Windows 2000 virus

A while ago there was a virus that was going around that only infected Windows 2000 systems. It didn’t do anything harmful, just replicated itself. I’m not on Windows 2000, but I’ve been getting e-mails with .pif and .scr attachments from a certain person.

Does anyone remember the name of this virus? Does anyone know where to get an anti-virus patch for it? It’s not affecting me, but I’d like to send the URL to the guy whose e-mails seem to be infected.

Thanks.

Google, “windows 2000 virus”. Is this it?

There might be more info at Symantec.

Could be… But I remember it coming out later, after Red Worm (when did that one come out?). It wasn’t Nimda.A, was it?

Nimda only attacks W2k systems if they’re running IIS (internet information server, IIRC), microsoft’s bundled software for running a website. A couple weeks ago I installed IIS to review some class work I had done over a year ago. The next day I received a notice that my Norton System works had detected and quarantined Nimda Worm but could not delete the file.

I tried to delete it from explorer but was unable. I ended up uninstalling IIS and deleting the inetpub folder (which is IIS), so I took the worm out 3 folders up from it’s location.

I talked to some of my friends who are better OS geeks than I and they all said that IIS is full of security holes. One of them said “swiss cheese”.

I just rec’d a pif attachment from an unknown person. I deleted it because there was no other message, so it must be spam. I assume these pif files contain a virus.

You’re getting Badtrans.B. Very common right now. It isn’t specifict to Win2k.

See http://www.sarc.com/avcenter/venc/data/w32.badtrans.b@mm.html

It turns out it was affecting me! :mad:

This thread tells how I got rid of it. (Thanks to the Dopers who helped me!)

http://www.symantec.com/avcenter/venc/auto/index/indexW.html

Anything listed here that begins with the prefix W2K. is specific to Windows 2000.

I ran a Norton scan & nothing was infected. But I remember the from was “Linda <lgonzal@hotmail.com>” – and this was in that list at http://www.sarc.com/avcenter/venc/data/w32.badtrans.b@mm.html

Thanks, RealityChuck.

My Norton didn’t find it either – until I downloaded the new profiles. When did you update your program last?

I have live updates. In addition to today, the prior update was 11/24/01.