Oh the wonder and horrors of doing I.T. work at a school.

[High_Jumbllama]

Basically, the school goes from Kindergarten to 8th grade. They just finished a new middle school. Which got around 90 machines. That was one heck of a chore.

#1 irritant. Power surges that managed to fry eight VCRs but none of the other equipment.

#2 irritant. Office insisting that I was using the wrong CD until I installed Microsoft Installer.

#3 irritant. Klez. Took me nearly a month to find the main culprit which was the librarian's computer attempting to infect everyone else. There was over 1200 copies on a FreeBSD box. I busted out laughing at that one.

The real problem.

Several dozen copies of an unknown worm/trojan have been appearing on the NT Server. It appears in the D:\Winnt directory with a name something like ap0.rar or ap12.exe using .rar, .exe, .bat and some other extensions. Anyone know what this is. Neither myself or the guy who is the actuall admin are dumb enough to activate any of these files, but how do we block them or at least, does anyone know what virus this is as Norton does not.

[RichL]

Google thinks AP12.exe is part of the MediaVision sound card drivers.

[High_Jumbllama]

If that were the only problem, I would not worry but dozens of files will reappear over a period of 3 or 4 days. Including .bat files.

See example text here from an executable not evn on the same machine.

Í!¸LÍ!This program cannot be run in DOS mode. $

This is similar to what appears inside the .bat files that are appearing on the server. I copied that text from my machine at home that has never seen the file. .bat files should never have this.

[RichL]

Put together a PC you dont mind flatlining and rebuilding later, stick the 'suspect' files on and run them to see what happens.

[High_Jumbllama]

Sounds like a good idea when we get the time. I'm going to try patching and securing the server in the meantime. It could use a good checking over. That may block the infection.

The guy in charge is run around constantly between two schools and has not had time to properly secure anything plus moving the server into the Middle school and setting up 81 of the 90 some machines from scratch. Imagine try to patch Office for some Pentium MMX machines. It's a very slow process though it works well enough when done. Most machines are PIIIs or Celerons from 733mhz to 1.2 ghz though.

I might try emailing the file to a machine with fully patched Outlook and a fully updated Norton. I happened upon a message board posting about someone's Norton blocking it as a Trojan when it came in as an email. I'll need to isolate it though if possible. I'll send the account multiple emails so Outlook won't display the infected one by default. Norton should catch it theoretically as an unknown Trojan. I should then be able to send it to Symantec and hopefully they'll come up with something more precise.

[K6-III]

Try using AVG Antivirus and see if it picks it up (free proggy)...

[az]

Yeah, or go to www.free-av.de and get AntiVir for free and try that.

AZ

[High_Jumbllama]

I tried to install Antivir and got it installed but no further. My German is limited to two or three words and some unflattering phrases. I'll try AVG.

[K6-III]

...and if that doesn't work, try the trial version of F-Prot...

[Drizzt]

That is the usual behaviour of Klex viruz.

[High_Jumbllama]

It isn't Klez. Klez infects through emails and unprotected network shares. The d:\winnt directory is not shared out even from the D drive and Norton does not detect it and nor does it's specialized removal tool. I wish you were right Drizzt, but this seems to be some unkown form or something alltogether different. It does look like it came out of some cookie cutter program though.

[Paddy]

If you get desperate you can send it to my spare box. It has NAV 2003 on it.

dont.spam@ntlworld.com

It is highly filtered.