Tag Info

Hot answers tagged

33

You don't "clean malware". You level the machines and start over. Anything less is a disservice to your Customer and asking for trouble. As far as dealing with the "threat", you don't allow users to run with Administrator-level accounts (on Windows), and you don't install untrusted software (inasmuch as is possible). It seems fairly simple to me. My ...


18

These are my general suggestions for this kind of process. I appreciate you'll have covered some of them already but its better to be told something twice than miss something important. These notes are orientated towards malware that's spreading on a LAN but could easily be scaled back to deal with more minor infections. Stopping the rot, and finding the ...


12

It is possible to do that by appending the existing alias onto the malicious one and using cursor movement to hide it if the alias command is used to display alias definitions. It's not a perfectly foolproof method, but it might go undetected for a while. Piping alias through hd will show you whether there are any escape sequences (cursor movement) in your ...


10

The reason malware likes to execute from these locations is because legitimate software likes to execute from these locations. They're areas that the user's account should expect to have some level of access to. Based on a quick grep of my own system and a random end-user account on our network: %appdata% Right now, I've got Dropbox, the installer for ...


9

AFAIK, there isn't a package than answers to all your requirements. Best Open Source AV package i know is ClamAV, and it doesn't have much, if any reporting and remote control/installation, and no centralized management. You can circumvent these problems by developing a scripted management and RIS environment. Shouldn't be too hard assuming you already ...


9

Normally I'd use Sysinternals tools like tcpview and procmon to see if there were any odd programs or activity on the system. Nothing strange in the logfiles? It's also possible that your network card or network card driver is wonky and may need to be replaced or reinstalled. Is this happening regardless of who's logged in? If the machine is first ...


9

You remove their admin rights. If they don't know what they're doing, they shouldn't have admin rights anyway, and there is no way to stop an administrative (or root) account from doing whatever they want on the machine. That is the nature (and indeed, the point) of root/admin.


9

If you suspect a rootkit, don't waste time trying to find it. Wipe and reinstall the system.


8

Once it's created a process on your server I would consider it as good as hacked. Time to reload or restore. Make sure updates are all setup and lock it down.


8

Microsoft's Malicious Software Removal Tool is a free tool for Windows XP and Vista (and probably Windows 7) which scans computers and removes specific malicious software. It is automatically updated on the second tuesday of every month via Windows Update. You can find it in the in the 'C:\Windows\System32' folder, its name is mrt.exe. If you don't find ...


6

Beyond the sysadmin practices of not letting users run administrator level accounts and such, a lot of the responsibility falls on you to remain up to date on threats in the wild. Read the warnings that popup when a new threat is found. Have an update policy for your software. Nothing can destroy security faster than a determined user, so educate them ...


6

Disabling Javascript within Reader will help a bit. Also, enable the "Enhanced Security" feature (it is on by default in Reader 9.3 and 8.2).


6

We were happy users of Symantec Anti Virus Corp for years, that is until Endpoint Protection came along. Slowed our computers down so that they were largely unusable. These were computers that ran SAV just fine. So about a year ago, we migrated our machines to ESET and their NOD32 product. While the management console can be kind of daunting, we've been ...


6

If you want to get into semantics (no pun intended) viruses are a subset of malware in the sense that they are (typically) malicious. What makes them stand out is that they spread themselves. Aside from that, technically there is no differentiation. Malware is malware in the sense that anything can be written to do whatever malicious activity the writer ...


6

Wipe the drive. Reinstall from known-good backup. There are plenty of ways you can miss something that's installed and hidden on a server that's been rooted. Unless you had hashes of all your files/binaries, you can't even tell if you're running the correct applications on your server. For all you know you're running altered system binaries that are ...


6

You don't really make mention of the current setup in terms of what access the subnet the kids are on has via the default gateway to your workplace subnet: I'll assume that you did not define any explicit denies. 1.) I would check to see if any of your work IP addresses are blacklisted. I don't know if you host your own mail server or not, but if you do and ...


6

You can use the EICAR virus. It can be used for testing anti-virus software and students.


6

You've done all the things I would do (if I were still a Windows admin) -- The canonical steps are (or were, last time I was a Windows guy): Isolate the affected machines. Update anti-virus definitions Run AV/Malware/etc. scans on the whole network Blow away the affected machines (completely wipe the suckers out) and reinstall. Restore user data from ...


5

You could setup another PC with Linux/BSD on it that is only used for accessing the bank web site. If you really wanted to get paranoid you could put it on its own dedicated Internet connection and not have anything else connected to it on the regular network. Gives you the benefits similar to dual boot while still keeping the Windows PC available for ...


5

As far as "malware training" goes, the name alone is a bit too marketing-buzzword to inspire much faith. Perhaps I'm too much of a skeptic, but I feel that any specific "malware topics" are going to be obsolete before the class is in session. Sure, some basic skills apply, but if an admin (or support tech) doesn't already know those things, I'd rather they ...


5

For this type of situation I would go one of two ways: For those that do alot of tinkering with different programs, install VMWare workstation and have a repository of base VMs they can pull off the network and start up as needed. This second one is a little more expensive, but I would go with something like VMWare ESX + Virtual Center* so that you can ...


5

Call your hosting company, tell them your site's been compromised. They probably have standard procedures, but it boils down to delete everything and restore it from backup.


5

Seems that your machine (173.162.7.130) is accepting connections on port 25 and seems to have NO filters so it could easily be and open relay, here is a telnet session i just tried: -> [~]$ telnet 173.162.7.130 25 Trying 173.162.7.130... Connected to 173.162.7.130. Escape character is '^]'. 220 smtp4dev ready helo test 250 Nice to meet you mail from: ...


5

I tend to find a Windows installation CD to be the best tool for removing malware. Backup the system. Format the system. Reinstall the system. Restore the backup. Fixes them EVERY time.


5

What are you going to report? Do you know who did it? If it's typical of other attacks, you had a hole that was exploited (wordpress, SQL injection, ...) by any of the thousands of script kiddies out there. Most providers don't care in that there's no practical way to arrest anyone for it. Your best bet is to get it restored from a backup from before the ...


5

You're not thinking about the problem in the right way; you are trying to apply a solution for Microsoft desktop installations to a Linux server. Square peg, round hole. Linux is not immune from malware - but different strategies are far more effective. My preference would be a big-name commercially-supported one So presumably you haven't read any of ...


5

Rootkit Revealer is not support and does not run on 64-bit Operating Systems. The fact that Rootkit Revealer fails to run on a windows 7 x64 system tells you nothing. It was never written to support 64 bit and is no longer being developed. Last version was published in 2006-ish? I believe. Notes on the download page state: It runs on Windows XP ...


5

Spam messages in the postfix message queue could mean a number of things: Your mail server is acting as an open relay. An open relay means that your server is accepting messages from any client on the Internet, and relaying them onward. Open Relays are quickly picked-up by spammers and quickly blacklisted. To see if your mail server is acting as an open ...


5

Pros: Malware attempting to execute from those locations will be unable to run. Cons: Legitimate programs attempting to execute from those locations will be unable to run. As to what legitimate programs you have in your environment that need execution rights in those directories, only you can say, but I see RobM just posted an answer with a high-level ...



Only top voted, non community-wiki answers of a minimum length are eligible