Read the documentation from CERT, Eeye and other virus/ security
authorities. If the virus was executed on your server, it will open ports
and cause damage that can not be 100% removed.
However, your statement "If you had a properly installed Hosted system, you
could determine what had been changed from a security standpoint." Sort of
negates your other comment. If a system was properly hosted, it probably
would have not been infected.
Bottom line, there are too many people that have reported trying to remove
using the tools that continue to be infected. It's just too much of a risk
to continue using a box that has unknown damage in a production environment.
My $.02.
Steve Clark
Clark Systems Support, LLC
AVIEN Charter Member
"Who's watching your network?"
www.clarksupport.com
301-610-9584 voice
240-465-0323 Efax
-----Original Message-----
From: Andrew S. Baker [mailto:[EMAIL PROTECTED]]
Sent: Sunday, September 23, 2001 10:17 AM
To: NT System Admin Issues
Subject: RE: Nimda and patch end up shutting my Web Server
>>Reformat. There is no way to 100% remove the
>>virus from your system.
I don't agree with that statement as an absolute, particularly if you
avoided rebooting the machine while the virus was running.
If you had a properly installed Hosted system, you could determine
what had been changed from a security standpoint.
Ultimately, rebuilding will be the safest way to resolve this issue
for those systems which are constantly infected.
==============================================================
ASB - http://www.ultratech-llc.com/KB/?File=~MoreInfo.TXT
==============================================================
"Feed a stranger's expired parking meter." -- H. Jackson Brown Jr.
>-----Original Message-----
>From: Clark, Steve [mailto:[EMAIL PROTECTED]]
>Sent: Sunday, September 23, 2001 9:55 AM
>To: NT System Admin Issues
>Subject: RE: Nimda and patch end up shutting my Web Server
>
>
>Reformat. There is no way to 100% remove the virus from your system.
>
>You can download and run utilities from Eeye, Norton, NAI,
>Commandcenter
>...... But the bottom line, it's not going to be 100% cleaned.
>
>Steve Clark
>Clark Systems Support, LLC
>AVIEN Charter Member
>www.clarksupport.com
> 301-610-9584 voice
> 240-465-0323 Efax
>
>-----Original Message-----
>From: Vani Murarka [mailto:[EMAIL PROTECTED]]
>Sent: Sunday, September 23, 2001 9:49 AM
>To: NT System Admin Issues
>Subject: Nimda and patch end up shutting my Web Server
>
>NT and IIS Gurus, please help.
>
>My system was infected by Nimda. Norton found certain TFTPxxx files
>under Inetpub/scripts which were infected. It could not clean it. It
>quarantined it. I deleted those files. But new TFTPxxx files kept
>getting created in that directory, and Norton kept saying those are
>infected with Nimda.
>
>I searched the internet to see what patch I must install. Following
>links from Symantec, this is the one I downloaded and installed -
>http://www.microsoft.com/ntserver/nts/downloads/critical/q269
862/default
.asp
The patch was called "Windows 4.0 Hotfix"
Ever since installing that, my Web Server does not run. Trying to run
it from Internet Service Manager, says, "The specified module could
not
be found".
I am also not being unable to uninstall the patch from Control Panel -
Add/Remove Programs as the page from where I downloaded it suggests,
because it is not listed there.
Maybe I selected the inappropriate patch - but now I am at a loss as
to
what to do next.
Please give pointers.
Thanks
Vani
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm