Virus Problem on W2K 1

[arbytech]

Hi everybody,

I have five PCs in a remote office that are having some issues. When they are connected to our LAN they flood port 445. That points to the Deloder virus but we did not detect it. Currently the PCs all run McAfee VSE 7 with DAT 4339 and Deloder is over a year old. I had the on-site tech check for the various Deloder and payload files, none were present.

The other symptoms were that you can't open regedit, task manager or a command line. They all open and then close right away. When you attempt to run a scan with McAfee it starts OK then finishes within a second or two. It can be run from Safe Mode but nothing is detected.

We did run the Stinger tool from McAfee (a stand alone virus detection, it looks for the more prevalent viruses like Mydoom, sircam, netsky, etc.) but that too came up empty.

Ran Adaware but nothing was detected that changed the symptoms.

The machines all run W2K SP3 and current Critical Updates, P4 @ 2.6 and 512 MB RAM.

Any suggestions would be greatly appreciated.

--itswork

 

[diogenes10]

http://216.239.41.104/search?q=cache:vWd1BJPMJEIJ:uk.trendmicro-

europe.com/enterprise/security_info/ve_detail.php%3FVName%3DWORM_AGOBOT.MY%
26VSect%3DT+flood+port+445&hl=en&ie=UTF-8

Well there's a "bot" deal that looks like it can do some of what you're talking about as well as stop protective processes.

Might try an online scan with something like trendmicro or panda to cross check mcafee. Also could run hijack this or bazooka to get a list of running processes and see if there is something there that looks strange to you.

If there is something that is terminating windows based av scanners, you could go to the extreme of trying fprot's dos based scanner.

 

[arbytech]

diogenes10,

Thanks for your input. I ran McAfee's command line scanner (similar to fprot's) but it came up with nothing. So I went up to the remote office and checked the PCs, they had the msclock.exe on them. Once that was stopped and removed everything was OK. Still can't find a whole lot on msclock but it does cause problems.

Thanks again.

 

[carrr]

Read this:

http://sophos.com/virusinfo/analyses/w32nackbotc.html

"'Tis an ill wind that blows no minds." - Malaclypse the Younger