Tag Info

Hot answers tagged

33

You don't "clean malware". You level the machines and start over. Anything less is a disservice to your Customer and asking for trouble. As far as dealing with the "threat", you don't allow users to run with Administrator-level accounts (on Windows), and you don't install untrusted software (inasmuch as is possible). It seems fairly simple to me. My ...


17

These are my general suggestions for this kind of process. I appreciate you'll have covered some of them already but its better to be told something twice than miss something important. These notes are orientated towards malware that's spreading on a LAN but could easily be scaled back to deal with more minor infections. Stopping the rot, and finding the ...


11

It is possible to do that by appending the existing alias onto the malicious one and using cursor movement to hide it if the alias command is used to display alias definitions. It's not a perfectly foolproof method, but it might go undetected for a while. Piping alias through hd will show you whether there are any escape sequences (cursor movement) in your ...


10

The reason malware likes to execute from these locations is because legitimate software likes to execute from these locations. They're areas that the user's account should expect to have some level of access to. Based on a quick grep of my own system and a random end-user account on our network: %appdata% Right now, I've got Dropbox, the installer for ...


9

You remove their admin rights. If they don't know what they're doing, they shouldn't have admin rights anyway, and there is no way to stop an administrative (or root) account from doing whatever they want on the machine. That is the nature (and indeed, the point) of root/admin.


9

If you suspect a rootkit, don't waste time trying to find it. Wipe and reinstall the system.


9

Normally I'd use Sysinternals tools like tcpview and procmon to see if there were any odd programs or activity on the system. Nothing strange in the logfiles? It's also possible that your network card or network card driver is wonky and may need to be replaced or reinstalled. Is this happening regardless of who's logged in? If the machine is first ...


9

AFAIK, there isn't a package than answers to all your requirements. Best Open Source AV package i know is ClamAV, and it doesn't have much, if any reporting and remote control/installation, and no centralized management. You can circumvent these problems by developing a scripted management and RIS environment. Shouldn't be too hard assuming you already ...


8

Microsoft's Malicious Software Removal Tool is a free tool for Windows XP and Vista (and probably Windows 7) which scans computers and removes specific malicious software. It is automatically updated on the second tuesday of every month via Windows Update. You can find it in the in the 'C:\Windows\System32' folder, its name is mrt.exe. If you don't find ...


8

Once it's created a process on your server I would consider it as good as hacked. Time to reload or restore. Make sure updates are all setup and lock it down.


6

Beyond the sysadmin practices of not letting users run administrator level accounts and such, a lot of the responsibility falls on you to remain up to date on threats in the wild. Read the warnings that popup when a new threat is found. Have an update policy for your software. Nothing can destroy security faster than a determined user, so educate them ...


6

Disabling Javascript within Reader will help a bit. Also, enable the "Enhanced Security" feature (it is on by default in Reader 9.3 and 8.2).


6

We were happy users of Symantec Anti Virus Corp for years, that is until Endpoint Protection came along. Slowed our computers down so that they were largely unusable. These were computers that ran SAV just fine. So about a year ago, we migrated our machines to ESET and their NOD32 product. While the management console can be kind of daunting, we've been ...


6

If you want to get into semantics (no pun intended) viruses are a subset of malware in the sense that they are (typically) malicious. What makes them stand out is that they spread themselves. Aside from that, technically there is no differentiation. Malware is malware in the sense that anything can be written to do whatever malicious activity the writer ...


6

You've done all the things I would do (if I were still a Windows admin) -- The canonical steps are (or were, last time I was a Windows guy): Isolate the affected machines. Update anti-virus definitions Run AV/Malware/etc. scans on the whole network Blow away the affected machines (completely wipe the suckers out) and reinstall. Restore user data from ...


6

Wipe the drive. Reinstall from known-good backup. There are plenty of ways you can miss something that's installed and hidden on a server that's been rooted. Unless you had hashes of all your files/binaries, you can't even tell if you're running the correct applications on your server. For all you know you're running altered system binaries that are ...


6

You don't really make mention of the current setup in terms of what access the subnet the kids are on has via the default gateway to your workplace subnet: I'll assume that you did not define any explicit denies. 1.) I would check to see if any of your work IP addresses are blacklisted. I don't know if you host your own mail server or not, but if you do and ...


6

You can use the EICAR virus. It can be used for testing anti-virus software and students.


5

I tend to find a Windows installation CD to be the best tool for removing malware. Backup the system. Format the system. Reinstall the system. Restore the backup. Fixes them EVERY time.


5

Call your hosting company, tell them your site's been compromised. They probably have standard procedures, but it boils down to delete everything and restore it from backup.


5

Seems that your machine (173.162.7.130) is accepting connections on port 25 and seems to have NO filters so it could easily be and open relay, here is a telnet session i just tried: -> [~]$ telnet 173.162.7.130 25 Trying 173.162.7.130... Connected to 173.162.7.130. Escape character is '^]'. 220 smtp4dev ready helo test 250 Nice to meet you mail from: ...


5

What are you going to report? Do you know who did it? If it's typical of other attacks, you had a hole that was exploited (wordpress, SQL injection, ...) by any of the thousands of script kiddies out there. Most providers don't care in that there's no practical way to arrest anyone for it. Your best bet is to get it restored from a backup from before the ...


5

Rootkit Revealer is not support and does not run on 64-bit Operating Systems. The fact that Rootkit Revealer fails to run on a windows 7 x64 system tells you nothing. It was never written to support 64 bit and is no longer being developed. Last version was published in 2006-ish? I believe. Notes on the download page state: It runs on Windows XP ...


5

Pros: Malware attempting to execute from those locations will be unable to run. Cons: Legitimate programs attempting to execute from those locations will be unable to run. As to what legitimate programs you have in your environment that need execution rights in those directories, only you can say, but I see RobM just posted an answer with a high-level ...


5

For this type of situation I would go one of two ways: For those that do alot of tinkering with different programs, install VMWare workstation and have a repository of base VMs they can pull off the network and start up as needed. This second one is a little more expensive, but I would go with something like VMWare ESX + Virtual Center* so that you can ...


5

As far as "malware training" goes, the name alone is a bit too marketing-buzzword to inspire much faith. Perhaps I'm too much of a skeptic, but I feel that any specific "malware topics" are going to be obsolete before the class is in session. Sure, some basic skills apply, but if an admin (or support tech) doesn't already know those things, I'd rather they ...


5

You could setup another PC with Linux/BSD on it that is only used for accessing the bank web site. If you really wanted to get paranoid you could put it on its own dedicated Internet connection and not have anything else connected to it on the regular network. Gives you the benefits similar to dual boot while still keeping the Windows PC available for ...


4

As with all things a risk based approach is going to be best, and the degree to which you take this is going to be based on your budget, risk, time, and the potential damage of a breach. I certainly don't expect you to do everything here. Here are some of the attack vectors: Physical attacks Types of attacks Theft Offline Attacks Hardware Key loggers ...



Only top voted, non community-wiki answers of a minimum length are eligible