Datmon worm with files msvxd

[Purd]

Our office has a worm called datmon I think and it keeps recurring with files called msvxd.exe, msvxd16 and msvxd32. I keep deleting them and also a run file in win.ini but the darn thing keeps recurring. Our antivirus program gets rid of it only to see it again a few days later. Have done search on google etc. but can't find much out. Any ideas. Thanks Purdy.

 

[SESaskDFC]

Howdy:

Fix for the W32.Datom.Worm (sure helps when you get the right spelling) is here..

http://securityresponse.symantec.com/avcenter/venc/data/w32.datom.worm.html

Murray

 

[Purd]

yeah Thanks I have seen all that...........the msvxd files are the give away and I have done what is suggested on the symantec site. Keep on trying huh?

 

[KimberTech]

Purdy:

Make sure you have the shares on your network passworded and that you have patched the systems.

If you are being reinfected and you have open shares on the network it will spread back to you from the source.(or back to the network from you)
Are you disconnecting all the network computers and checking them ALL for this before reattaching?

What are you doing when the antivirus program you are running picks it up?

The links below are relevant:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS00-072.asp

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2000091415173339

You will get better help with virus problems if you post in the general virus discussion forum next time. Lots of very knowledgeable people answering questions there.

Good Luck! and post if you need any more help or have details.
Kimber

The more I learn,I realize how much more there is to know!

 

[Purd]

Thanks Kimber. I have only worked here for a short while and an outside technician has been looking after it. That's why I am a trifle vague about it. I'll follow your suggestions THANKS Purdy

 

[KimberTech]

My pleasure Kimber

The more I learn,I realize how much more there is to know!