft have for preventing re-infection?

______________________________________________________________________

f. What are the symptoms of this worm (in general)?

______________________________________________________________________

______________________________________________________________________

g. How many different user names does this worm try? __________________________

h. How many different passwords does this worm try? ___________________________

i. How many different calculations would the worm have to do to try every username/password combination? _________________________________________

j. Assuming it would take10 microseconds for each try, how long would it take for the worm to try this many combinations on 1000 machines? __________________________________...