Re: Hacked
From: Alvaro Prieto (alvaro_at_apg88.com)
Date: 04/14/05
- Previous message: Eric Shepler: "fport on windows 2003 server"
- In reply to: Mauricio Fernandez: "Hacked"
- Next in thread: Joshua Berry: "RE: Hacked"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 14 Apr 2005 14:27:13 -0400 To: mfernandez@fdta-valles.org
Mauricio,
What if you try loading knoppix, or another live cd and remove the files
without starting windows. You can also do a virus scan through there.
If it is only in that folder, just delete it and run a virus-scan to
make sure everything is clean.
I have used knoppix before, and even if you are not familiar with linux,
it will be very easy to do what you need.
You can get knoppix at http://www.knoppix.org
I hope this helps.
Alvaro
Mauricio Fernandez wrote:
>This morning I found a wwwhack window opened on one of my w2k servers,
>antivirus agent was deleted (TrendMicro) and when I reinstall it back, it
>found about 4500 viruses named PE_PARITE.B
>
>Now the virus is still regenerating itself creating files on winnt\temp
>folder, I saw the task list and stopped all the suspicious process, but
>the virus still goes on...
>
>The virus/hacker created a folder named RADMIN, where he copied these
>files:
>r_server.exe
>admdll.dll
>hide.reg
>raddrv.dll
>pro.bat
>start.bat
>
>Does anyone knows how to remove this virus and avoid this hack
>vulnerability?
>
>
>Mauricio Fernández S.
>IT Manager
>Tel. 591- 445-25160
>Fax. 591- 441-15056
>mfernandez@fdta-valles.org
>www.fdta-valles.org
>Cochabamba - Bolivia
>
>
>
---------------------------------------------------------------------------
Earn your MS in Information Security ONLINE
Organizations worldwide are in need of highly qualified information security
professionals. Norwich University is fulfilling this demand with its MS in
Information Security offered online. Recognized by the NSA as an
academically excellent program, NU offers you the opportunity to earn your
degree without disrupting your home or work life.
http://www.msia.norwich.edu/secfocus_en
----------------------------------------------------------------------------
- Previous message: Eric Shepler: "fport on windows 2003 server"
- In reply to: Mauricio Fernandez: "Hacked"
- Next in thread: Joshua Berry: "RE: Hacked"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
