[pchelpers] Re: News:Kucoo Worm Spreads Via Shared Drives

Hi John,

Tuesday, March 18, 2008, 4:55:07 PM, you wrote:

JD> Jackie MacWhirter wrote:

JD> I see what you mean by a mess. In your suggested network if one
JD> machine was cleaned it would probably be re-infected before the
JD> last one could be cleaned. It would end up with an endless loop of
JD> clean and re-infect.

JD> Cleaning it would also require each machine to be disconnected
JD> from the network for scanning. Afterwards it would have to be kept
JD> off the network until every single machine was cleaned. Then they
JD> might be connected once more, put back on the internet only to get
JD> the infection back due to some user's careless browsing habits.

Actually, could probably block it fairly easily.  Most apps can't
handle a case where a folder exists already with the intended name of
a file, such as smss.exe and Sexy Girls.scr.  Clean the system, create
folders with those names, and then go to the next system.  Most apps
also can't handle cases where permissions don't allow a file to be
changed or deleted.

In any event, the article says that at least two vendors know about it
already, so active protection would clean systems and keep them from
being re-infected.

-- 
Scott.



-- 
-------list-services-below-----------
Regards, John Durham (list moderator) <http://modecideas.com/contact.html?sig>
Freelists login at http://www.freelists.org/cgi-bin/lsg2.cgi
List archives at http://www.freelists.org/archives/pchelpers
PC-HELPERS list subscribe/unsub at http://modecideas.com/discuss.htm?sig
Latest news live feeds at http://modecideas.com/indexhomenews.htm?sig
Good advice is like good paint- it only works if applied.

Other related posts: