Windows Forum

Ask something
Discussion Locked

JAKE virus?

0 helpful
7 replies

by adisha

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

A colleague of mine tells me that the machines on his NT network are being spuriously renamed to JAKE. Is this virus activity? I have searched most of the major antivirus sites but there doesn't appear to be a virus that fit's the symptoms.

I would be keen to know if anyone else has experienced this problem?

Thanks for your help in advance.

7 replies

by russ werner

I try to stay on top of the virus arena and this is a new one. But they come out everyday. I went to http://www.trend.com/vinfo/virusencyclo/default.asp and did a search, but found nothing.
As you know there can't be two computers with same name ona network, is it naming 2 computers Jake at a time???
I would maybe start suspecting a person that works there playing around???
Good luck!!!

by mtnsqs

If htere is no virus info, then it looks like someone is playing with you.

Fisrt up, change all system admin passwords.

Secondly, look through the event viewer file s- the name change will be recorded there - that way you can establish when (day and time it occurred).

Given that soemone has probably cracked your admin passwords, they will do it again and again. You will need to start improving your security. Review who has sys admin password knowledge, but suspect other users as well. Turn on a lot more auditing.

Change the local NT sysadmin passwrods on workstations. Do users have admin rights - if so then it is possible its being doen from the user login - one person could simply be guessing user passwords and doing itfrom there.

You have a lot of frustrating time ahead of you - I've been through it and its not fun.

I suggest you look through all the security info at M$ sites and many others on the net. Ensure you have latest patches. etc

by adisha

A mchine name changed on a staff machine where the member of staff in question always sits at the machine and does not have the rights nor inclination to change the computer name. This is definately virus activity. Probably written internally using a C++ compiler. It seems to me that a clever batch file has been written that activates on a timer. I am currently investigating files on the clients network for possible suspects.

This discussion is closed to new replies.