Novell Home

Remove, Clean, and Protect yourself against Nachi Virus

Novell Cool Solutions: Tip
By Steven McKibben

Digg This - Slashdot This

Posted: 4 Mar 2004
 

This particular virus may have come and gone, but there is much to be learned from seeing how Steven approached the creation of an app object to combat it. This should work for other updates as well.

I created an application object that runs a scan for Nachi, cleans, then runs Microsoft's Security Patch to protect against re-infection.

I used the nachicli.com downloaded from http://www.sophos.com/support/ along with the following batch file:

--- Start of Batch ---
ECHO off
REM **************************************************
REM *                                                *
REM *    NACHI Removal and Protection Batch File     *
REM *                                                *
REM *  Written and Tested By: Steven McKibben,CNE   *
REM *                                                *
REM *             October 31st 2003                  *
REM *                                                *
REM **************************************************
CLS
echo Your System is being checked for the NACHI virus.
echo Please Waiting While This Process Runs.
:return
if exist u:\verify.txt goto proceed else goto return
:proceed
u:
cd\
cd prod
cd microsoft
cd "MS Patches"
cd KB823980
cd update
nachicli.com -noc
update -q -z
z:\map del u:
echo.
echo.
--- end of batch ---

Since the Application object is doing the drive mapping I had to put a Wait loop until the U:\ drive is available. Since the Application run finishes prior to the batch files I had to manually remove the drive mapping at the end of the batch.

I used the update.exe provided by Microsoft to install the security patch quietly and without a reboot (-q -z respectively).

Just place all the files in the same directory and change the drive mapping to your location.

Detect, Clean, Protect in one easy batch.

PS: I had to create a mapped drive since batch files do not like UNC's.

This should work with other updates as well.

If you have any questions you may contact Steven at steven.mckibben@dfcufinancial.com


Novell Cool Solutions (corporate web communities) are produced by WebWise Solutions. www.webwiseone.com

© 2014 Novell