Finding Natchi/Blaster

[bazcurtis]

Hi,

We seem to have one machine on our network with natchi. We can't find it. Does anyone know if you can find it via the network traffic it produces and if so what tools would be good for this?

Any help most welcome.

Best wishes

Michael

 

[msdos21]

The best way to resolve the problem would be to shut down all servers (if possible) and workstations, disconect the network cables then run the fixes available from the net ie

http://www.sophos.com/support/disinfection/nachia.html

(will need to download this type of NACHISFX.EXE tool before you disconect from the network and save burn to a cdrom)
Have you patched all the 2000/XP/nt machines with the Microsoft patches

http://www.microsoft.com/technet/security/bulletin/MS03-026.asp

http://www.microsoft.com/technet/security/bulletin/MS03-007.asp

Although this is a long and widen process, at least you can totally disinfect the virus from the system. (just completed the task myself!)

 

[beavisandbutthead]

we used angryip (try a google search to locate and download this) run angryip or a network sniffer that shows port activity and pay attention to ports 4444, 707, and 69 if a machine is running traffic from these ports check the machine for the nachi