Printable View
Hi I was windering if anyone could help. I have a machine that keeps getting attacked by w32/forbot-gen I have look through google and all that comes up are links to sophos web site I was wondering if any one knew anything about it. So I can try and block it as the machine isn't powerful enough to accept any patches past service pack 2 for Windows 2000.
cheers
Are you running any kind of Antivirus protection on that system?
Yes Sophos.
the File "cftnom.exe" Make it in to C:\WINNT\System32\ and once every 1/2 days it writes it self into the registry. I have removed like it tell me to on sophos and it keeps coming back
Cheers for the quick response
okay from what you have given in the post this is what i think you should do
1. UPDATE to SERVICE PACK 4
2. Get a firewall
3. Update your antivirus and i dont know how good is sophos but try out AVG (free) or trandmicro's
i did not find the virus name at symantec but ill still try to get a link for removal tool any way if you can get removal tool from your anti-virus provider and run it in SAFE MODE.
ByTeWrangler thanks for the advice.
But I am behind a firewall and have removed this virus from both safe mode and non-safe mode and still it comes back. That is why I was asking if anyone had any information of the virus
But your advice was greatfully received
Try running Trend Micro's "Housecall" and Panda Software's Online Scan.
Go to DiamondCS's website and get RegistryProt
Get Spybot Search & Destroy, update it and run it in safe mode. Run its immunisation option. Start it in advanced mode and use the tools to check BHOs the Hosts file and so on.
EDIT: Are you sure it is cftnom.exe? you might like to look at this link:
http://support.microsoft.com/kb/q282599/
read this
http://www.sophos.com/virusinfo/anal...2forbotay.html
under the description tab you'll see
nextQuote:
W32/Forbot-AY attempts to spread to network machines using various exploits including the LSASS vulnerability (see MS04-011). The worm may also spread via IRC channels.
http://www.microsoft.com/technet/sec.../MS04-011.mspx
From Microsoft
Quote:
Microsoft Windows 2000 Service Pack 2, Microsoft Windows 2000 Service Pack 3, and Microsoft Windows 2000 Service Pack 4 –
whlie you said that you had only updated to service pack 2 GET THIS SPECIFIC PATCH HERE
http://www.microsoft.com/downloads/d...displaylang=en
get your computer scanned online at
http://housecall.antivirus.com
eventhough you said your computer cannot take over service pack 2.
I STRONGLY RECOMMEND YOU DO.
pegasys,
I don't understand that. As far as I am aware there is no greater power required for SP4Quote:
the machine isn't powerful enough to accept any patches past service pack 2 for Windows 2000.
The requirement is PI/133 and 128Mb of RAM?
Can you explain why you think that your machine is not powerful enough? I am intrigued.
Well the machine in question is a email server running exchange and isn't in the best of states and I am affraid that after installing any more patches it will become more hassle to deal with. At the moment the machine has become a typical windows machine and playup whilst trying to complete the simplest of daily checks.
Just wante to say that Installing Service Packs or patches doesn't degrade the speed or power of the computer but patches either improve perfomance and give better security, the fact that you machine gets infected every 1 or 2 days shows the IMPORTANCE of patches and service packs.
I mean it makes no sence keeping your door's locked and windows open.... you are still insecured..
anyway its up to you to update or even upgrade but after reading the document at sophos and microsoft only way you can stop this virus is installing that patch. belive me no matter how messed up your computer is patches will always help you and one more thing you can "ALWAYS UNINSTALL" a patch when you need too. :)
Hi,
If you believe M$, SP4 is supposed to make Win2000 MORE stable:)
The behaviour you describe is typical of a machine infested with malware, so I would certainly give it the scans mentioned.
How much (%) free hard disk space have you? A shortage of disk space is also likely to produce those symptoms. You really should have 20% free or better, or defragmentation will not work properly. Speaking of which...........when did you last defragment it? :cool:
This is best done in safe mode, as is the malware scanning. I would suggest that you schedule some downtime for "essential maintenance"................yeah, yeah, I can hear the whining already, but it will make life easier :D
Good luck mate!
EDIT: The compression utilities in datamases and mailing systems don't work properly if you don't have enough free space, either. This will produce quite dramatic performance degeneration as well.
Much like nihil has stated, it is sounding to me more and more like you just need to perfrom a major cleanup of that machine. This cleanup would include a disk defrag, a registry clean, full malware/spyware cleanup, uninstallation of non-needed Windows components & applications, perhaps a full Scandisk, full virus scan NOT using your current AV application, and of course, updates of any patches. Others already hinted to this fact, but why have the machine exposed to the wild if you're not going to patch it? You're just asking for trouble which will in turn lead to even more hassles and troubles from this machine.
I would just like to thank everyone for the advice given it has been greatly received I am going to do everything stated including patch it. People in the UK shouldn't be able to hear the scream due to the local fireworks events being held but it will be there, Wish me luck Although as I am dealing with microsoft I shouldn't need it
LOL