iv been at it for over a week now.trying to get w32.goabot and its variants
off the network. network is 3 servers, 35 workstations, unknown amount wireless laptops. im running NAV. and Fprot. i have operating sys nt4, 98, me, w2k, xp.. servers are nt4, linux, w2k.
the file it has created is wmon32.exe or wmon23.exe.
ive deleted all in registry and in windows dir.
the effects are at any givin time all the printers will empty thier trays printing garbage (a shockwave file between 125k to 135k)
under system32/spool/printers ill find 25 000 till 100 000 files in que to be printed !!!!
my final act to stop the hack was to disconnect the dsl from the network..!
