sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-05 09:18:06 +03:00
Code
5129c40c83
samba-mirror/docs
History
Jelmer Vernooij 5129c40c83 Split up faq in smaller files
0001-01-01 00:00:00 +00:00
..
docbook Split up faq in smaller files 0001-01-01 00:00:00 +00:00
faq Add generated files for FAQ 0001-01-01 00:00:00 +00:00
htmldocs Fix links in html versions of manpages 0001-01-01 00:00:00 +00:00
manpages fix typos in net.8.sgml so it will compile and 0001-01-01 00:00:00 +00:00
OID fixes from 2,2 0001-01-01 00:00:00 +00:00
Registry Merge from 2.2 0001-01-01 00:00:00 +00:00
textdocs Convert ADS-HOWTO to SGML and add it to the howto collection 0001-01-01 00:00:00 +00:00
announce merge from 2.2 0001-01-01 00:00:00 +00:00
history yet another person asked me where the name Samba came from, so I put 0001-01-01 00:00:00 +00:00
README.ldap merge from 2.2 0001-01-01 00:00:00 +00:00
README.Win32-Viruses Apply Vance Lankhaars' cifs2002 documentation patch - mostly grammar and 0001-01-01 00:00:00 +00:00
Samba-Developers-Guide.pdf fixing typos spotted by eagle-eye-vance 0001-01-01 00:00:00 +00:00
Samba-HOWTO-Collection.pdf fixing typos spotted by eagle-eye-vance 0001-01-01 00:00:00 +00:00
THANKS global change from samba.anu.edu.au to samba.org 0001-01-01 00:00:00 +00:00

README.Win32-Viruses 

While this article is specific to the Nimda worm, 
the information can be applied to preventing the spread
of many Win32 viruses.  Thanks to the Samba Users Group of Japan
(SUGJ) for this article.
===============================================================================
Steps against Nimba Worm for Samba

Author: HASEGAWA Yosuke
Translator: TAKAHASHI Motonobu <monyo@samba.gr.jp>

The information in this article applies to
    Samba 2.0.x
    Samba 2.2.x
    Windows 95/98/Me/NT/2000

SYMPTOMS
  This article describes measures against Nimba Worm for Samba
  server.

DESCRIPTION
  Nimba Worm is infected through shared disks on a network, as well as through
  Microsoft IIS, Internet Explorer and mailer of Outlook series.

  At this time, the worm copies itself by the name *.nws and *.eml on
  the shared disk, moreover, by the name of Riched20.dll in the folder
  where *.doc file is included.

  To prevent infection through the shared disk offered by Samba, set
  up as follows:

-----
[global]
  ...
  # This can break Administration installations of Office2k.
  # in that case, don't veto the riched20.dll
  veto files = /*.eml/*.nws/riched20.dll/
-----

  By setting the "veto files" parameter, matched files on the Samba
  server are completely hidden from the clients and making it impossible
  to access them at all.

  In addition to it, the following setting is also pointed out by the
  samba-jp:09448 thread: when the
  "readme.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}" file exists on
  a Samba server, it is visible only as "readme.txt" and dangerous
  code may be executed if this file is double-clicked.

  Setting the following,
-----
  veto files = /*.{*}/
-----
  any files having CLSID in its file extension will be inaccessible from any
  clients.

This technical article is created based on the discussion of
samba-jp:09448 and samba-jp:10900 threads.