RE: Virus Problem

["Shashank Rai" <shash () nis etisalat ae>]

Hi Jay,

To start with are you sure it's "badass" worm? According to description of the worm, it shouldn't be causing any such 
problems:
http://www.sss.ca/sensible/home.nsf/0/fbe0af15cd2628ff8525689300571c0d?OpenDocument

What I would suggest is to download a copy of Insert Security CD from http://www.inside-security.de/insert_en.html.
This is a live linux CD with Clam AV and support for NTFS. Boot the server off the CD and from the GUI you get an 
option to update the Clam AV signatures (ofcourse you need to be connected to Internet :). Once done, mount the Windows 
partition and scan it. Hopefully, you guys are not running on some real high-end hardware config, so the mini distro 
should have all the required drivers :)

Another alternative is to use a live linux CD from Bit Defender 
(http://www.bitdefender.com/bd/site/products.php?p_id=40).

HTH

shashank rai 


-----Original Message-----
From: full-disclosure-admin () lists netsys com on behalf of Jay R ajaldas Makhija
Sent: Tue 03-Aug-04 10:48
To: full-disclosure () lists netsys com
Subject: [Full-disclosure] Virus Problem
 


Hi,

We are having Windows 2000 network in the lab , We are stuck due to a
virus. The symptoms of it are :
1) Error message coming after login - "No Paging file found or paging file
too small" paging file limit is set to well above the limits still it
actually allocates 20 MB for it.It doesnot changes even after setting new
'Initial File size' & 'Maximum File Size'.

2) It disables the norton antivius.

We tried stinger for it & that found W32/Nachi.worm in svchost.exe and
deleted the svchost.exe. Still paging error is  same.

On searching google we found one more person havin similiar problem naming
it as 'badass virus' but do not found antivirus for it.

Please suggest that what could be done for it.

With regards
-- 
Jay Makhija
Sysad - WEL,EE Dept
IIT BOMBAY



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html