<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE>Re: [Full-Disclosure] Cleanining viruses from netware</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>A certain mass maier that infected a netware environment? And you have a buddy to fix it?<BR>
<BR>
Please talk about the mass mailer. You think is inplay,<BR>
<BR>
G<BR>
<BR>
-----Original Message-----<BR>
From: Gadi Evron <ge@egotistical.reprehensible.net><BR>
To: Full-Disclosure <full-disclosure@lists.netsys.com><BR>
CC: Dowling, Gabrielle <dowlingg@sullcrom.com><BR>
Sent: Mon May 31 09:53:39 2004<BR>
Subject: Re: [Full-Disclosure] Cleanining viruses from netware<BR>
<BR>
Dowling, Gabrielle wrote:<BR>
> Gadi....<BR>
><BR>
> What exactly are you encountering?<BR>
><BR>
> If you aren't running an av nlm on the server(s) in question, you should be able to map a drive to the system from even a workstation, and run a scan from there.<BR>
><BR>
> I'm not aware of anything that can actually infect a netware system, just things that can drop latent infectious content when write rights are relatively open.<BR>
><BR>
> What exactly are you dealing with?<BR>
<BR>
A certain mass mailer which infected a netware network.<BR>
<BR>
I've dealt with most of it, but I am looking for some script similar to<BR>
what a friend of mine once wrote for active directory, using LDAP and<BR>
running from a domain admin account.<BR>
<BR>
The script scanned the network and remotely removed the infection...<BR>
Which is what I am looking for, if one such as that already exist and<BR>
can be shared.. only for netware.<BR>
<BR>
Thanks for your answer,<BR>
<BR>
Gadi Evron.<BR>
<BR>
<BR>
--<BR>
Email: ge@linuxbox.org. Work: gadie@cbs.gov.il. Backup: ge@warp.mx.dk.<BR>
Phone: +972-50-428610 (Cell).<BR>
<BR>
PGP key for attachments: <A HREF="http://vapid.reprehensible.net/~ge/Gadi_Evron.asc">http://vapid.reprehensible.net/~ge/Gadi_Evron.asc</A><BR>
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104 C0D0 A7B3 1CF7 D921 6A06<BR>
GPG key for encrypted email:<BR>
<A HREF="http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc">http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc</A><BR>
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA 569A A87E 8DB7 06C7 D450<BR>
<BR>
</FONT>
</P>
<FONT SIZE=3><BR>
<BR>
**********************************************************************<BR>
This e-mail is sent by a law firm and contains information<BR>
that may be privileged and confidential. If you are not the <BR>
intended recipient, please delete the e-mail and notify us <BR>
immediately. <BR>
***********************************************************************<BR>
</FONT>
</BODY>
</HTML>