[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference powdml::pc_security

Title:PERSONAL COMPUTER SECURITY
Notice:SWEEP servers Note 5; more info on www-is-security.mso.dec.com
Moderator:BSS::BOREN
Created:Wed Jan 02 1991
Last Modified:Fri Jun 06 1997
Last Successful Update:Fri Jun 06 1997
Number of topics:504
Total number of notes:2905

480.0. "Winword/Npad Virus?" by HYDRA::KLIGER () Fri Feb 07 1997 12:46

    Running Sophos Sweep V2.93 on a Windows95 system found 1 virus:
    
    Winword/Npad detected in c:\msoffice\template\normal.dot
    No Action taken
    
    What should I do?
    
    - Hal Kliger
    
T.RTitleUserPersonal
Name
DateLines
480.1Use sweep to disinfectVARDAF::BERBIGIERNo known policy forbids common senseMon Feb 10 1997 04:408
Options/Configuration/Action

select "Disinfect Documents" and "Requet Confirmation" boxes
click OK button

re-scan your hard disk

Pierre
480.2NPAD in DRVSPACE.000ODIXIE::BIERLEYTue Feb 18 1997 23:227
    I have also been infected with the Winword Npad virus.  I am running
    sweep 2.94 and had it set up to automatically disinfect files.  It
    found the virus in normal.dot and says that it took care of that one. 
    Now it says that I have the same virus on my host drive x: in the file
    DRVSPACE.000.  I can't let it delete my compressed volume.  I tell it
    no and it doesn't attempt to repair the file (although I'm not sure I
    want sweep to monkey with DRVSPACE.000).  Anyone have any ideas?
480.3Solution foundODIXIE::BIERLEYWed Feb 19 1997 14:224
    I found a second infected file when I booted from a floppy and ran
    F-Prot.  I deleted the file and when I reran SWEEP on my uncompressed
    volume it ran clean.  Apparently SWEEP was seeing the footprint when
    scanning DRVSPACE.000 but not in the actual file.
480.4does this virus have residual effects?PHXSS1::HEISERMaranatha!Thu Mar 20 1997 15:3115
    I've been seeing this one a lot lately too.  On my local siteserver, my
    PC, etc.  Sweep 2.95 caught them all and disinfected them all. 
    However, my PC has been acting very strangely since.  The Sweep library
    doesn't indicate that this is a serious virus, is this true?  
    
    Since the discovery, Sweep 2.95 has been acting strangely as well. 
    Long periods (i.e., 10-30 secs.) of hesitation between mouse clicks
    (and this is a Pentium 75).  The whole system hangs during this period
    and I can't do anything else.  Another symptom is losing network access 
    through the PPP connection.
    
    Is this related or a different problem?
    
    thanks,
    Mike
480.5See http://www.Europe.DataFellows.com/v-descs/npad.htmVARDAF::BERBIGIERNo known policy forbids common senseFri Mar 21 1997 04:290
480.6A "feature" of auto-upgradeTROOA::trp147.tro.dec.com::ACHANArthur Chan @TROFri Mar 21 1997 16:3718
Mike,

If you installed Sweep for Windows 95 from a site server 
over a modem connection, you may notice the modem 
lights flicker approximately every minute.  What Sweep is 
doing is probing the site server to see if a new version is 
available.  

A possible work around is to not impose a heavy load on 
the line when using Sweep (eg. preparing to scan a file).  

I have not heard of problems with Sweep breaking network 
access on a PPP connection, is this a common symptom?  
It may just be a poor connection or call waiting kicking in.

Regards,
Arthur