Subject: Re: windows shares and virus
From: Buddha (buddha@gci.net)
Date: Mon Aug 26 2002 - 20:03:36 AKDT
>
> Chris Hamilton wrote:
>
>>Hi All, I've read that certain virii are able to spread themselves
>> across LAN's through open windows shares. Does anyone know if these
>> types of virii can also spread themselves across samba shares on
>> linux/unix boxes?
>>
>>Thanks.
>>
>>Chris.
>>
>>
>>
>>---------
>>To unsubscribe, send email to <aklug-request@aklug.org>
>>with 'unsubscribe' in the message body.
>>
> An unqualified NO. There is only one virus that will infect both
> platforms and it has never been seen in the wild (and of ccourse it
> cannot infect executables except those the user has write access to)
>
> Civileme
>
If the Windows box is the device that's doing the spreading of the virus,
then the answer is 'yes'.
For example, take the Klez virus. It copies itself to network shares and
waits for a user to execute it.
From www.sarc.com...
Local and Network Drive copying:
The worm copies itself to local, mapped, and network drives as:
A random file name that has a double extension. For example,
Filename.txt.exe.
A .rar archive that has a double extension. For example, Filename.txt.rar.
The .exe on the Samba share can't infect anyone until someone comes along,
wonder's "What is this", double clicks on it like a dummy and executes it
thereby infecting their client.
References:
http://www.sarc.com/avcenter/venc/data/w32.klez.h@mm.html
I think I read the question from a different angle than civilme did.
---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.
This archive was generated by hypermail 2a23 : Mon Aug 26 2002 - 19:57:34 AKDT