[Samba] Random Directories
tom at cpty.net
Wed Jun 4 13:04:57 GMT 2003
I had a similar situation a year or so ago. It turned out to be the Sircam
virus. But the virus software would not find it I had to use a removal tool
from Symantec to get it out. Also we found this virus would write itself over
and over in the autoexec.bat file 100's of times on some. So as soon as you
remove it and reboot it called itself back. It spreads through drive shares
on Winblows. Also we learned to fully get rid of it disconnect the
workstation from the network then boot to safe mode then run the tool then
check autoexec.bat and then reboot normal and run the tool one more time.
Before hooking back to the network all other workstation have to be checked.
This thing also sets up a hidden drive share for itself. It gets to be a real
bugar to get rid of if it got very far. It sounds like you may be dealing
with a related virus. Panda www.pandasoftware.com has an ecellent virus
encyclopedia. You may want to do a little research over there.
On Wed, 4 Jun 2003 8:47:35 -0400, Joe Wojnas wrote
> I believe this a virus on one of the work stations, but I want to
> just make sure because no of the virus scans are picking it up. I
> just built the largest Linux server I ever attempted (725 Gigs in
> RAID5). I convinced my client to move from Micro$oft. Everything
> was working perfectly during tests. In operation they are getting
> random directories made (1000s of them) in the shared folders. They
> are generally things like 00000cccdcdc. It started in one person's
> home directory and that's why I am leaning towards a virus. The
> only problem is that I can't find a virus on the work stations. The
> configurations is as follows:
> Redhat 9 with Samba 2.2.8
> RAID5 (hardware using Adaptec's 2400A card and 4 WD 250Gig drives)
> Workstations -> Windows XP Pro (just upgraded from ME)
> Thanks for your help. I don't want to blow this one. This office
> is a small portion of a much bigger company. If I get this one to
> work out, I am hoping they will consider it elsewhere.
> Thanks for your help!!!!!
> To unsubscribe from this list go to the following URL and read the
> instructions: http://lists.samba.org/mailman/listinfo/samba
Internet Service Provided By Abyss Communications
Internet Service only $10 a month
More information about the samba