I'm surprised that no one has mentioned Samba yet......we (UNIX group) got hit through a (Samba)mapped drive to a UNIX server. Luckily we caught it almost immediately. Did a shutdown and then came up in single user mode with the ethernet cable yanked (can you say paranoia?) Disabled the samba server and removed it from startup. Did a find to identify overwritten files (piped to a text file to document for users) and then deleted. I can also see this trojan getting unintentionally propagated through UNIX servers by people with windows "hide file extensions" turned on while FTPing through a GUI client. Next (windows) user comes along and downloads it (GUI windows client) and BLAM!
Slashdot Mirror
I'm surprised that no one has mentioned Samba yet......we (UNIX group) got hit through a (Samba)mapped drive to a UNIX server. Luckily we caught it almost immediately. Did a shutdown and then came up in single user mode with the ethernet cable yanked (can you say paranoia?) Disabled the samba server and removed it from startup. Did a find to identify overwritten files (piped to a text file to document for users) and then deleted. I can also see this trojan getting unintentionally propagated through UNIX servers by people with windows "hide file extensions" turned on while FTPing through a GUI client. Next (windows) user comes along and downloads it (GUI windows client) and BLAM!