Search for network.vbs on the system. We've had a lot of problems with this
little bugger on customer systems. All in does is attempt to replicate via
open shares. It picks a random 24.0.0.0/24 subnet and scans all the hosts
on that subnet. The version we've found doesn't do anything but spread (no
payload). There are numerous variations so you might just want to search
for all .vbs files. Some virus scanners don't seem to pick up some of the
variants.
HTH,
Mike
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of John Huggins
> Sent: Monday, September 18, 2000 1:38 PM
> To: [EMAIL PROTECTED]
> Subject: Windows 98 trying to learn about Windows Networks outside of
> our little world.
>
>
>
> One of our Windows 98 machines ground to a slow pace today. Then
> we get an
> email from our Internet provider essentially copying a message
> they received
> from some outside person complaining that this little 98 machine was
> exploring a whole range of IP addresses on the usual Windows
> network ports.
>
> Any body heard of this kinf of virus? If not, can you provide some other
> resource links to others in the know?
>
> I know, I know. We should have been packet filtering our local
> network from
> the Internet, BUT those on high demanded full access to the Internet; For
> all I know they belong to the Flat Earth Society. Thus, I let them have
> their way, while us few non-flat-earthers protect our individual machines
> with things like Zone Alarm.
>
> J
>
> -
> [To unsubscribe, send mail to [EMAIL PROTECTED] with
> "unsubscribe firewalls" in the body of the message.]
>
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
