hi,
my sys. got attacked by a virus name W32.HllW.Gaobot.gen (the file
explored.exe)
Norton2004 detected it but can not remove. I guess it is located on my
home server \\slackbox\shares\exlpored.exe (samba folder), physically it
is on /home/pub/explored.exe of slackware Box
my question is:
-should i move explored.exe to windowsXP then using Norton to delete? or
using a linux anti-virus software to delete it?
any idea? and which anti-virus program is good for linux?
your help would be much appreciated,
regards
dieu

Dieu Phan wrote:

> hi,
> my sys. got attacked by a virus name W32.HllW.Gaobot.gen (the file
> explored.exe)
> Norton2004 detected it but can not remove. I guess it is located on my
> home server \\slackbox\shares\exlpored.exe (samba folder), physically it
> is on /home/pub/explored.exe of slackware Box
> my question is:
> -should i move explored.exe to windowsXP then using Norton to delete? or
> using a linux anti-virus software to delete it?
> any idea? and which anti-virus program is good for linux?
> your help would be much appreciated,
> regards
> dieu

Why not just delete it?

I've never seen an anti-virus program for Linux, and I always
assumed that it was because of Linux's natural resistance.

Save everything you can from the Doze box and install Slackware.

I'm using KDE right now on 10.0, and with the exception of AutoCAD
Mechanical Desktop, it's doing everything that Doze can do. And
it's naturally virus-resistant. And it just simply doesn't do
spambots, unless it's been explicitly told to do so - i.e., it's
very difficult for anyone but the owner of the system to get it
to do anything he doesn't want done. Like run viruses. :-)

As far as fixing your Windoze, you'll have to ask the hoi polloi.

Have Fun!
Rich

* Dieu Phan <phannhatdieu_NOSPAM@yahoo.com.au> writes:

[some windoze virus]

> my question is:
> -should i move explored.exe to windowsXP then using Norton to delete?
> or using a linux anti-virus software to delete it?

$ su -c 'rm -f explored.exe' RET



--
|---<Steve Youngs>---------------<GnuPG KeyID: A94B3003>---|
| Genius - Is the ability to reduce |
| the complicated to the simple |
|----------------------------------<steve@youngs.au.com>---|

Dieu Phan wrote :

> -should i move explored.exe to windowsXP then using Norton to delete?

Read "Removal Instructions" here:
<URL: http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.gen.html>

> or using a linux anti-virus software to delete it?

Antivirus software for Linux are just for to use with a mailserver. Its
used for scanning incoming mail for virus before they are passed to M$
clients.
--
Thomas O.

This area is designed to become quite warm during normal operation.

On Mon, 26 Jul 2004 00:18:49 +1000, Dieu Phan wrote:


> any idea? and which anti-virus program is good for linux?
> your help would be much appreciated,
> regards
> dieu

I've heard that ClamAV is a good linux anti-virus program.

http://www.clamav.net/

CT wrote:
> I've heard that ClamAV is a good linux anti-virus program.
>
> http://www.clamav.net/

clamav only detects, it doesn't remove anything

On Sun, 25 Jul 2004 17:04:51 +0200, Thomas Overgaard wrote:

> Dieu Phan wrote :
>
>> or using a linux anti-virus software to delete it?
>
> Antivirus software for Linux are just for to use with a mailserver.

Just? Not really. I know many people using av software running on a Linux
machine in heterogeneous networks to scan SMB shares.

--
Jakub Jankowski
shasta AT spam DOT atn DOT pl

> I've never seen an anti-virus program for Linux, and I always
> assumed that it was because of Linux's natural resistance.

There are a few AV packages for Linux, clamav is useful because it can use
various addins to scan such things as:
- The usual file/archive scanning
- On Access file/directory scanning
- Incoming POP mail
- SMB share scanning
- Apache module to scan web content.

http://www.clamav.net/
But it can be a bit slow when scanning large volumes of files

F-Prot are reasonably well known commercial organisation
http://www.f-prot.com/products/home_use/linux/

Their software does not support the range of plugins/abilities that clamav
has, but it is extremely easy to install and its scanning is much faster.

Panda AV is again easier to install, faster to scan but has less options
than clamav with regard to possible uses.
http://www.pandasoftware.com/download/linux/linux.asp

On Sunday 25 Jul 2004 16:04, Thomas Overgaard wrote:

[...]
>
>> or using a linux anti-virus software to delete it?
>
> Antivirus software for Linux are just for to use with a mailserver. Its
> used for scanning incoming mail for virus before they are passed to M$
> clients.

Not necessarily. I use F-Prot on a mail server, but according to the docs it
can also disinfect files, though I've never needed to test that yet...

You can grab it from
http://www.f-prot.com/download/home_...d_fplinux.html

--
Ian

Here's my 2 cents worth solution to fixing your problem:
- Delete Windowz completely after backing up important docs, etc.
(hopefully your documents are not infected) If you don't have anti-virus
software or the latest updated, you can check if your documents are
clean by emailing them to yourself at some public mail server that scans
for infected attachements (like yahoo).
- Then reinstall Windowz from the install disks.
- If possible don't install and/or configure networking support
(networking is usually needed is you want Windows to connect to
something like a Symbian phone).
- Next install your fav Linux distro (hopefully its slackware) on
another partition.
- Use Linux to connect to public and private (these aren't any safer
when it comes to viruses/worms) networks.

You will find:
- It is far easier to maintain a Linux distro with the latest patches.
- If you occasionally need to use Win you will find it may be faster,
since you don't have a lot of crap installed like anti-virus programs
and firewalls. As long as Windows is not exposed to any networks and
your emailed docs are scanned by someone elses anti-virus software you
may not need to bother installing the latest patches.

If you don't want to install Linux on the harddrive use a CD distro like
SLAX or Knoppix.

A.