Hi all,
I have an interesting problem which I'm sure theres something simple both myself and our server support team are overlooking.
We have malware being dropped in visable network shares on a server (Well more make that 2 servers).
We have identified the people concerned and are in the process of kicking their arses off the network totally and also didabling their ability to logon at all (Just in case they ignore us).
I "thought" I had found how they are doing it, as the drive being infected had the local machine group Users with modify access, BUT the Domain Users group was a part of the local users group.
So everyone on the domain had modify access to the affected drive and it's shares (NOT admin shares).
To add to the woes, both Macfee and Compater Associates said their current sigantures did not detect this new variant (fixed not with new signature updates).
This server is a lights out box and no-one logs on interactively.
So to cut a long story short After removing the domain/Domain Users account from the local machine\Users account I thought all was good. NOT correct.
They came back and only with specifying an explicit DENY access rule for domain/Domain Users on a file level did it finally get rejected.
This machine seems to be accepting anyone access to the shares on one drive.
File level security on said drive is SYSTEM - Full Control, Local machine/Administrators - Full Control, Local Machine/Users Modify. There is one domain level group that is a part of the administrators and I'll enumerate who's a part of that on Monday.
HOWEVER as a gotchca, I'm a part of a domain this server knows nothing about, no trust relationship, it doesn't even see it, BUT with my domain logon I still have the full modify access.
I think I've checked the normals (file level everybody access, anonmous access etc) with nothing sticking out, IIS is not installed on this box (It's a file server and thats all).
What have I forgotten that it allows someone from an unknown and untrusted domain full modify access to the visable shares?
(Hidden/admin shares are unaffected)
Cheers,
Terry
