Week Long Fight

-(Xyphox)- said:
This hole mess started because i plugged a infected drive into my machine to clean. I had Mapped drives back to the server's. The infected spread like wildfire.
I have everything cleaned and reloaded but the server's
Click to expand...

I'm not meaning to rub your face in what happened, but this is a true act of stupidity. Why in the world would you plug a known-infected drive into a computer that's on your work's local network? Especially when said network has mission critical servers on it AND you have their drives mapped locally? I can't believe an IT professional would actually do that. At the very least you should have yanked the network cable from the box until you could see how the system would react. Ideally you should have accessed it from a linux system that can't be infected so you could recover any data and then format the shit out of it.


EDIT: The intention of my post was not just to criticize you, sorry if it sounds that way. I agree that the only safe, reliable, long-term solution is to reload everything. Even if you manage to "clean" the servers and get things looking right, I don't think you can ever trust them again until they are wiped clean. That virus is crazy. You need to have a heart-to-heart with your boss and just hope that you don't get fired. I mean, it is largely your fault, so yeah, your boss is gonna be pissed. But by delaying the inevitable you're just making it worse for the company (lost money and data) and yourself (the longer it takes the more the boss is going to be angry).
 
Eva_Unit_0 said:
I'm not meaning to rub your face in what happened, but this is a true act of stupidity. Why in the world would you plug a known-infected drive into a computer that's on your work's local network? Especially when said network has mission critical servers on it AND you have their drives mapped locally? I can't believe an IT professional would actually do that. At the very least you should have yanked the network cable from the box until you could see how the system would react. Ideally you should have accessed it from a linux system that can't be infected so you could recover any data and then format the shit out of it.


EDIT: The intention of my post was not just to criticize you, sorry if it sounds that way. I agree that the only safe, reliable, long-term solution is to reload everything. Even if you manage to "clean" the servers and get things looking right, I don't think you can ever trust them again until they are wiped clean. That virus is crazy. You need to have a heart-to-heart with your boss and just hope that you don't get fired. I mean, it is largely your fault, so yeah, your boss is gonna be pissed. But by delaying the inevitable you're just making it worse for the company (lost money and data) and yourself (the longer it takes the more the boss is going to be angry).
Click to expand...

If i knew this virus could trendsend like it does, i would have. At the time i had no idea what i was dealing with. Usually most malware does not have the ability to cross over the network like this one does. This virus is one of the most pain in my arse i've ever seen
 
-(Xyphox)- said:
Usually most malware does not have the ability to cross over the network like this one does.
Click to expand...

To be fair- mapped network drives look like they're local... not really "crossing over network".

Also why I don't like Autoplay turned on (I always have it prompt).
 
So how is it going today -(Xyphox)- ?

did you get the shit sorted yet ?
 
Well, this week has been very busy. I had 2 huge networking jobs to do. I got CureIt to run. I also deleted all the .exe installer files, over 1000 of them. CureIt cleaned a lot of files. Going to work on it more tonight
 
/facepalm if it isn't fixed.

It could have all been backed up and formatted by now.
 
It might be a bit late, but you might want to try BartPE to clean stuff up. Make a bootable disk with every AV known to man on it and run them all. Since you won't be booting off infected drives and the CD is read only you can probably get the machines clean enough to make backups. Even once they are clean, I would still format with a silver format command to make sure nothing comes back from the dead.
 
Right well looking at you credentials in your sig tells me I am far from qualified to give you any advice.

However I would love to get my hands on one of your infected drives just so I can plug it in to my PC and watch it propagate it self on my windows system, cause if it really has this ability I could learn a lot watching it in action.. I have dealt with PC's infected with this very same virus and many others and never had one manage to spread to my system just by connecting the drive to my PC. In fact when I pick up a PC from a friend or family member to fix the first thing I do is throw the drive in my PC and scan for infection. I use to have potently infected PC's run Trend Micro's house call but I gave up on that step when I realized I was getting a virus hit every time. So now I just skip that step and put the drive right in to my PC.

If there is some danger in doing this I would love to hear about it, just don't see how a virus could spread from an infected drive with out me running an infected program located on that drive. Been doing it for years and never seen it. I don't have the patience to reed through your logs but like was mentioned above you must be allowing inserted disks to auto run with no prompting for this to be happening.
 
TGA said:
Right well looking at you credentials in your sig tells me I am far from qualified to give you any advice.

However I would love to get my hands on one of your infected drives just so I can plug it in to my PC and watch it propagate it self on my windows system, cause if it really has this ability I could learn a lot watching it in action.. I have dealt with PC's infected with this very same virus and many others and never had one manage to spread to my system just by connecting the drive to my PC. In fact when I pick up a PC from a friend or family member to fix the first thing I do is throw the drive in my PC and scan for infection. I use to have potently infected PC's run Trend Micro's house call but I gave up on that step when I realized I was getting a virus hit every time. So now I just skip that step and put the drive right in to my PC.

If there is some danger in doing this I would love to hear about it, just don't see how a virus could spread from an infected drive with out me running an infected program located on that drive. Been doing it for years and never seen it. I don't have the patience to reed through your logs but like was mentioned above you must be allowing inserted disks to auto run with no prompting for this to be happening.
Click to expand...

You're absolutely right about learning from this sort of thing. It's very interesting to get an understanding of how malware takes over a machine like that.

Simply plugging or mounting a drive to another machine won't allow a virus/malware to propogate to another volume/drive. There has to be some sort of action taken. In this case plugging the flash drive in and allowing the autorun feature to 'run' whatever was on the drive, is what allowed this infection to move elsewhere.
 
defektiv said:
You're absolutely right about learning from this sort of thing. It's very interesting to get an understanding of how malware takes over a machine like that.

Simply plugging or mounting a drive to another machine won't allow a virus/malware to propogate to another volume/drive. There has to be some sort of action taken. In this case plugging the flash drive in and allowing the autorun feature to 'run' whatever was on the drive, is what allowed this infection to move elsewhere.
Click to expand...

Exactly.

If this sucker truly spread on its own (very doubtful) you could make some serious bank on selling the secret to other malware writers...
 
If I recall It runs via autorun, so if you insert anything into a pc like say a flashdrive and it is infected, just having autorun enabled will allow it to propogate, supposedly.
 
TechieSooner said:
Which is user-error.
Click to expand...

i had autorun off on test machines, and it still infected them. This virus is a real nasty SOB. I used the best cure and just formatted everything. Dropped a pile of gas and let it burn. It was the only way i was going to get the virus completely removed from the network.
 
You can still report this virus to any anti virus company and they can add a solution to their future updates.
 
You must log in or register to reply here.
Back
Top