Worm strikes down Windows 2000 systems

[trickster]

Worm strikes down Windows 2000 systems

This damn thing made a mess at my workplace today >

[mojo jojo]

wow thats sucks, how do you get rid of a worm that is causing havoc on the network? I didn't RTFA but what do you do when AV doesn't work?

didn't m$ stop support of W2K? this isn't good im glad that my ISP uses Linux for 80% of there servers.

[trickster]

On windows, you cannot delete a file that is in use. The virus loads in memory at startup and the AV cannot remove it because the file is in use.

You have to use some tools to stop it from starting with the pc, or boot in safe mode and remove the files that way.

[mojo jojo]

what kind of tool do you have to use? let's say that an entire building got infected how would you go about clearing it?

i've been going to school for network administration but we didn't learn how to clear a network of computers.

[trickster]

We have about 400 pc's.

We are using Landesk and login scipts to push the patches to fix the vulnerability. If we were on an AD domain, it would be easier cause you can use policies, but we have not migrated yet.

After the vulnerability is patched, you still need to get rid of the virus. Basically, we are remoting to the infected machines and using "msconfig" or directly editing the registry to prevent the virus from starting the pc. After that, you reboot and then try to access the file. The AV will remove it before you can access it.

[mojo jojo]

interesting couldn't you use a live cd and mount windows and remove it or use something like clamav thats on a live cd?...then again I guess that would do no good on a network haha

[trickster]

That is another alternative. However, is just faster, once you know what you are looking for, to do it the way we are doing it. We can do it remotely w/o leaving the office or waiting for the computer to boot from a cd.

[mojo jojo]

cool. don't you wish times like these you were running something other then m$ .

I was just wonding wouldn't novell be a good choice instead of AD?

[GhostDawg]

We have a alot of win2000 machines at work, in fact my workstation is one but haven't heard of anything major happening here.

We used to get hit hard with viruses, etc but they clamped down more on keeping those out. I guess they have better protection in place.

[trickster]

[quote author=The Great Mojo Jojo link=board=25;threadid=10632;start=0#msg95513 date=1124241357]
cool. don't you wish times like these you were running something other then m$ .

I was just wonding wouldn't novell be a good choice instead of AD?
[/quote]
We used to run Novell here at work. It was pretty good, but we had a lot of problems with it (mainly lack of training, so when something broke, it was a big deal.)

Microsoft recently put out a free software called WSUS, that patches computers on your network. Though not fantastic, it is quite good.