Find Those MyDoom Infected Machines on your network...

[hevnsnt]

I have been putting together a small tool that will find & notify those MyDoom infected machines on your network..

If you want to check it out you can here

100% Virus Free

If you are looking for Mydoom.f or netsky read below!
This was posted for mydoom.a, if you are looking for mydoom.f update the batch file to scan for port 1080. Netsky.c cannot be found with this batch.

 

[FoBoT]

is that port scanner (sl.exe) freeware? i could use it for some other stuff at work

neato

 

[hevnsnt]

Originally posted by: FoBoT
is that port scanner (sl.exe) freeware? i could use it for some other stuff at work

neato

Yes, it is ScanLine from Foundstone.com.. It is freeware & a nice fast scanner.

 

[trmiv]

I ran it and it said it found infected machines, but the results just say:

Scan of 254 IPs started at Wed Jan 28 16:50:29 2004

Scan finished at Wed Jan 28 16:50:42 2004


What are the infected machines?

 

[PowerMacG5]

Originally posted by: trmiv
I ran it and it said it found infected machines, but the results just say:

Scan of 254 IPs started at Wed Jan 28 16:50:29 2004

Scan finished at Wed Jan 28 16:50:42 2004


What are the infected machines?

Yeah. It reports that there is an infected machine on my network, when I know there are none (I just ran norton).

 

[hevnsnt]

Infected machines can be found in results.txt

If you hit "No" to the netsend, it will also give you the list.

 

[PowerMacG5]

Originally posted by: hevnsnt
Infected machines can be found in results.txt

If you hit "No" to the netsend, it will also give you the list.

Then why does it say infected machines found, and then there is no list either when I hit n or look in results?

 

[hevnsnt]

crap, you just found a bug..

Anyone know how to pipe the result of grep -c (count) to a dos variable?

like grep -c -E yadayadayada results.txt = %myvariable

 

[FreshPrince]

nonefound != Notfound

 

[hevnsnt]

Originally posted by: FreshPrince
nonefound != Notfound

= bug #2

 

[FreshPrince]

Originally posted by: hevnsnt

Originally posted by: FreshPrince
nonefound != Notfound

= bug #2

I like sl.exe

 

[acemcmac]

valiant effort recognized :beer:

 

[hevnsnt]

Ok, should be fixed now, re-download

Bug 1 Fixed: On those network which no machines are found, it now correctly identifies that
Bug 2 Fixed: nonefound != Notfound

 

[glen]

so, I extract to a folder, then in "run" I type the file path for the scan.bat ?
Like this:
"C:\downloads\MDS-public\scan.bat"???
Then what?

 

[hevnsnt]

Originally posted by: glen
so, I extract to a folder, then in "run" I type the file path for the scan.bat ?
Like this:
"C:\downloads\MDS-public\scan.bat"???
Then what?

No, check out the readme

extract to folder
go to dos & run scan x.x.x.1 (x.x.x. = your subnet)

 

[AndyHui]

Good stuff.

May I suggest removing some of those CLS's. It's nice to see what is happening on the screen and some of the output results.

 

[PowerMacG5]

Nice work on the fixes.

 

[Platypus]

I hate this so much

 

[hevnsnt]

Originally posted by: CorporateRecreation
I hate this so much

??

 

[Platypus]

Originally posted by: hevnsnt

Originally posted by: CorporateRecreation
I hate this so much

??

MyDoom, sorry that made sense in my head, forgot to add that.

 

[GRIFFIN1]

It says I have an infected machine, but there is only one computer and the router running right now. It also didn't save a results.txt file.

 

[hevnsnt]

Originally posted by: GRIFFIN1
It says I have an infected machine, but there is only one computer and the router running right now. It also didn't save a results.txt file.

Did you d/l newest version?

Also I changed the results.txt to results-SUBNET.txt . So results will be saved in results-192.168.1.1.txt for example.

 

[GRIFFIN1]

I just realized that it was user error. I was typing scan 192.168.1.1/254

It worked fine after I read the readme file again.

 

[Ramma2]

I just ran this, and now ALL 91 machines on my network have shut down, and all of my printers are spitting out reams of paper!!!

What have you done!?!




J/K! Nice program, network is clean. Kudos to you!

 

[MacBaine]

MyDoom pwned my email