Search Members Help

» Welcome Guest
[ Log In :: Register ]

 

[ Track This Topic :: Email This Topic :: Print this topic ]

 reply to topic new topic new poll
Topic: #@!$ing FUNLOVE.4999! ^\%$#@^\%$!^\%!!!< Next Oldest | Next Newest >
 Post Number: 1
damien_s_lucifer Search for posts by this member.
Emperor of Detnet
Avatar



Group: Members
Posts: 33
Joined: Jan. 1970
PostIcon Posted on: Apr. 12 2001,06:08  Skip to the next post in this topic. Ignore posts   QUOTE
This virus just attacked my entire goddamn group... it's spreading over our entire NT domain and keeps attacking MY users, who are freaking out because when they shutdown at the end of the day because they get messages about IPC$ being open. So they come knocking on my cubicle in a panic... why? Because all the other goddamn sysadmins are too lazy / l33t / whatever to UPDATE THEIR VIRUS FILES... I had to stay two hours later than usual today!!! I HATE LEAVING WORK LATE! FUCKING VIRUS WRITER MOTHERFUCKERS!!!! If I ever meet one of 'em they're going to have me on their hands!!!

Ah.... thanks for listening.

Offline
Top of Page Profile Contact Info WEB 
 Post Number: 2
Observer Search for posts by this member.
I once watched, but I have left.
Avatar



Group: Members
Posts: 912
Joined: May 2000
PostIcon Posted on: Apr. 12 2001,13:33 Skip to the previous post in this topic. Skip to the next post in this topic. Ignore posts   QUOTE
I've dealt with that here at Pitt, too. Set aside a day to clean everyone's machines. Turn off all sharing and clean each machine with a command-line scanner.

But that isn't even the worst part. If I understand correctly, it patches a few NT files to make all users admins if the virus happens to run once when an admin is logged in.

That and updating definitions should be an automated service. I feel your pain.

------------------
A good programmer is someone who looks both ways on a one-way street

Offline
Top of Page Profile Contact Info 
 Post Number: 3
damien_s_lucifer Search for posts by this member.
Emperor of Detnet
Avatar



Group: Members
Posts: 33
Joined: Jan. 1970
PostIcon Posted on: Apr. 12 2001,18:43 Skip to the previous post in this topic. Skip to the next post in this topic. Ignore posts   QUOTE
Correction : it's funlove.4099

I have now spent about 8 hours cleaning this damn thing. I **think** I got it... I booted into a command prompt from the 98 CD.

Then :

move \windows \oldwin
del \oldwin\win.com
move \progra~1 \programs.old
attrib -r -s -h \*.*
del \*.*
fdisk /mbr
sys c:

and reinstall Windows, then NAV, and scan the ENTIRE disk. The thing that sucks is that no one here can find a SCANNED backup... and I can't lose the user's data... so I CAN'T REFORMAT!!!! AUGHH!!!

Offline
Top of Page Profile Contact Info WEB 
 Post Number: 4
just_dave Search for posts by this member.
Town Naysayer, and court jester..
Avatar



Group: Members
Posts: 535
Joined: Apr. 2001
PostIcon Posted on: Apr. 13 2001,05:22 Skip to the previous post in this topic.  Ignore posts   QUOTE
when i worked in the IT up at college ... we had one get lose on the inside... some student let it loose... god i could have killed them needless to say 2 p3 labs were shutdown for two days
Offline
Top of Page Profile Contact Info 
3 replies since Apr. 12 2001,06:08 < Next Oldest | Next Newest >

[ Track This Topic :: Email This Topic :: Print this topic ]


  		reply to topic new topic new poll

» Quick Reply #@!$ing FUNLOVE.4999! ^\%$#@^\%$!^\%!!!
iB Code Buttons
You are posting as:

Do you wish to enable your signature for this post?
Do you wish to enable emoticons for this post?
Track this topic
View All Emoticons
View iB Code