The thing is that it is very difficult to remove all infected files. Some viruses even infect legitimate files. And most of the time it is simply not worth the time it takes to manually remove the infection on each machine. It is usually much faster to re-image the machine, especially if you use home folders and roaming profiles.
_________________________ Daniel DeStefano PC Support Specialist IAG Research 345 Park Avenue South, 12th Floor New York, NY 10010 T. 212.871.5262 F. 212.871.5300 www.iagr.net <http://www.iagr.net> Measuring Ad Effectiveness on Television The information contained in this communication is confidential, may be privileged and is intended for the exclusive use of the above named addressee(s). If you are not the intended recipient(s), you are expressly prohibited from copying, distributing, disseminating, or in any other way using any of the information contained within this communication. If you have received this communication in error, please contact the sender by telephone 212.871.5262 or by response via e-mail. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kern, Tom Sent: Monday, November 22, 2004 4:29 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] virus/worm How can it be permanent? I mean if you delete all instances on harddisk and reg keys in safe mode when nothing is running,where the heck is it coming back from? I've always wanted to know. Also,how the heck does it get elevated privilges. I mean,if i'm running as joeuser,how is it getting local system rights? Without revealing specifics(I understand the need to not let everyone on this list become privy to a hacking windows how to). Does it need low level kernel access? can this be done via VB or does it have to be wriiten in a lower level language? thanks. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, November 22, 2004 3:58 PM To: [EMAIL PROTECTED] Subject: Re: [ActiveDir] virus/worm Hi, I've noticed on several occasions that after a certain machine got raped by viruses, even when removed and the machine has all latest datfiles and critical patches, the viruses keep on coming on in and afflicting the same machine again and again and again. As stated, this happens even AFTER the previously infected machine has been cleaned and "protected" with updates and datfiles. I think, in summary, that sometimes the damage caused by virus infections is permanent, regardless of what you read on antivirus vendor's websites. A total software rebuild has been necessary on all occasions as described above. If the systems you mention have not had known virus infection and subsequent "fix" then ignore this email. But in my experience the antivirus vendors DO NOT TELL US EVERYTHING... Cheers and good luck. DDH > Hi all. I am having a serious issue with bot type worms that keep infecting my machines over and over. It doesn't matter that I'm fully patched and my virus defs are up to date. > I use Symantec Corporate Edition 9.0 in a win2k mixed mode AD enviroment. My machines all have the most up to date patches and hot fixes. > I have seen machines that are up to date in everything get reinfected time and time again. The worm is a varient of what Symantec calls Spybot.worm32. It usually creates a exe in system32 called Explorer.exe or 386.exe or svchosting.exe and no matter the defs it slips by Symantec. > > This is a posting perhaps better sent to a virus or Symantec list,but you guys seem really knowldgeable and I'd like to pick your collective brains about how to deal with this issue. > I assume its getting in via laptop users wh take their pc's home at nite or some of our traveling sales guys,but if my desktops are up to date and patched,they should'nt get infected. > No? > Am I being naive? > > > > Finally,we are a liqour distributor and alot of times we have suppliers from other companies come in with laptops that give powerpoint presentations and access our internet connection. These guys are from elsewhere so they don't have accounts in our domain and thus log in locally. > How can i protect myself against these guys? Management insits they be allowed to do their thing with their laptops on our network when they come in and since they don't log into our domain,I can't even push out a GPO and I'm at the mercy of these guys and what hteir IT dept did or did not do. > Help! > > > Thanks alot. If I can get a solution to just one of these 2 questions,I'll be a happy man. > List info : http://www.activedir.org/mail_list.htm > List FAQ : http://www.activedir.org/list_faq.htm > List archive: http://www.mail-archive.com/activedir% 40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
