Re: file defragfatz.exe
- From: "Amos D. Galiardo" <amdix@xxxxxxxxxx>
- To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
- Date: Thu, 13 Jan 2005 09:20:07 +0700
Thank you very much dan...
i found this from AVG free forum that the same as my problem is...
=============================
W32.Linkbot.A
Backdoor.Win32.Rbot.dc
Worm
When W32.Linkbot.A is executed, it performs the following actions:
1. Copies itself as:
%System%\defragfat32z.exe
Note: Variants might have the following file names:
* defragfat32.exe
* defragfat32x.exe
Ports: TCP port 1040 and upwards. Listens on TCP port 113.
I have had problems with this virus for weeks now, on winNT. I can't get rid
of it. I keep deleting the file (defragfat32.exe) and the registry entry
but, the virus keeps coming back from time to time. Maybe it copies itself
in an other file that I can't find.
Do you have any solution for me ?
=====================================
----- Original Message -----
From: "Danny" <nocmonkey@xxxxxxxxx>
To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
Sent: Thursday, January 13, 2005 8:43 AM
Subject: [exchangelist] Re: file defragfatz.exe
> http://www.MSExchange.org/
>
> On Thu, 13 Jan 2005 08:44:57 +0700, Amos D. Galiardo <amdix@xxxxxxxxxx>
wrote:
> > http://www.MSExchange.org/
> >
> > Thank you, i will try to look at mlin.net first...
>
> Run the MBSA (first link provided).
>
> > i use trendmicro too, and i'm scanning....i set delete on norton when
found
> > the virus, i think when norton found that virus that worm run first
...so
> > the server was infected....
>
> The root of the problem is a vulnerability that the virus keeps on
> exploiting, so fix that first - by patching windows - then cleanup the
> rest of your systems.
>
> ...D
>
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
> Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp
> Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Other Internet Software Marketing Sites:
> World of Windows Networking: http://www.windowsnetworking.com
> Leading Network Software Directory: http://www.serverfiles.com
> No.1 ISA Server Resource Site: http://www.isaserver.org
> Windows Security Resource Site: http://www.windowsecurity.com/
> Network Security Library: http://www.secinf.net/
> Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
> ------------------------------------------------------
> You are currently subscribed to this MSEXchange.org Discussion List as:
amdix@xxxxxxxxxx
> To unsubscribe visit
http://www.webelists.com/cgi/lyris.pl?enter=exchangelist
> Report abuse to listadmin@xxxxxxxxxxxxxx
Other related posts:
