Check for .NWS files also.

-----Original Message-----
From: Shawn Fertch [mailto:fertch at mninter.net]
Sent: Wednesday, September 19, 2001 2:47 PM
To: tclug-list at mn-linux.org
Subject: [TCLUG] New virus info I think



Just found this today on one of my systems with samba running...

If someone is mapped to a samba share and they are infected with the "code 
blue" or nimba virus I think it's called, it will fill the file system with
a 
pe000##.eml file in every directory.  Currently I'm writing a script to
clean 
out the system of these and greping for the readme.exe when doing a strings 
against the file.

My scripting sucks, but I'll get it done sometime....


-- 
---
Shawn

   "Knowing is not enough, we must apply.  Willing is not enough, we must
do."
	-Bruce Lee
_______________________________________________
tclug-list mailing list
tclug-list at mn-linux.org
https://mailman.mn-linux.org/mailman/listinfo/tclug-list