Portable App

Hey all

Yesterday our network got hit very hard by some malware. Panda Corporate didn't spot it and neither did our perimeter defense. Everyone is "trying" to blame someone , blocking Gmail etc.

Now instead of fixing the problem the idiot would rather try and "plug" a hole rather than admit than the AV we have implemented is totally crap.

An AVG PC with an outdated database was able to detect everything on my flash drive.

Anyhow on my workstation AVG is cleaning things up, however there are 2 production servers left which the boss is on my head for.

1st server is running stable at the moment.
2nd server keeps on going into standby mode for some reason, I have checked the power settings etc and everything is fine, I would assume this is malware based. Every 20 seconds it will go into standby and will pause the work/scan at hand.

Any ideas how to clean this in a timely manner?

Thanks

First, don't assume anything. It's not unusual to find concurrent issues
on any given PC, including servers.

Take a good look at the processes and services running on that server.
Google anything that doesn't look familiar. Shaking down a server like
that is a rather more formidable task than doing the same on a desktop.

You might try something like Portable Clamwin to doublecheck for any
viruses. That version is designed to run off a USB stick, but it's easily
copied to a HDD and run from there. It doesn't need a full-blown install
like most AV apps so it's easily installed with a minmum of registry changes.
It's not the greatest AV app, but it does give you a second opinion.

HTH.

I have seen workstations infected with viruses.......and yes...these can infect certain data areas on a server....

But I can still can not understand how a server becomes infected with a virus with out someone using it to read email or surf the world wide web using the all powerful administrator account....which is a nono ...basic security 101

MLF

Quote:

---

Originally Posted by morganlefay

But I can still can not understand how a server becomes infected with a virus with out someone using it to read email or surf the world wide web using the all powerful administrator account....which is a nono ...basic security 101

---

I believe this was already covered :p

Quote:

---

Originally Posted by Cider

Now instead of fixing the problem the idiot would rather try and "plug" a hole rather than admit than the AV we have implemented is totally crap.

---

A chain is only as strong as its weakest link. Same goes for networks, and the programs intended to protect them.


CTO

Quote:

---

I believe this was already covered

---

I must be missing it then????

How did the server become infected???

maybe you can splain it to me....

MLF

Quote:

---

Originally Posted by Cider

Yesterday our network got hit very hard by some malware. Panda Corporate didn't spot it and neither did our perimeter defense. Everyone is "trying" to blame someone , blocking Gmail etc.

Now instead of fixing the problem the idiot would rather try and "plug" a hole rather than admit than the AV we have implemented is totally crap.

An AVG PC with an outdated database was able to detect everything on my flash drive.

---

The server became infected, as Cider believes, because the AV protection they employed was crap and did not do the job..... Much like hiring a night watchman who sleeps on the job - The theives just slip right by.

Why the server became infected, simply is the nature of the www - ?

I think Cider's beef is the fact the id10t would rather apply a fix to the issue, now and give the night watchman a stern talking to - as opposed to replacing them with a more secure, highly thought of product - Trend would be a nice way to go i think.


CTO

What was executed ...with administrator privledges...on a server?? and how?

What was the role of this server??

How did the lack of a AV cause an infection?? It is a reactive approach?

MLF

http://www.malwarebytes.org/

By far THE best scanner....Good Luck!

Hi Cider, long time no talk.....sorry about that............. will explain later.

Quote:

---

Yesterday our network got hit very hard by some malware. Panda Corporate didn't spot it and neither did our perimeter defense. Everyone is "trying" to blame someone , blocking Gmail etc.

---

Hey, welcome to the world of corporate management pal, and the "blame culture".

Quote:

---

Now instead of fixing the problem the idiot would rather try and "plug" a hole rather than admit than the AV we have implemented is totally crap.

---

As I see it, the guy is at least a half right. Hell, you obviously do have a "hole" somewhere in your defences. You need to examine:

1. Your security model and policies.
2. Your processes to implement that model.
3. Your procedures to support those processes.
4. Your software and manual activities support your procedures.
5. Your audit, management and enforcement processes support your policies and its infrastructure.

Security is a layered approach that requires commitment at all levels of an organisation. You cannot buy it off a supermarket shelf like a box of breakfast cereals, and there is no "magic bullet" solution; despite what some vendors would like you to believe. :rolleyes:

You need to look at what attacked you, how it got there, and how it spread. That will tell you where the gaps are. Fix those gaps and then, and only then, can you publicly execute the culprits:lildevil:

Please remember that if you have a home user, or small business security suite, it is largely pre-configured to provide a reasonable level of protection. Corporate solutions, on the other hand are generally pretty useless out of the box, as there is no way the vendor can make reasonable assumptions regarding corporate architectures.

If you accept that; then the problem is more likely to be the way that the system was implemented than the product itself. I am sure that you will appreciate this more if you consider firewalls on there own? If you don't know how to set one up, it is worse than useless, as it lulls you into a false sense of security.

MLF has some good questions.............. what was the malware, and what was the server's role?

Please remember that you have an "enemy within" and if you let them bring external crap into the company, read their private e-mail, attach unauthorised devices, install unauthorised software, visit their Facebook or other crap, trade on e-bay, and on and on and on............... then just make sure that they know that it is an instant dismissal offence and that they sign up (at least once every 3 months) to the fact that they haven't forgotten that.:lildevil:

:)

Hey all,

I havent read all the posts, I will do so and reply to everyones post.

Basically This malware was copying every file in the directory it was in. For instance in the root of C, it would copy every file whether it was a dll, word doc or whatever , it would change it to a .exe. All the files that were created either were 631 kb in size or 218 and were modified on the same day.

Basically I uninstalled our AV and put on AVG protection for file servers. This cleaned up everything and landed up with 2.5k infected files. There were the ones that got duplicated.

This is to answer MLF.

Both our servers are logged on with ADMINISTRATOR at all times. Dont ask my why. I believe it started duplicating files on a share that the marketing department uses and then just spread like wild fire.

You still did not quite cover MLF's questions

Quote:

---

What was executed ...with administrator privledges...on a server?? and how?

What was the role of this server??

How did the lack of a AV cause an infection?? It is a reactive approach?

---

Quote:

---

Both our servers are logged on with ADMINISTRATOR at all times. Dont ask my why. I believe it started duplicating files on a share that the marketing department uses and then just spread like wild fire.

---

There is no problem with leaving a server logged on as administrator, in fact it can prevent a console remote login by another user (although security policies should be preventing this anyway)..... In saying that, if the server is left unattended, the user should lock the computer, requiring to enter the password again to access.

Also, depending on software installed, it may need a user account logged on to work (Read: Application based feed Vs. Installed Service)

Hi there,

Well my issue mainly with the Av on the server is that it did not pick it up.

Will reply fully when I get home.

What is the specific AV Product?

Hey there guys

The specific AV product is Panda for Enterprise. Basically this is a proactive and a reactive product. The malware was not in our signature file however Pandas technologies such as "Truprevent" which is deep code scan for behavior analysis should have picked it up. This is my issue.

EDIT: The servers role is it hosts a number of applications expect our mail.

if a shared directory on a server gets infected...there should be no way it affects the OS of the server unless the user\client that got infected had domain admin privledges...and still domain admin is not server admin.

My point is the server should not have gotten infected if security is set correctly and it is patched.

MLF

MLF that is a very hard point to sell. For what ever reason the AntiVirus vendors have succeeded in scaring the hell out of companies. Even this latest RPC thing lends itself to the need for antivirus software. I still laugh at companies that spend 15k for antivirus licensing.

I haven't ran antivirus on a server (other than exchange) in like 7 years. Been running exchange without AV for the last two years.

Vendors constantly want to speak to "management" when they find this out. "Management" explains that we have experienced zero down time due to virus or malicious software in going on 10 years now.

It probably was a shared directory - yes. There are about 3 of us with domain admin rights.

Can you please explain to me how a shared directory on the server that got infected will not/cannot spread to the rest of data on that particular server? What is stopping a virus from spreading to a non shared folder or files?

Quote:

---

Originally Posted by dinowuff

MLF that is a very hard point to sell. For what ever reason the AntiVirus vendors have succeeded in scaring the hell out of companies. Even this latest RPC thing lends itself to the need for antivirus software. I still laugh at companies that spend 15k for antivirus licensing.

I haven't ran antivirus on a server (other than exchange) in like 7 years. Been running exchange without AV for the last two years.

Vendors constantly want to speak to "management" when they find this out. "Management" explains that we have experienced zero down time due to virus or malicious software in going on 10 years now.

---

Hi there,

I am very intrigued by this comment/s of yours. Please explain to me in detail how the hell you are protecting your company with no AV packages running? Running exchange 2007 I presume. Please explain.

You should really read this.


http://technet.microsoft.com/en-us/l.../cc163140.aspx

I have not had a realtime virus scanner on my server in years.....we do real time scan mail and clients. Absolutley 0 downtime due to a virus in 8 + years. Also our mailserver strips certain attachments.

No one runs as domain administrator on a day to day basis....if admin duties need to be performed ...the domain admin account is used...and then logged off and a relogged in a a domain user.

If a domain administrator account becomes compromised you risk your whole network!

Also...you can restrict access to shared folders through permissions. I am sure say production or sales users dont have access to finance folders or other users folders....or do they???

Quote:

---

Originally Posted by Cider

Hi there,

I am very intrigued by this comment/s of yours. Please explain to me in detail how the hell you are protecting your company with no AV packages running? Running exchange 2007 I presume. Please explain.

---

WOW Now that's a request!:eek:

First off read the link MLF provided.

Second, I use CISCO products not ISA so there is a difference there.

Third MXLogic

Fourth Websense

Now I must say that I only patch things that I allow on my network. I DO NOT RANDOMLY PATCH EVERYTHING THAT COMES DOWN THE PIPE! Make that your #1 rule

I do not allow IMCP in or out of the network unless it's port 25. Which means I can't even do a tracert to you from my workstation (USE DNSSTUFF instead)

I deny all but email traffic. 80 and 8080 are on a seperate vlan Many CiOS rules there.

NO ONE has admin or power user rights. Many AD policies modified so users can still configure their bells and whistles.

If MXLogic is down or unavaliable, I do not recieve any email

If web sense is down NO INTERNET ACCESS for anyone

All end point devices (even remote users) must use MY equipment, and MY gateway. Again AD rules.

No bootable USB devices. Only administrators can boot from CD

Only the one mail server has a gateway. THERE ARE NO INTERNET GATEWAYS on my servers. Servers are locked with a domain account. And in a secure data center.

Layer 3 SNMP traps and mac filtering enterprise wide

The bottom line theroy is do all your scanning - filtering either off the network or on the other side of the gateway.

End point security and layer 3 threats are #1.

Don't allow remote access ssl or rdp to a server unless you are 100% sure security is set correctly. If remote control is not needed, uninstall the service. DO NOT DISABLE uninstall. A service or program cannot be exploited if it is not installed.

Research windows 2008 and M$ Virtual server.


DO NOT INSTALL VISTA ANYWHERE ON YOUR NETWORK

That's just the tip of the ice burg.