got hit by worm in W2K Help!

[pirateclem]

got hit by a worm doing the following:

propogates over port 139. Does a buffer overflow attack on symantec AV. Leaves a file on the root of the C drive called: U.exe. Is only affecting Windows 2000 OS's that are a bit behind in patch levels. Systems I patched just this weekend are unafected. Some XP systems are having errors in symantec AV on their desktops.

Any ideas what it is? Most recent heuristic on symantec AV 10.1 can not find the purpotrator on infected systems.

Help!

 

[Arsyn]

Try starving the offending executable by booting in safemode and deleting it or running a virus removal tool to delete it.

 

[itschad]

I am curious if there was a solution to this. I am having a very similiar problem with a few variatons.

 

[pagy]

Get the systems up to date with patches and security hotfixes and remove Symantec and get a decent AV package installed.

Paul

MCSE 2003

"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
Albert Einstein

 

[itschad]

Everything is up to date and current. I do not have the option to buy a different Antivirus and really dont see a need to. I have ran over 14 different anti viruses on one of these computers and they do not clean or find the problem.
I will open up a new post I just thought maybe someone who had this exact problem could help.

Thanks for the opinion though!

 

[WhoKilledKenny]

Suggestion:
1. Google the name of the executable to search for removal intsructions.
2. In task manager, look for processes that are running that you may be unfamilair with - google their names to see what comes up.
3. download (free) HijackThis, run a system report. It reports processes running, location of the .exe's, and registry locations. It can clean the system of any of these. If the worm is memeory resident it can remove files during a re-boot.

http://www.download.com/HijackThis/3000-8022_4-10379544.html

4. Post your HijackThis log into this forum or any others to find those who have delt with the same issue.

 

[itschad]

Hi, I have fixed it. Thanks for the advice I tried the stuff you suggested already. It would work for the time being but soon the computer would be reinfected as it was on a very large network and spreading like crazy. It ended up being about four different viruses that they released a new update for today.

Thanks for the help all.