Printable View
Well,i will share my really bad experience of being infested with 2 difference viruses and cause my system to get infested with the viruses on 200 over files within 1hrs.Although my antivirus is able to clean that up but causing some of the system files to get missing and endup i have format my hard disk.This is the worse experience that i ever have and how about you?
I have seen several infections. I get people come in with their PCs infected with viruses all the time. It amazes me how bad it can get.
A while ago, I was very curious how viruses work. So... I setup a test "network".
I just hooked 2 test boxes together and didn't put them on my network nor give them access to the web. I didn't install antivirus and I installed a couple of utilities such as filemon and regmon from www.systernals.com
I collected several viruses, of different sorts. I then created a batchfile to execute all of the viruses one after another. I had the filemon and regmon up and running.
I got pretty much the same results on both machines... and I was barely able to save the logfiles from filemon and regmon.
I ran the bachfile and let the viruses go crazy for a couple of hours.
The machines were useless afterwords.
I'm not sure if I still have the log files... If I can find them, I'll attach them.
School is coming to an end pretty quickly... so maybe I'll do it again with newer viruses.
I'll have to track some of em down... but pretty confident I can find quite a few on p2p and virus archives... how bout the AO archive? lol There are plenty of places to find them.
Pretty interesting though... :rolleyes:
lol same here. i had a client using 2 AV Sofwares and 2 firewalls, and his PC was infested with viruses and dialers. he didnt bother checking the Start Up in his msconfig. another proof that its not what you have that makes ur computer safe, its how u use them.
Summer 2000 (I believe) I was working as a computer technician intern at my school system. Starting my summer job about 3 weeks before the end of school. My direct superior Walked into the shop with a large bundle of papers, a coffe stain on his shirt, and a grim smirk on his face.
"Disconnect all infected computers from the network, yeah right hehe" he said in a depressed tone.
We asked him what he was talking about, he waved us off a bit and turned on his shop computer.
He is the head technician for our small school system. A bachelors in political science, fresh out of college about 6 weeks ago. He calls computers a hobbie, and he's got 4 schools with about 4-500 computers that he's responsible for, especially for the next two weeks, as the system administrator is on vacation before the upgrades began durring summer break. Luckilly for him, these are supposed to be among the quietest and most cheerfull weeks of the year, right before the summer. The fact that these are the few days in the year when the IT infrastructure of the county was absolutely depended upon to process the results of several thousand exams and year final grades and report cards wasn't supposed to be an issue.
We queried him again.
"Just a second, I've just gotta make sure" he said hesitantly.
After a minute or two while we waited at our respective computers browsing pricewatch.com and tweak3d.com, he spoke.
"I'm pretty sure that about 60% of the computers on the network have a god damned virus."
To us this news was intriguing... our first major experience with a network wide virus. To him it was a nightmare. I would have hatted to be him right then :D
I honestly can't remember exactly which virus that one was, we played with a lot of them. It might have been a flavor of klez, but i can't remember if that does anymore than email itself around. whatever it was it could spread by email, the 1 character password thing in win 9x shares, and infected exe's. We managed to keep it off the servers. but we had to do complete reinstalls on countless systems. That's all we did well into the summer was clean up fallout from that stupid virus. We didn't get the work order list back to 'real time' where we're fixing stuff as it comes in until a few weeks before the next school year.
yeah, that sucked, I think I'm now immune to worrying about viruses on single systems customers bring in. We also recovered some of the systems at the schools as we learned more about what the virus did. So they don't bother me anymore, cleanups like second nature... (like the story? it's a little over dramatized, but the numbers are all right, just wanted to make it interesting :) )
UpperCell:
Sounds like your school needs a corporate edition of AV...
I use norton antivirus corp edition . Set it and forget it. It downloads updates daily (if there is one) and pushes out the def files automagically. I have not had any serious infection at work for bout 2 years.
Aside from that, make sure AV is running on mail servers and proxy servers. Anything that is a would be virus, gets caught at the front door and doesn't make it very far.
Since then, I've only seen viruses on floppies. Stupid users bringing in floppies from previous employment and get all pissed when I throw away their work that can't be saved.
The only problem with all that is... resources. Sure takes up quite a bit of resources and I had to upgrade several of the machines just so they could work. I've since replaced 90% of those PCs and they are generally round 1.6-2.0ghz with 512mb ram. Very nice workstations...
you are very wise phishphreek80. As of July 2001 the entire network is using that very product. Now wether they can keep it nice is another story :) we never had a problem with resources, but that was the same year we 'purged' everything under 450 mhz from the system. So we were pretty good off from that standpoint.
My first (and hopefully only) expericne with a virus infection is no where near as looming as the ones already mentioned, but it was rather annonying, and prooved to be a learning experience. At the point in time when my system became infected, I was without AV or Firewall (I'm almost ashamed to mention it now) so I was prettymuch wide open to the entire world, but somehow I only got infected with one virus. JS/Kak@M was the annoying virus to latch itself onto my computer. Fortunately for me it was not a destructive virus, but rather a nagging one which would deny me the ability to use my computer on the first of every month. After cleaning it off my system, I got amazinly paranoid, so now my AV system updates every night and also runs a complete system scan nightly as well. I've yet to get a virus since then, though I have seen many get plucked up by AVG and tossed in the Vault.
Oh.. a FYI for those who may consider NAV corp edition...
It doesn't seem to like to play nice with XP. There is a patch for it though...
Also... not that you'd be using 95 or 98... but if you are... your PC won't shutdown properly.
There is a registry tweak that you can apply to make it work with it.
But... if you're using 95 or 98 on your network... you have much larger problems to deal with. :rolleyes:
When I was finishing college, about a year or so ago, we were hit bad by the nimda virus. Because it hopped from computer to computer using open shares, we had to power off the switches and routers, so that the pc's couldn't talk and go one by one removing the virus from infected computers. That was one waste of a good afternoon, but the pizza the admin bought for us made it all worth it.
PuRe
I've got 2 stories... both kinda short (I hope as I really wanna go to bed.. but I really am addicted)
1)
When nimda came out, it infected our HS network hardcore, hit nearly every computer. and we're talking a school board wide infection. 12 high schools, prolly 30+ public schools, and all the admin offices.. and this wasn't just a city.. this covered around 160000 km^2 (gotta love Northern Ontario). So they modified the logon script to include running fixnimda. They figured this would fix it.. (I love network admins sometimes)... anyways.. since not every computer was logged onto at the same time, some would get fixed, but then it would spread from other computers back to the cleaned ones... Finally they go board wide and clean the problem, and one principal get's an email with it and runs the damned virus again. Hey look they started all over.
2)
A friend of mine, when CIH first came out, was hit pretty hard. But being against AVs.. he decided to just leave it alone.... a few weeks later he had a computer that wouldn't boot because he had a fubar'd bios/cmos on his motherboard...
now i'm really going to bed..
g'nite
the only experience with virus i had was sometime in end of 1999 a friends computer(win 98 box) was giving problems during startup... so i asked him to get his HDD to my place and copy his important stuff and format his hdd.............
as installed his hard disk as slave and booted my computer.....
as soon as windows started, i got many messages from norton AV .......luckly i had the latest definations. on scanning norton found 300something infected files....
repaired some and deleted some times.....hope that taught my friend a lesson......
Quote:
It doesn't seem to like to play nice with XP. There is a patch for it though...
:
im using NAV since i purchased my acer travelmate....
i got xp home and NAV bundled with it and havent experienced ne problem with it......
btw whats the but and where can i get the patch?
Well,i really wanna laugh at my pervious company which is such a big company also get infested with the virus call I LOVE YOU.Guess what,i managed to find out that they are using Norton Corp.I really almost bust out into laughter cos such a big company having problem with virus and our whole company system is down for a few days due to the silly worm(It is a listed company call Micron Semiconductor).Sorry to make it comment if you are a Norton User.When the worm first spread so widely,Kaspersky and some other antivirus companys have already resolved it within a short period of time.
The patch is only needed if you are running XP and using NAV Corp Edition.Quote:
im using NAV since i purchased my acer travelmate....
i got xp home and NAV bundled with it and havent experienced ne problem with it......
btw whats the but and where can i get the patch?
They have most likely fixed this with the new packages they are selling, but with the one we got, we needed a patch. XP wouldn't run NAV otherwise, due to the unsigned drivers/services that were being installed.
Symantec has it available on their site for DL.
I don't have the direct link right here. I'll have to get it when I get to work.
The last time I got hit by a virus was back when my 486 SL 33 was still state of the art and DOS 6.2 witn Windows 3.1 was the latest and greatest. I got hit by the One Half virus and lost everything on my hard disk. Since I didn't have my original Compaq restore disks (about 50 floppies), I had to go to the Compaq office and pay a bomb to get all the software reinstalled. After that I've never been hit by a virus. Oh sure, Norton (or McAfee depending on what I happen to be using at that time) has caught a few viruses from time to time, but it's never got past the autoprotect feature.
Cheers,
cgkanchi
Damn...... I am old.....<sigh>
My first and most interesting experience with a virus was good old Stoned about 12 years ago. The receptionist's computer was infected with it. Back then NCR used a slightly different sector size then other computer manufacturers so going out and buying Norton proved to be a bit if a waste of cash. I ended up having to call Norton to get an idea of exactly how the virus worked to determine how to get rid of it. Turns out to really be reather simple. The virus would take sector zero and write it to the first unused sector which was sector 7 and write itself into sector zero thus executing itself at boot and executing a jump to sector 7 when it was done. There was a hard jump from sector zero to sector 1 at the end of sector 1 anyway so the boot sector did not need to be changed. The problem with Norton was that rather then execute a jump to sector 7 via the FAT it would count a literal number to find the beginning of sector 7 and that's where it would fall down on an NCR drive - the sectors were a different size. All I had to do to repair it was copy sector 7 back over sector zero and bingo - all was well.
The real funny part was that this peeked my interest..... I wanted to know where it had come from. Not many people in the office were literate and those that were were all creatures of habit. So I scanned every floppy in the office, (200 plus), and found no sign of infection. Funny, thinks me...... So I go to the network fileservers that provided the programs to our micrographics machines and that had just been upgraded to Novell 2.11, (wow). Lo and behold they were both infected...... Upon asking the receptionist if her un-networked computer had been used by the upgrade techs from corporate she said they had - OK - I have the infection source.......
I write all my findings down and send them off to corporate in sunny California only to called into my bosses office a few days later and utterly reamed for accusing them of spreading a virus across the breadth of the country. He, via them, informed me that these peeps "really new their $h1t and could never make such an amateur mistake"....... That was followed by a nasty memo from the corporate head tech chap telling me the same thing...... Boy, was I pi$$ed.....
I found out the tech's schedule for upgrades and started calling the offices he had visited prior to mine.... 5 of them..... Funny old thing, all five offices servers were infected with Stoned.... I was LMAO now..... I called the office he was currently at and asked the local tech there to insist that the corp. tech scan his install disks for viruses before he carries out the upgrade. Apparently after a lot of indignant BS he went ahead and scanned them..... They _all_ were infected with Stoned...... Duh....
I never heard from Corporate again...... They never apologized and they never sent people to do further upgrades etc. they would just send me the stuff...... Two months later I was promoted to District Systems Specialist responsible for New York, Philly, Delaware, Rhode Island and all points in between....... ;)
And that's how I learned about viruses and corporate BS........
Back in the early days of the net, before any one took viri as a serious threat I saw a truly vicious virus ravage a JC. I have forgotten its name, but it was a boot sector virus that would try to cause the HD read head to spin too fast and slammed into the right side of the drive case. Most systems just froze up but I saw around 50 systems with dead hard drives from it.
The other nightmare infection was a virus I saw in development in the late 80’s, it never made it into the wild luckily. The virus was called Demi Lich and it would force overclocking of the processor until it burned itself out.
interesting bballad, what kind of systems where those, if you remember. that's a crazy concept by todays standards, but I wonder what type of system either of those where possible on.
wait... I guess the second one might be feasable with a bios virus of some sort... so nevermind about that being too crazy.
The first virus shouldn't work today, I belive any drive over 250 mb would be new enough to not have the feature that was exploited to allow overspinning of the drive.Quote:
Originally posted here by UpperCell
interesting bballad, what kind of systems where those, if you remember. that's a crazy concept by todays standards, but I wonder what type of system either of those where possible on.
wait... I guess the second one might be feasable with a bios virus of some sort... so nevermind about that being too crazy.
The second one was a boot sector, and this worked best on 386 systems, or overporcessed 386 systems. They ran hot to start with and the lack of any cooling mechinisam helped.
So far no virus has hit our networks as hard as Gandalf doing something that "seemed like a good idea at the time."
Gandalf: Yeah..... I know that one too..... :D