Virus in Boinc Project!

**Major Tom MIB** · #1 04-13-2007, 04:30 PM §

Now the question is where did I get it from or did it really come from a Boinc project

It's on one of my BoincPE machines

I have to leave right now, so all I can do is shut everything down until I return

Virus Encyclopedia

Search the Encyclopedia

Displaying Results for threat
Win32/Gaelicum.A

alias: Win32.Tenga, W32.Licum, W32/Gael
It`s parasitic infector and internet worm.
Virus spreads itself exploiting Buffer Overrun In RPC Interface vulnerability described in Microsoft Security Bulletin MS03-026

.
When the worm is launched, it infects .EXE files on all accessible drives.
Virus also tries to download trojan horse from the internet.
Healing:
Please download Vcleaner

utility.

-------------------------------------------------------------------
VIRUS CLEANER - Virus Removing Utility V0.998 Grisoft, 2007
Build timestamp: Feb 23 2007 11:52:57
-------------------------------------------------------------------
Scanning for 704 viruses and variants.
Scanning active processes...
Memory scan done.
No active viruses found. 10 running processes scanned.
Scanning files on drive C:\...
C:\Boinc\00-11-D8-43-D3-87\BOINC\projects\boinc.gorlaeus.net\classical_5.42_windows_intelx86.exe Virus Win32/Gaelicum.A found. Cleaned OK.
C:\Boinc\00-11-D8-43-D3-87\BOINC\projects\boinc.gorlaeus.net\trajtou-cu111_5.33_windows_intelx86.exe Virus Win32/Gaelicum.A found. Cleaned OK.
C:\Boinc\00-11-D8-43-D3-87\BOINC\projects\boinc.rieselsieve.com\bunzip2.exe Virus Win32/Gaelicum.A found. Cleaned OK.

**Major Tom MIB** · #2 05-28-2007, 02:34 AM §

Again!

Fish · #3 05-28-2007, 11:43 AM §

I'm clean, all six hosts checked this morning.

Fish

Kilika_5200 · #4 05-28-2007, 07:08 PM §

My host are all running riesel w/ AVG, and all of them are clear... From the description of the virus it sounds as though its just an RPC worm - Those usually come from being connected to the internet without a firewall, or they sometimes spread between computers on your LAN

**Major Tom MIB** · #5 05-28-2007, 11:48 PM §

I might try and put them on an isolated segment with a linux box to monitor and provide yet another firewall, but for now, I've detached from Riesel and I'll see if I get reinfected.