Posted by Grant Foraker on February 21, 2007 at 12:04:50:
Customer calls. "Two workstations are broken". Not even close :)
Get to their office and take a look at the first workstation. Everything looks fine except for a message box about "can't contact a web site for a screen saver". Closed that and started Comet from the desktop icon. Up pops the "screen saver" message. Checked the icon properties and it's normal. At the server, I checked the Comet folder and Comet.exe did not show the Comet icon. And, the date was 8:43AM that morning. One of the users, probably a Win98 user (mapped drive), apparently was suckered into trying a "free" screen saver. Somehow, their Comet.exe was overwritten with this malware version. I reinstalled CometWorkstation to get the users going. Last night's full server virus scan came up virus free.