Re: Hacked

From: Alen Capalik (
Date: 04/14/05

  • Next message: Matan Peled: "Re: Hacked"
    Date: Thu, 14 Apr 2005 12:41:13 -0700


        It's a worm called WORM_DELODER.A. You can find all the information
    on it at the Trend Micro site. In the future you can just Google the
    files, and it will give you more info on it. You can also look at the
    bat scripts and reg file and see what it's doing. Hope this helps.

    Mauricio Fernandez wrote:

    >This morning I found a wwwhack window opened on one of my w2k servers,
    >antivirus agent was deleted (TrendMicro) and when I reinstall it back, it
    >found about 4500 viruses named PE_PARITE.B
    >Now the virus is still regenerating itself creating files on winnt\temp
    >folder, I saw the task list and stopped all the suspicious process, but
    >the virus still goes on...
    >The virus/hacker created a folder named RADMIN, where he copied these
    >Does anyone knows how to remove this virus and avoid this hack
    >Mauricio Fernández S.
    >IT Manager
    >Tel. 591- 445-25160
    >Fax. 591- 441-15056
    >Cochabamba - Bolivia

    Earn your MS in Information Security ONLINE
    Organizations worldwide are in need of highly qualified information security
    professionals. Norwich University is fulfilling this demand with its MS in
    Information Security offered online. Recognized by the NSA as an
    academically excellent program, NU offers you the opportunity to earn your
    degree without disrupting your home or work life.

  • Next message: Matan Peled: "Re: Hacked"