🚀 go-pugleaf

In news:ce0fgb$8lk$1@lust.ihug.co.nz, Dieu Phan bitched and moaned:
> hi,
> my sys. got attacked by a virus name W32.HllW.Gaobot.gen (the file
> explored.exe)
> Norton2004 detected it but can not remove. I guess it is located on my
> home server \\slackbox\shares\exlpored.exe (samba folder), physically
> it is on /home/pub/explored.exe of slackware Box
> my question is:
> -should i move explored.exe to windowsXP then using Norton to delete?
> or using a linux anti-virus software to delete it?
> any idea? and which anti-virus program is good for linux?
> your help would be much appreciated,
> regards
> dieu

If it is only finding it on the Linux share, and not on the Windows system
then chances are you are not infected.

First thing you need to do, is get onto the Symantec website and read about
this virus to see if there are any alterations made to the system registry,
this will help to determine if you really are infected, or whether the file
was copied.

Secondly, delete the file, either from the share, or from the Linux system
directly.  If you cannot delete it from the share, chances are that you do
not have r/w permissions, hence (perhaps) Nortons inability to remove the
virus.

There are some Linux AV apps about, but for the most part, Linux virri are
not a major concern as at this stage they still require execution by root,
or access through a kernel module which again requires root or suid, but it
could not hurt to ayr of the side of caution.