<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR></HEAD>
<BODY style="MARGIN-TOP: 2px; FONT: 10pt Book Antiqua; MARGIN-LEFT: 2px">
<DIV>If you really suspect a Windows virus, download <A
href="http://www.sysinternals.com">www.sysinternals.com</A> tdimon and
filemon. Run them on the windows PC in question an see what file is
running and the port it's using. The file will usually be under C:\windows
on W9x or c:\windows\system32 or c:\winnt\system32 on a W2k/Xp PC. In the
hkey_local_machine\software\Microsoft\Windows\CurrentVersion\Run<BR>You will
usually find the file, just delete the registry setting and the file on the
C:\. Also you may want to d/l a good virus scanner to run the across the
disk to see if there are other files infected.</DIV>
<DIV> </DIV>
<DIV>Jon</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Jon L. Miller, MCNE, CNS, ASE<BR>Director/Sr Systems Consultant<BR>MMT
Networks Pty Ltd<BR><A
href="http://www.mmtnetworks.com.au">http://www.mmtnetworks.com.au</A></DIV>
<DIV> </DIV>
<DIV>"I don't know the key to success, but the key to failure<BR> is trying
to please everybody." -Bill Cosby</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV><BR>>>> cameron@patrick.wattle.id.au 12:27:56 pm 13/07/2004
>>><BR>Hi,<BR><BR>I recently noticed high CPU usage and network traffic
to my desktop at<BR>home without any good reason. Tcpdump showed lots of
Samba traffic to<BR>my brother's machine, and said brother couldn't think of a
good reason<BR>why. I suspect a Windows virus or trojan or some such, but
am at a<BR>loss with regards to what to do about it. I've shut down Samba
on my<BR>machine and the server (because they allow passwordless write
access<BR>to a lot of stuff that they really really shouldn't -- I will fix
this<BR>before turning Samba back on) and have removed network access from
my<BR>brother's machine for now.<BR><BR><Linux content><BR>So what I
really want to know is, how can I find out what files it was<BR>poking around in
and for how long it's been going on (presumably by<BR>looking at Samba logs, but
I can't find anything equivalent to ftpd's<BR>xferlog or apache's
access.log)?<BR></Linux content><BR><BR><maybe Linux content><BR>How
can I find out what the infected machine was running? Should I<BR>use a
Linux-based virus scanner to inspect it off a Linux boot disc?<BR>Alternatively,
what are good Windows virus scanners? Is there a<BR>better of cleaning up
any infections than backing up anything<BR>important, wiping the whole disc (and
installing Linux on there :-P)?<BR></maybe Linux
content><BR><BR><non-Linux content><BR>What do Windows viruses/trojans
do to machines over SMB? Is this<BR>machine also likely to have been sending out
spam too?<BR></non-Linux content><BR><BR>Utterly unrelated question while
I'm here: is there a flag to rm to<BR>tell it to remove files from directories
chmod'ed read-only?<BR>Something like 'rm -rf
--try-harder'...<BR><BR>Cheers,<BR><BR>Cameron.<BR><BR>_______________________________________________<BR>PLUG
discussion list: plug@plug.linux.org.au<BR><A
href="http://mail.plug.linux.org.au/cgi-bin/mailman/listinfo/plug">http://mail.plug.linux.org.au/cgi-bin/mailman/listinfo/plug</A><BR>Committee
e-mail: committee@plug.linux.org.au<BR><BR></DIV></BODY></HTML>