Security

Ask something
Discussion Locked

Possilbe Virus?

0 helpful
6 replies

by tksolway 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have several problems on my network that I believe stem from a virus. First and formost, Shared or network printers constantly print out random charaters. This I know is a virus trying to copy itself the the printer share (thinking it is a normal share). The other problem is computers sutting down with a RPC call after the lsass.exe crashes.

The machines have all been properly patched (long ago, to prevent these specific vulnerabilities, specifically the LSASS vulnerability). I have scanned the computers with the NAV Corporate edition, which was running and updated before this happened, as well as online scanners, trendmicro and Panda. I have even removed a HD and scanned it as a Secondary HD on another computer. The computers that shutdown with the LSASS problem do not show any viruses whatsoever. I have checked the registry manually for stray services, there are no unwanted processes runing on the computers either.

The viruses that have been stopped on the network recently are Gaobat and SDBOT.

Does anyone have any ideas?

6 replies

by simy

Get stinger.exe from the mcafee website - this will detect and clean a host of viruses.

Also look on the symantec site for some virus removal tools, in particular the removal tool for sasser as this is probably causing the lsass problem.

Good Luck

by lmon

Along with the first answer if any of the computers are xp make sure you turn off system restore before doing anything. Then run stinger and your updated virus scanner. Also run spyware programs to make sure you dont have any other miscellaneous stuff. then restart the computer and turn on system restore.

by lmon

Make sure you download the following patches if you have not done so yet MS03-049(2000), MS04-011, MS04-043(XP), MS03-026.

by tksolway

Have downloaded the pathes. When I was finally able to get NAV corporate v9 on the machines I was able to catch it

This discussion is closed to new replies.