[Samba] Random Directories

[Tom McKellips]

I had a similar situation a year or so ago. It turned out to be the Sircam 
virus. But the virus software would not find it I had to use a removal tool 
from Symantec to get it out. Also we found this virus would write itself over 
and over in the autoexec.bat file 100's of times on some. So as soon as you 
remove it and reboot it called itself back. It spreads through drive shares 
on Winblows. Also we learned to fully get rid of it disconnect the 
workstation from the network then boot to safe mode then run the tool then 
check autoexec.bat and then reboot normal and run the tool one more time. 
Before hooking back to the network all other workstation have to be checked. 
This thing also sets up a hidden drive share for itself. It gets to be a real 
bugar to get rid of if it got very far. It sounds like you may be dealing 
with a related virus. Panda www.pandasoftware.com has an ecellent virus 
encyclopedia. You may want to do a little research over there.

Tom


On Wed, 4 Jun 2003 8:47:35 -0400, Joe Wojnas wrote
> I believe this a virus on one of the work stations, but I want to 
> just make sure because no of the virus scans are picking it up.  I 
> just built the largest Linux server I ever attempted (725 Gigs in 
> RAID5).  I convinced my client to move from Micro$oft.  Everything 
> was working perfectly during tests.  In operation they are getting 
> random directories made (1000s of them) in the shared folders.  They 
> are generally things like 00000cccdcdc.  It started in one person's 
> home directory and that's why I am leaning towards a virus.  The 
> only problem is that I can't find a virus on the work stations.  The 
> configurations is as follows:
> 
> Redhat 9 with Samba 2.2.8
> RAID5 (hardware using Adaptec's 2400A card and 4 WD 250Gig drives)
> Workstations -> Windows XP Pro (just upgraded from ME)
> 
> Thanks for your help.  I don't want to blow this one.  This office 
> is a small portion of a much bigger company.  If I get this one to 
> work out, I am hoping they will consider it elsewhere.
> 
> Thanks for your help!!!!!
> 
> Joe
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  http://lists.samba.org/mailman/listinfo/samba


--
Internet Service Provided By Abyss Communications
Internet Service only $10 a month
1-866-842-2977