NetWare Problem or Virus?

Thread View: comp.dcom.lans.novell

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Al Berg Sat, 11 Feb 1995 21:45

#70

Author: Al Berg
Date: Sat, 11 Feb 1995 21:45

50 lines
2898 bytes

Here's a real poser...

I just got back from a client (let's call them The Eighth National Bank of
West Podunk) who has some real problems:

They have a Novell NetWare (3.11) based 16Mbps Token Ring network with
rings in both East and West Podunk connected by a WAN link.  The network
has been pretty stable until recently, when users' workstations started
randomly rebooting.  Users only reboot while they are attached to the
network (although they do not have to log in) and while they are in
Windows.  The problem started in West Podunk in one department, spread to
other W Podunk depts and then spread to East Podunk (where IS is located).
The number of machines affected seems to be increasing day by day.
Affected machines reboot at least daily.  Today whil I was there, 3
machines rebooting withing <5 min of each other.

The IS department states that no new software or other changes have been
made on a network wide basis recently.

I ran Virus Scans on an affected workstation with both F-PROT (Secure and
Heuristic Scans) and McAfee Scan 2.14e - no result.  The same scans on the
server also turned up nothing.

If this is a virus, my theory is that it would have to be file based (to
explain its replication over the WAN) and it would either have to be new or
employ some stealth technique to render it undetectable from F-Prot and
Scan.

Things that seem 'virus like' about this behavior:

     * sudden onset
     * pattern of spread from one office to another - gradual
'transmission' within office

Things that point to a non virus problem:

     * can't find the beast
     * almost simultaneous 'activation' on multiple PCs in some cases
     * only happens in Windows
     * in 5 years of antivirus experience, this would be the first 'new'
virus I have come across

I'm bringing an HP Advisor onsite Monday to check the wire...

Has anyone had a similar experience?  Please email me or post to this
group... any help would be greatly appreciated!

Thanks

Al Berg

Re: NetWare Problem or Virus?

#69

Author: Toby Garner
Date: Sun, 12 Feb 1995 22:48

60 lines
3242 bytes

In article <3hjb58$e9l@pipe1.pipeline.com>, alberg@pipeline.com says...
>
>Here's a real poser...
>
>I just got back from a client (let's call them The Eighth National Bank
of
>West Podunk) who has some real problems:
>
>They have a Novell NetWare (3.11) based 16Mbps Token Ring network with
>rings in both East and West Podunk connected by a WAN link.  The network
>has been pretty stable until recently, when users' workstations started
>randomly rebooting.  Users only reboot while they are attached to the
>network (although they do not have to log in) and while they are in
>Windows.  The problem started in West Podunk in one department, spread to
>other W Podunk depts and then spread to East Podunk (where IS is
located).
>The number of machines affected seems to be increasing day by day.
>Affected machines reboot at least daily.  Today whil I was there, 3
>machines rebooting withing <5 min of each other.
>
>The IS department states that no new software or other changes have been
>made on a network wide basis recently.
>
>I ran Virus Scans on an affected workstation with both F-PROT (Secure and
>Heuristic Scans) and McAfee Scan 2.14e - no result.  The same scans on
the
>server also turned up nothing.
>
>If this is a virus, my theory is that it would have to be file based (to
>explain its replication over the WAN) and it would either have to be new
or
>employ some stealth technique to render it undetectable from F-Prot and
>Scan.
>
>Things that seem 'virus like' about this behavior:
>
>     * sudden onset
>     * pattern of spread from one office to another - gradual
>'transmission' within office
>
>Things that point to a non virus problem:
>
>     * can't find the beast
>     * almost simultaneous 'activation' on multiple PCs in some cases
>     * only happens in Windows
>     * in 5 years of antivirus experience, this would be the first 'new'
>virus I have come across
>
>I'm bringing an HP Advisor onsite Monday to check the wire...
>
>Has anyone had a similar experience?  Please email me or post to this
>group... any help would be greatly appreciated!
>
>Thanks
>
>Al Berg

The only other thing I could suggest is maybe running Netshield on the
servers, and see if that shows up anything... but it sounds like you have
a strange problem on your hands!

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads