Windows 2000 virus

Factual Questions
1

A while ago there was a virus that was going around that only infected Windows 2000 systems. It didn’t do anything harmful, just replicated itself. I’m not on Windows 2000, but I’ve been getting e-mails with .pif and .scr attachments from a certain person.

Does anyone remember the name of this virus? Does anyone know where to get an anti-virus patch for it? It’s not affecting me, but I’d like to send the URL to the guy whose e-mails seem to be infected.

Thanks.

2

Google, “windows 2000 virus”. Is this it?

There might be more info at Symantec.

3

Could be… But I remember it coming out later, after Red Worm (when did that one come out?). It wasn’t Nimda.A, was it?

4

Nimda only attacks W2k systems if they’re running IIS (internet information server, IIRC), microsoft’s bundled software for running a website. A couple weeks ago I installed IIS to review some class work I had done over a year ago. The next day I received a notice that my Norton System works had detected and quarantined Nimda Worm but could not delete the file.

I tried to delete it from explorer but was unable. I ended up uninstalling IIS and deleting the inetpub folder (which is IIS), so I took the worm out 3 folders up from it’s location.

I talked to some of my friends who are better OS geeks than I and they all said that IIS is full of security holes. One of them said “swiss cheese”.

5

I just rec’d a pif attachment from an unknown person. I deleted it because there was no other message, so it must be spam. I assume these pif files contain a virus.

6

You’re getting Badtrans.B. Very common right now. It isn’t specifict to Win2k.

See http://www.sarc.com/avcenter/venc/data/w32.badtrans.b@mm.html

7

It turns out it was affecting me! :mad:

This thread tells how I got rid of it. (Thanks to the Dopers who helped me!)

8

http://www.symantec.com/avcenter/venc/auto/index/indexW.html

Anything listed here that begins with the prefix W2K. is specific to Windows 2000.

9

I ran a Norton scan & nothing was infected. But I remember the from was “Linda <lgonzal@hotmail.com>” – and this was in that list at http://www.sarc.com/avcenter/venc/data/w32.badtrans.b@mm.html

Thanks, RealityChuck.

10

My Norton didn’t find it either – until I downloaded the new profiles. When did you update your program last?

11

I have live updates. In addition to today, the prior update was 11/24/01.