256 reputation
414
bio website
location Rochester, NY
age 28
visits member for 3 years, 9 months
seen Mar 30 '12 at 18:08

Please wash hands before returning to libc.


Sep
24
awarded  Autobiographer
Jul
2
awarded  Curious
Jan
14
awarded  Notable Question
Oct
10
awarded  Notable Question
Jul
29
awarded  Notable Question
Jan
6
awarded  Nice Question
Nov
28
awarded  Popular Question
Sep
19
awarded  Popular Question
Aug
29
awarded  Popular Question
Aug
23
awarded  Popular Question
Feb
21
awarded  Yearling
Dec
12
accepted How do I deal with the removal/eradication of an unknown worm on our network?
Dec
12
comment How do I deal with the removal/eradication of an unknown worm on our network?
I'm not sure, but it may have been a combination of both. Either way I'm here to try and fix it, and I have support so we have already invested in some new hardware. At any rate I've removed the bad systems from the network, although I can't take the old server down. From what I can tell nothing odd has been happening, so I am just going to have to continue to follow the advice given here.
Dec
10
comment How do I deal with the removal/eradication of an unknown worm on our network?
Yea, there are actually even more problems with this setup. You'll probably laugh when I say that an old ass Netgear home wireless router was being used as a gateway, for the entire network.
Dec
10
comment How do I deal with the removal/eradication of an unknown worm on our network?
Well, fortunately I'm not the one deserving to be killed, he already left. I'm just here to pick up the pieces.
Dec
9
comment How do I deal with the removal/eradication of an unknown worm on our network?
Well, to that point I'm actually in the process of building a replacement Linux server. Unfortunately, it has already been connected to this 'tainted' network, but it hasn't really been used. I've been working with it my self, and using it's services. I'm just going to continue and remove the bad apples, update security on the old server as much as possible and hope for the best.
Dec
9
comment How do I deal with the removal/eradication of an unknown worm on our network?
Yes, its a domain controller, email server, the whole 9 yards. For better or worse.
Dec
9
comment How do I deal with the removal/eradication of an unknown worm on our network?
I figured this was the case. My problem is that I still haven't been able to finger exactly what is happening, and I just want to make sure that our server and network shares our clean. At least to the best I can. Just FYI I inherited this project and am sort of cleaning up after the absence of an admin for a long time...
Dec
9
comment How do I deal with the removal/eradication of an unknown worm on our network?
@MarkM it is indeed accessible from the internet. The following ports were opened: SMTP, HTTPS, PPTP, HTTP, OpenVPN (1194), IMAP-SSL (993), Apache (7902), Sharepoint SSL (7983), Sharepoint intranet (444), Remote Web Workplace (4125), SSH (22), Apache (8080). Note the OpenVPN, SSH, and Apache(8080) ports are forwarded directly to a Linux machine.
Dec
9
revised How do I deal with the removal/eradication of an unknown worm on our network?
added 395 characters in body