Hello, I recently replaced a network admin after he was fired on hostile terms. Discovered that he had left himself backdoor trojans on three of our servers and has been accessing our network possibly to cause harm. I need to begin logging all activity, block all unnecessary network traffic, and remove these RAT's. Here we have a windows 2000 domain.
Our traffic goes through:
Cisco 1601 Router
Cisco PIX Firewall version 6.3 (5)
I discovered the RAT's on the three servers by using GFI Languard Vulnerability Scan after the previous admin had called another employee here to "brag" about being able to see everything inside the network, and making threatening demands, such as offerring him two weeks pay and a letter of reccomendation to come in for one day to "fix" the network and return to us all the paswords to such things as the norton antivirus system management console, which is locked, and with many exception to the virus scanning. The SQL User id and pass to log on to two of the SQL databases, specifically the one we use for processing our credit card purchases. and the other we use to store all of our company's product pricing information. I really need to be sure he is locked out of our network, and I hope I can do this first by making some changes to the ACL's on our PIX,, this will buy me the time I need to contact Symanted Support , to get into the system management console, so i could remove the exclusions he set up in the scan, I cannot even uninstall the antivirus software from the server as i am prompted for password for that also. I believe the trojans on the other server could also be a password stealer, anyway there are RAT's on each of our three servers and our Norton Corporate verstion 10.0.1.1000 isnt finding. Please help with any suggestions on where to begin adressing this serious threat, including blocking the traffic first, then also to finding and removing the RAT's and any other malicious software. Im sending out the call to our community for help here ! I'm being held hostage in my own network here, and our information is at serious risk, and if he were to cause any harm, it will be expected of me to provide evidence so that we may prosecute him. I have been on this network for only 3 days now,, there is no documentation, I have already reset the passwords / enable passwords on the router, and the PIX firewall both. Being that it is Memorial Day weekend, also I have been unable to get a hold of any of my old classmates and friends that might be able to help me,, so i have come here to the experts exchange to draw upon our collective infinite wisdom. Any help and suggestions will be most welcome thank you !!
