nanog mailing list archives

Re: Disabling QAZ (was Re: Port 139 scans)


From: Dan Hollis <goemon () sasami anime net>
Date: Fri, 29 Sep 2000 13:14:08 -0700 (PDT)


On Fri, 29 Sep 2000, Mike Lewinski wrote:
"exit" will close the connection but not the QAZ server, while "quit" does
appear to shut it down. You can also "run x". Once QAZ has been shutdown,
it's also possible to connect to the share and manually delete the infected
notepad.exe, although I haven't yet figured out if there's a way to unshare
someone's drives remotely via command line (if I did this, I wouldn't be
able to get back in to clean the infection).

It would be cool if someone would make a tool that would auto-disinfect
users...

-Dan




Current thread: