<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.6944.0">
<TITLE>RE: [Full-Disclosure] Virus Problem</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Hi Jay,<BR>
<BR>
To start with are you sure it's "badass" worm? According to description of the worm, it shouldn't be causing any such problems:<BR>
<A HREF="http://www.sss.ca/sensible/home.nsf/0/fbe0af15cd2628ff8525689300571c0d?OpenDocument">http://www.sss.ca/sensible/home.nsf/0/fbe0af15cd2628ff8525689300571c0d?OpenDocument</A><BR>
<BR>
What I would suggest is to download a copy of Insert Security CD from <A HREF="http://www.inside-security.de/insert_en.html">http://www.inside-security.de/insert_en.html</A>.<BR>
This is a live linux CD with Clam AV and support for NTFS. Boot the server off the CD and from the GUI you get an option to update the Clam AV signatures (ofcourse you need to be connected to Internet :). Once done, mount the Windows partition and scan it. Hopefully, you guys are not running on some real high-end hardware config, so the mini distro should have all the required drivers :)<BR>
<BR>
Another alternative is to use a live linux CD from Bit Defender (<A HREF="http://www.bitdefender.com/bd/site/products.php?p_id=40">http://www.bitdefender.com/bd/site/products.php?p_id=40</A>).<BR>
<BR>
HTH<BR>
<BR>
shashank rai<BR>
<BR>
<BR>
-----Original Message-----<BR>
From: full-disclosure-admin@lists.netsys.com on behalf of Jay R ajaldas Makhija<BR>
Sent: Tue 03-Aug-04 10:48<BR>
To: full-disclosure@lists.netsys.com<BR>
Subject: [Full-Disclosure] Virus Problem<BR>
<BR>
<BR>
<BR>
Hi,<BR>
<BR>
We are having Windows 2000 network in the lab , We are stuck due to a<BR>
virus. The symptoms of it are :<BR>
1) Error message coming after login - "No Paging file found or paging file<BR>
too small" paging file limit is set to well above the limits still it<BR>
actually allocates 20 MB for it.It doesnot changes even after setting new<BR>
'Initial File size' & 'Maximum File Size'.<BR>
<BR>
2) It disables the norton antivius.<BR>
<BR>
We tried stinger for it & that found W32/Nachi.worm in svchost.exe and<BR>
deleted the svchost.exe. Still paging error is same.<BR>
<BR>
On searching google we found one more person havin similiar problem naming<BR>
it as 'badass virus' but do not found antivirus for it.<BR>
<BR>
Please suggest that what could be done for it.<BR>
<BR>
With regards<BR>
--<BR>
Jay Makhija<BR>
Sysad - WEL,EE Dept<BR>
IIT BOMBAY<BR>
<BR>
<BR>
<BR>
_______________________________________________<BR>
Full-Disclosure - We believe in it.<BR>
Charter: <A HREF="http://lists.netsys.com/full-disclosure-charter.html">http://lists.netsys.com/full-disclosure-charter.html</A><BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>