mirror of
https://github.com/samba-team/samba.git
synced 2025-01-12 09:18:10 +03:00
57 lines
1.7 KiB
Plaintext
57 lines
1.7 KiB
Plaintext
|
While this article is specific to the recent Nimda worm,
|
|||
|
|
the information can be applied to preventing the spread
|
|||
|
|
of many Win32 viruses. Thanks to the Samba Users Group of Japan
|
|||
|
|
(SUGJ) for this article.
|
|||
|
|
===============================================================================
|
|||
|
|
Steps againt Nimba Worm for Samba
|
|||
|
|
|
|||
|
|
Author: HASEGAWA Yosuke
|
|||
|
|
Translator: TAKAHASHI Motonobu <monyo@samba.gr.jp>
|
|||
|
|
|
|||
|
|
The information in this article applies to
|
|||
|
|
Samba 2.0.x
|
|||
|
|
Samba 2.2.x
|
|||
|
|
Windows 95/98/Me/NT/2000
|
|||
|
|
|
|||
|
|
SYMPTOMS
|
|||
|
|
This article has described the measure against Nimba Worm for Samba
|
|||
|
|
server.
|
|||
|
|
|
|||
|
|
DESCRIPTION
|
|||
|
|
Nimba Worm is infected through the shared disk on a network besides
|
|||
|
|
Microsoft IIS, Internet Explorer and mailer of Outlook series.
|
|||
|
|
|
|||
|
|
At this time, the worm copies itself by the name *.nws and *.eml on
|
|||
|
|
the shared disk, moreover, by the name of Riched20.dll in the folder
|
|||
|
|
where *.doc file is included.
|
|||
|
|
|
|||
|
|
To prevent infection through the shared disk offered by Samba, set
|
|||
|
|
up as follows:
|
|||
|
|
|
|||
|
|
-----
|
|||
|
|
[global]
|
|||
|
|
...
|
|||
|
|
veto files = /*.eml/*.nws/riched20.dll/
|
|||
|
|
-----
|
|||
|
|
|
|||
|
|
Setting up "veto files" parameter, the matched files on the Samba
|
|||
|
|
server are completely hidden from the clients and become impossible
|
|||
|
|
to access them at all.
|
|||
|
|
|
|||
|
|
In addition to it, the following setting are also pointed out by the
|
|||
|
|
samba-jp:09448 thread: when the
|
|||
|
|
"(Jreadme.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}"(B file exists on
|
|||
|
|
a Samba server, it is visible only with "readme.txt" and a dangerous
|
|||
|
|
code may be performed when this file is double-clicked.
|
|||
|
|
|
|||
|
|
Setting the following,
|
|||
|
|
-----
|
|||
|
|
veto files = /*.{*}/
|
|||
|
|
-----
|
|||
|
|
no files having CLSID in its file extension can be accessed from any
|
|||
|
|
clients.
|
|||
|
|
|
|||
|
|
This technical article is created based on the discussion of
|
|||
|
|
samba-jp:09448 and samba-jp:10900 threads.
|
|||
|
|
|