full-disclosure - Virus Problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: shash at nis.etisalat.ae (Shashank Rai)
Subject: Virus Problem

Hi Jay,

To start with are you sure it's "badass" worm? According to description of the worm, it shouldn't be causing any such problems:
http://www.sss.ca/sensible/home.nsf/0/fbe0af15cd2628ff8525689300571c0d?OpenDocument

What I would suggest is to download a copy of Insert Security CD from http://www.inside-security.de/insert_en.html.
This is a live linux CD with Clam AV and support for NTFS. Boot the server off the CD and from the GUI you get an option to update the Clam AV signatures (ofcourse you need to be connected to Internet :). Once done, mount the Windows partition and scan it. Hopefully, you guys are not running on some real high-end hardware config, so the mini distro should have all the required drivers :)

Another alternative is to use a live linux CD from Bit Defender (http://www.bitdefender.com/bd/site/products.php?p_id=40).

HTH

shashank rai 

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com on behalf of Jay R ajaldas Makhija
Sent: Tue 03-Aug-04 10:48
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] Virus Problem

Hi,

We are having Windows 2000 network in the lab , We are stuck due to a
virus. The symptoms of it are :
1) Error message coming after login - "No Paging file found or paging file
too small" paging file limit is set to well above the limits still it
actually allocates 20 MB for it.It doesnot changes even after setting new
'Initial File size' & 'Maximum File Size'.

2) It disables the norton antivius.

We tried stinger for it & that found W32/Nachi.worm in svchost.exe and
deleted the svchost.exe. Still paging error is  same.

On searching google we found one more person havin similiar problem naming
it as 'badass virus' but do not found antivirus for it.

Please suggest that what could be done for it.

With regards
-- 
Jay Makhija
Sysad - WEL,EE Dept
IIT BOMBAY

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040803/f7dad818/attachment.html