virus called PIDSERV.EXE 1

[501]

Has anyone else seen this virus, it shuts down serves on the server like browser services. Norton does not detect it.

 

[SjrH]

It is the W32/rbot-y worm that attacks network shares and trys to delete them. Try googling for removal procedures.

SjrH - Data Security Storage & Availability Specialist

http://www.sjrh.co.uk

 

[501]

Thanks, here is the link for removal instructions.

http://www.sophos.com/virusinfo/analyses/w32rboty.html

The only problem is it keeps coming back.

 

[jtb]

The problem then is someone on your network who has access to the server...

recommend locking down access (remove "Everyone" group and audit all file creation activities?) until you track it down... I just don't have the Security chops to be able to tell you exactly how...

maybe you can sms or gpo the latest av signatures to everyone...

JTB
Have Certs, Will Travel
"A knight without armour in a [cyber] land."