🚀 go-pugleaf

Dieu Phan wrote:

> hi,
> my sys. got attacked by a virus name W32.HllW.Gaobot.gen (the file
> explored.exe)
> Norton2004 detected it but can not remove. I guess it is located on my
> home server \\slackbox\shares\exlpored.exe (samba folder), physically it
> is on /home/pub/explored.exe of slackware Box
> my question is:
> -should i move explored.exe to windowsXP then using Norton to delete? or
> using a linux anti-virus software to delete it?
> any idea? and which anti-virus program is good for linux?
> your help would be much appreciated,
> regards
> dieu

Why not just delete it?

I've never seen an anti-virus program for Linux, and I always
assumed that it was because of Linux's natural resistance.

Save everything you can from the Doze box and install Slackware.

I'm using KDE right now on 10.0, and with the exception of AutoCAD
Mechanical Desktop, it's doing everything that Doze can do. And
it's naturally virus-resistant. And it just simply doesn't do
spambots, unless it's been explicitly told to do so - i.e., it's
very difficult for anyone but the owner of the system to get it
to do anything he doesn't want done. Like run viruses. :-)

As far as fixing your Windoze, you'll have to ask the hoi polloi.

Have Fun!
Rich

CT wrote:
> I've heard that ClamAV is a good linux anti-virus program.
> 
> http://www.clamav.net/

clamav only detects, it doesn't remove anything

* Dieu Phan <phannhatdieu_NOSPAM@yahoo.com.au> writes:

[some windoze virus]

  > my question is:
  > -should i move explored.exe to windowsXP then using Norton to delete? 
  > or using a linux anti-virus software to delete it?

  $ su -c 'rm -f explored.exe' RET



-- 
|---<Steve Youngs>---------------<GnuPG KeyID: A94B3003>---|
|             Genius - Is the ability to reduce            |
|               the complicated to the simple              |
|----------------------------------<steve@youngs.au.com>---|

Dieu Phan wrote :

> -should i move explored.exe to windowsXP then using Norton to delete?

Read "Removal Instructions" here:
<URL: http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.gen.html>

> or using a linux anti-virus software to delete it?

Antivirus software for Linux are just for to use with a mailserver. Its
used for scanning incoming mail for virus before they are passed to M$
clients.
-- 
Thomas O.

This area is designed to become quite warm during normal operation.

On Mon, 26 Jul 2004 00:18:49 +1000, Dieu Phan wrote:


> any idea? and which anti-virus program is good for linux?
> your help would be much appreciated,
> regards
> dieu

I've heard that ClamAV is a good linux anti-virus program.

http://www.clamav.net/

On Sunday 25 Jul 2004 16:04, Thomas Overgaard wrote:

[...]
> 
>> or using a linux anti-virus software to delete it?
> 
> Antivirus software for Linux are just for to use with a mailserver. Its
> used for scanning incoming mail for virus before they are passed to M$
> clients.

Not necessarily. I use F-Prot on a mail server, but according to the docs it
can also disinfect files, though I've never needed to test that yet...

You can grab it from
http://www.f-prot.com/download/home_user/download_fplinux.html

-- 
Ian

Here's my 2 cents worth solution to fixing your problem:
- Delete Windowz completely after backing up important docs, etc. 
(hopefully your documents are not infected) If you don't have anti-virus 
software or the latest updated, you can check if your documents are 
clean by emailing them to yourself at some public mail server that scans 
for infected attachements (like yahoo).
- Then reinstall Windowz from the install disks.
- If possible don't install and/or configure networking support 
(networking is usually needed is you want Windows to connect to 
something like a Symbian phone).
- Next install your fav Linux distro (hopefully its slackware) on 
another partition.
- Use Linux to connect to public and private (these aren't any safer 
when it comes to viruses/worms) networks.

You will find:
- It is far easier to maintain a Linux distro with the latest patches.
- If you occasionally need to use Win you will find it may be faster, 
since you don't have a lot of crap installed like anti-virus programs 
and firewalls. As long as Windows is not exposed to any networks and 
your emailed docs are scanned by someone elses anti-virus software you 
may not need to bother installing the latest patches.

If you don't want to install Linux on the harddrive use a CD distro like 
SLAX or Knoppix.

A.

In news:ce0fgb$8lk$1@lust.ihug.co.nz, Dieu Phan bitched and moaned:
> hi,
> my sys. got attacked by a virus name W32.HllW.Gaobot.gen (the file
> explored.exe)
> Norton2004 detected it but can not remove. I guess it is located on my
> home server \\slackbox\shares\exlpored.exe (samba folder), physically
> it is on /home/pub/explored.exe of slackware Box
> my question is:
> -should i move explored.exe to windowsXP then using Norton to delete?
> or using a linux anti-virus software to delete it?
> any idea? and which anti-virus program is good for linux?
> your help would be much appreciated,
> regards
> dieu

If it is only finding it on the Linux share, and not on the Windows system
then chances are you are not infected.

First thing you need to do, is get onto the Symantec website and read about
this virus to see if there are any alterations made to the system registry,
this will help to determine if you really are infected, or whether the file
was copied.

Secondly, delete the file, either from the share, or from the Linux system
directly.  If you cannot delete it from the share, chances are that you do
not have r/w permissions, hence (perhaps) Nortons inability to remove the
virus.

There are some Linux AV apps about, but for the most part, Linux virri are
not a major concern as at this stage they still require execution by root,
or access through a kernel module which again requires root or suid, but it
could not hurt to ayr of the side of caution.

Dieu Phan wrote:
> hi,
> my sys. got attacked by a virus name W32.HllW.Gaobot.gen (the file 
> explored.exe)
> Norton2004 detected it but can not remove. I guess it is located on my 
> home server \\slackbox\shares\exlpored.exe (samba folder), physically it 
> is on /home/pub/explored.exe of slackware Box
> my question is:
> -should i move explored.exe to windowsXP then using Norton to delete? or 
> using a linux anti-virus software to delete it?
> any idea? and which anti-virus program is good for linux?
> your help would be much appreciated,
> regards
> dieu

It's a file on a linux share? Well, if it's a windows virus, the linux 
machine is not infected. Just delete the file.

-- 
spammage trappage: replace fishies_ with yahoo

Dieu Phan wrote:

> hi,
> my sys. got attacked by a virus name W32.HllW.Gaobot.gen (the file 
> explored.exe)
> Norton2004 detected it but can not remove. I guess it is located on my 
> home server \\slackbox\shares\exlpored.exe (samba folder), physically it 
> is on /home/pub/explored.exe of slackware Box
> my question is:
> -should i move explored.exe to windowsXP then using Norton to delete? or 
> using a linux anti-virus software to delete it?
> any idea? and which anti-virus program is good for linux?
> your help would be much appreciated,
> regards
> dieu
Thanks a lot for all helps..
Yes just simply to delete the file explored.exe contained the virus 
W32.HllW.Gaobot.gen. all clients were not affected
cause it is on linux so Norton can not delete it. I manually delete it 
in /home/pub (or \\server\shares [samba])
anyway, i am trying to install a antivirus for my linux. Thanks for all 
hints concerned w/ GUI but I dunt use GUI, just ssh (puTTY) from my XP 
to control slackwareBox.
panic! for some essential docs are in XPclients :-(, now got a backup 
for all those stuffs
cheers,
dieu