0

I am having a bit of a trojan problem. We have a Windows 2003 Server configured with a partition for file sharing for backup purposes. In our network there are about 50+ computers with access to these folders. The problem is that each time the infected computers restart they write a hidden file and an executable (depends on the originator; eg: khw, vfixbi.exe) in each folder it has access network access. I think the hidden file is set with the exact date and time of writing but the executable is randomly dated. I desinfected a few but they keep popping up.

Is there a way to identify witch PC/IP is writing in those folders so i wouldn't have to go about and scan each computer on site/remotely.

Does windows have a built in tool, or can i install a certain software to track them down?

Thank you.

2 Answers 2

0

if you right click on the file, and go to properties, look for the owner of the file. that should tell you what user account created it. Unless everybody uses the same account, that should do the trick.

1
  • Thank you. Didn't cross my mind. I'll give it a try.
    – Crishu
    Sep 20, 2010 at 18:23
0

... I hate to say it... but you really should run AV software on EVERY machine connected to your network. You seem to have been lucky so far and have only run into a virus trying to self-propagate. Unfortunately, there is no way to determine which machine wrote the virus... but like Richard said, you can determine the owner of the file... assuming you require your users to log in using unique usernames. If this is a completely open share with no permissions or everyone is using the same username.... you've just stepped into a big pile of do-do.

Basic security principles should ALWAYS be used. All users connecting to your network should have unique usernames & passwords. And there should be NO shares that are open to the world & writable without a valid user logging in. Antivirus software in a windows environment is a MUST... (and a good idea in a *nix/mac environment too)

4
  • From my knowledge most of them have a free AV installed bee it AVG, Avira or MSE.(Other recomandations? with a corporate license?) They do have a user and password set for login, and to have access to folders from the shared file server they must enter it, but if it was set to 'remember' and the infection occured afterwards? The network is closed to interent access and uses a static IP, except a couple of unrestricted IPs and power users.
    – Crishu
    Sep 20, 2010 at 18:29
  • If you have the $$ to spend... I highly recommend Sophos. It's FAASST and very low footprint. Sometimes it works too well however... It sometimes causes some applications to crash because it will delete the file while the program is trying to write it to disk. Still... you should be able to check the ownership of the file & narrow it down by-user... to where it's coming from.
    – TheCompWiz
    Sep 20, 2010 at 21:11
  • How about Comodo Interent Security? I understand it's EULA also permits free commercial use. The firewall popus will be problem for some of the users but with proper tuning it may be an option.. Thank you for your recommendation; checked the price ~4000$ on a 3y 50 user sub .. sweeet :D
    – Crishu
    Sep 21, 2010 at 5:57
  • He doesn't give enough information to draw those conclusions. @Crishu I'll second sophos, I used it on a small network and loved it, though I liked the central console best. IIRC it was around $50 / machine. Avast is good too. I'm mixed on Comodo, it seems to work better than symantec, but worse than avg/avast/sophos. Sep 21, 2010 at 12:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .