RE: worm that crashes win explorer upon search

["Luis Osorio" <luis.osorio () parfois com>]

Hi,

Try to check DEP (Data Execution Prevention). This could happen if explorer is trying to launch the search program.

regards, 


Luis Osório
Parfois - IT Department
Telef:+351220900240
Telem:+351917798455
www.parfois.com
-------------------------------------------------------------------------------
Barata & Ramilo, S.A.
Rua de Sistelo
Lugar de Santegãos
4435-429 Rio Tinto
Portugal

-----Original Message-----
From: Leon [mailto:roastin () yahoo com] 
Sent: segunda-feira, 1 de Agosto de 2005 21:20
To: security-basics () securityfocus com
Subject: worm that crashes win explorer upon search

Hi,

I have a client who suspects that they may have a worm running around there network that is infecting machines through 
open shares or some other means of propogation.  The symptom is that when people open up windows exploer and try to 
search the explorer.exe process dies.

I installed the microsoft spyware application and they are using up-to-date virus definitions with their scanner.  I 
also went through netstat looking for strange open port and saw nothing.  The event log also has nothing out of the 
ordinary in it

What is the best way to troubleshoot something like this?  I can get the dump file from dr watson but I am unsure where 
to go from there. 

Suggestions appreciated.

Thx,

Leon



                
____________________________________________________
Start your day with Yahoo! - make it your home page http://www.yahoo.com/r/hs