0
votes
2answers
52 views

Unknown issue taking down client machines, virus or coincidence

I’m sorry if this should be on SuperUser instead of ServerFault. Please ask me to migrate the question instead of flaming. I’ve had 2 windows desktops go down on the network in the space of one ...
-2
votes
2answers
105 views

Conficker Virus Infection: Where did it start? [closed]

I have a network-wide Conficker infestation, and we have been working on starting virus scans on all our servers and workstations. It is being erased one by one, but I was wondering if there is a ...
0
votes
1answer
71 views

Small business server 2011 standard - applications randomly closing for remote desktop users

Small business server 2011 standard - applications randomly closing for remote desktop users I have an issue where when you are connected through remote desktop (doesn't matter whether you have ...
0
votes
1answer
137 views

What is causing ping sweep?

I am spotting ping sweeps on our firewall log originating from our Windows 2003 SP2 x64 server. The traffic shows sequential pings sent to private ranges only. Eg: 192.168.1.1 192.168.1.2 192.168.1.3 ...
3
votes
3answers
138 views

Training High School Students on Security - What harmless “viruses” can I install that they can find?

I'm training some high school students interested in OS security (specifically, Windows Server 2003/2008), and though I've gone over a lot of the "in-theory" stuff, some hands on would be great. ...
2
votes
3answers
326 views

What would you do when a worm infects everything?

Ive always wondered, what can we do if a virus or worm happens to affect the main file server? What if from the file server the clients get infected by said worm/virus? How would you clean it up? ...
0
votes
1answer
59 views

What is the expamapi.dll in windows folder?

I'm getting a virus message related to expamapi.dll in c:\Windows (windows xp). When I used ProcessExplorer, this dll is related to a bunch of processes, which isn't making sense. Some of the ...
1
vote
3answers
155 views

Need help controlling viruses

I've recently noticed an increase of viruses on my systems. We employ CA eTrust 8.1 for antivirus and all users are "Domain Users", and thus should not have access to install any software on their ...
1
vote
1answer
71 views

Files deleted. What could have happened?

I'm having a weird issue today. I was writing and testing out some simple cgi scripts this morning when I realized that I couldn't run them from one of the other computers on the (windows) network. So ...
0
votes
3answers
77 views

Missing NIC and USB devices

Coming into work today, I've found we have a few different computers (different companies/networks/OS versions - all windows based) that are all having the same issue. 1) Network NIC is not able to ...
1
vote
1answer
646 views

Remove eml and HTML:Nimda viruses from my Linux machine

(yes, the title is strange, but read on...) I copied some data from here and there on my linux box and now i find some many eml and HTML:Nimda viruses on my system when i scan it using clamtk. ...
10
votes
5answers
1k views

Prevent execution of Windows executables

Is there any way to tell Windows (XP and above) not to execute files (*.exe files), which are present in drives/folders other than certain folders, that I mention? In short I want executables from ...
7
votes
5answers
19k views

how to find out what created a file?

I have some virus files being randomly created on root of a c: disk of one of my servers. How can I find out what created it? Some 3rd party software maybe?
3
votes
2answers
1k views

How do I repair dhcp service after conficker infection on Windows 2003 Server?

How do I repair dhcp service after conficker infection on Windows 2003 Server? If the server is restarted with DHCP then it keeps attempting to acquire a network address. It seems to work fine if ...
4
votes
5answers
840 views

Conficker: Should steps taken in group policy to secure against virus remain?

We got nailed two weeks ago by Conficker, I ran through the 26 step checklist from Mircrosoft on my own computer, as well as on our domain server. It says near the end to reverse all the changes, but ...