Has anyone dealt with w32.randex.ge

[karmic]

Has anyone dealt with w32.randex.gen yet? it's a new flavor of the randex virus and can't seem to find the information I need. I have a server that's infected, norton know's it's there but can't cope with it yet.

I've checked all the usual areas for virii to load but can't seem to find the dropper for it.

Thanks

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[smah]

http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.gen.html

randex.gen is a general family detection. Many of the randex variants propogate through the network to the default administrative shares - C$. Make sure these default shares either have a strong password or remove the shares entirely. For example, see the info for this particular variant

http://vil.nai.com/vil/content/v_100443.htm

 

[karmic]

been there already... just wondering if there's anyone out there that has dealt with this virus first hand. Most of these virii are the same but I can't find the dropper or the loader.

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[Xemus]

Have you looked at this writeup? Dec 4th from Sarc. Not Randex.gen, but Randex.AZ.

http://www.sarc.com/avcenter/venc/data/w32.randex.az.html

http://www.closedsocket.com

 

[karmic]

yep... it's not loading in all the usual spots.

~ K.I.S.S - Don't make it any more complex than it has to be ~