Ditto!
Michael Semiglia
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 19, 2001 1:37 PM
To: Exchange Discussions
Subject: RE: nimda virus changes on me
Maybe it's just me, but, if your servers were infected I would rebuild them
as a matter of principle. You are only cleaning up the symptoms and closing
the hole after someone has already been in and "touched" you. The only way
that I know of to be assured of having truly cleaned the system is to start
fresh with all appropriate patches and then reinstall programs and data.
Anyone have any comments?
Ken Powell
Systems Administrator
Clark County Office of Budget and Information Services (OBIS) Vancouver,
Washington [EMAIL PROTECTED]
Voice: (360) 397-6121 x4658
Fax: (360) 759-6001
-----Original Message-----
From: Ron Jameson [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 19, 2001 9:57 AM
To: Powell, Ken
Subject: nimda virus changes on me
Well, I just put in a 24 hour shift to patch the ol' web, email, main and
terminal servers in one form or another and clean up 30 workstations. Was a
little too late in the blocking of all .exe files on the sybari but I think
this one entered thru the front web door on a client PC hitting an infected
web site.
Odd - two of the PC's out of the 30 were REALLY infected so as I could not
repair. I need to format these boxes. Has anyone seen this virus change or
morph into other executables other that the noted ones (riched20.dll,
readme.exe, load.exe, modified system.ini, plus several other windows
programs)?
Regards,
Ron Jameson
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
