Printable View
Hi all.
Tomorrow I've got to go to a customer (a company of approximately 20 - 25 users) where a virus outbreak has wreaked havoc on the entire network.
My job is to go in and rescue the poor guys ;-)
They already use Symantec as a virus scanner and I'll bring Stinger to back it up (since Symanct obviously overlooked something)....
But are there any more tools as convenient and trustworthy as Stinger to help clear out this mess?
Any help would be much appreciated.
Symantec Corp addition has about 5 different sigs levels available that range from crappy liveupdate all the way to the most aggresive rapid release. Check to see what happens with a rapid release signature. Go to the site and DL the sigs. This may take care of the issue very quickly.
--TH13
I did not know about this... I figured with the live update you'd be up to date...
Thanks! I'm looking for those rapid release updates right now. I hope I it'll turn out well.
Try to scan in safe mode if possible, as you will have a better chance of getting rid of stuff that runs on startup.
Also you might look at these:
http://www.ewido.net/en/
http://www.emisoft.com/en/software/free/
Remember it might not be a "virus" as such.
:)
To get a handle on unwanted processes :
Starter v. 5 -- Shows you what starts with windows and lets you toggle/delete them.
Hijack This -- Old standby. Displays and disables processes. Can use with a parser like http://hjt.iamnotageek.com/.
Maybe its just me, but you sound a little like you are heading into the deep jungle with not much more than a can of bug spray. Good luck in any case.
Why Use Stinger? it has not been updated since May of this year?
Goto Trend Micro and d/l Sysclean - and you had better get the pattern file as well
And follow nihils advice..
also...unplug the comps from the network if possible. otherwise you are just going to scan a few computers, and then they will be reinfected by the time you get to the last one.
dont use stinger, as undertaker said, its far out of date. and dont just scan for viruses, chances are thats not their only problem.
Well, personally I use AVG Free and Avast!, I like Avast because it will do a boot up scan, so it'll get anything before windows loads it, it will also abort connections on the internet that try to download trojans. And when I run AVG I always do it in safe mode (when I know there are viruses), same with Hijackthis. So I'd probably, Run Avast!, load up hijackthis, take off everything that shouldnt be there, restart in safe mode and run AVG. Seemed to work pretty well in the past.
Thanks for all the quick replies guys.
I've added sysclean AVG and Avast! to my kit.
Both hijackthis and AdAware were already in it to scan for spyware.
Thanks again. It's time to enter the jungle... ;)
Morvai.
Seems hesperus may have inadvertantly pasted the wrong link above.. the prog he mentions should be this one..
http://www.snapfiles.com/get/starter.html
Thanks a lot, all of you!
I used just about every trick you guys gave me and I managed to clear out the entire network.
For your information, the virus turned out to be a combination between WORM.cachecache and W32.Spybot.worm. Apparently the first is a sort of "cover up" for the latter.
In the end the most convenient for me was using the rapid release in combination with the already installed Symantec to scan and detect both. It wouldn't find them without the rapid release sigs, so it saved me quite a hassle.
Furthermore the server (nor any of the pc's btw) could be reached from the network as a result of this virus. In the local policy "access this computer from the network" was cleared and it wasn't possible to add any users or groups (buttons greyed out). I bypassed this eventually by resetting the local policy to the defaults using the following command:
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose
I know it's kinda off topic and you all might already know this, but it took me some time to find this, so I figured it might help somebody in return in the future.
Thanks again.
Morvai.