Wednesday, January 10, 2007

No N00S is Good N00S

I spent the evening responding to a new virus. This one runs a program called n00s.exe and attacks Symantec AntiVirus on TCP port 2967. Nearly all of the machines in our domain have Symantec AntiVirus, so there is a lot of potential for destruction. Some machines get a message when Symantec's rtvscan crashes, but others get infected and go to the dark side.

1 comment:

jjp said...

We've been dealing with Big Yellow on campus. Not fun. And we can't just reinstall everything, we don't have access to student devices...

But I don't have to worry about it, since it's Windows.