NT Autostart Mac Worm Vulnerability

Bugtraq ID:	216
Class:	Unknown
CVE:
Remote:	No
Local:	Unknown
Published:	Feb 01 1999 12:00AM
Updated:	Feb 01 1999 12:00AM
Credit:	This vulnerability was posted to NTBugtraq by Rui Pedro Patricio Cabrita Martins.
Vulnerable:	Microsoft Windows NT 4.0 SP3 + Microsoft Windows NT Enterprise Server 4.0 SP3 + Microsoft Windows NT Enterprise Server 4.0 SP3 + Microsoft Windows NT Server 4.0 SP3 + Microsoft Windows NT Server 4.0 SP3 + Microsoft Windows NT Terminal Server 4.0 SP3 + Microsoft Windows NT Terminal Server 4.0 SP3 + Microsoft Windows NT Workstation 4.0 SP3 + Microsoft Windows NT Workstation 4.0 SP3 Microsoft Windows NT 4.0 SP1 + Microsoft Windows NT Enterprise Server 4.0 SP1 + Microsoft Windows NT Enterprise Server 4.0 SP1 + Microsoft Windows NT Server 4.0 SP1 + Microsoft Windows NT Server 4.0 SP1 + Microsoft Windows NT Terminal Server 4.0 SP1 + Microsoft Windows NT Terminal Server 4.0 SP1 + Microsoft Windows NT Workstation 4.0 SP1 + Microsoft Windows NT Workstation 4.0 SP1 Microsoft Windows NT 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Enterprise Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Terminal Server 4.0 + Microsoft Windows NT Workstation 4.0 + Microsoft Windows NT Workstation 4.0
Not Vulnerable:

NT Autostart Mac Worm Vulnerability

A MacOS worm "Autostart" is able to install itself on NT Server based Mac Volumes. The worm is not identified by Intel-based antivirus packages. The worm is identified by a file "deldb" on the Mac Volume root.

NT Autostart Mac Worm Vulnerability

see discussion

NT Autostart Mac Worm Vulnerability

Solution:
The file "deldb" may be safely deleted.

NT Autostart Mac Worm Vulnerability

References: