Re: Re: IIS Worm

["Justin" <justin@xxxxxxx>]

Are you having any luck Graham?

I'm in the same position with an NT Server system, no trace of nimda now,
but all drives are shared after every reboot.
I have found a stand alone removal tool here
http://vil.nai.com/vil/virusSummary.asp?virus_k=99209#RemovalInstructions
which is supposed to remove the shares created by the virus.

I will let you know if it works.

Justin.

----- Original Message -----
From: Graham Howe <graham@xxxxxxx>
To: <ukha_d@xxxxxxx>
Sent: Wednesday, September 19, 2001 10:19 PM
Subject: RE: [ukha_d] Re: IIS Worm


> I knew this was the case for Win2K but is it also the case for NT
(remember
> it is an NT4 server). Also if these are just the admin shares then
what
> should the directory permissions be (mine are showing Administrators,
> SYSTEM, CREATOR OWNER as having Full Control and Server Operators and
> Everyone having Change).
>
> Graham
>
> > -----Original Message-----
> > From: Mark Hetherington (egroups)
> > [mailto:mark.egroups@xxxxxxx]
> > Sent: 19 September 2001 22:12
> > To: ukha_d@xxxxxxx
> > Subject: RE: [ukha_d] Re: IIS Worm
> >
> >
> > > Graham I was under the inpression that under WIN2k
"ALL"
> > local hardrives
> > > where shared by default, instead of deleting thses shares
just
> > > disable them,
> > > see if that works, havnt used the server before but, so no
actual
> > > experience.
> >
> > Win2K can do some auto sharing of drives for administration
> > purposes only.
> > In this case it is not possible to turn sharing off since it
> > is prohibited
> > by the OS to try so I assumed that it was not shares such as
> > these that
> > Graham was concerned with.
> >
> > Mark.
> >