	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

5.5

New Virus/Malware ...

Asked by TBK-Consulting in Anti-Virus, Windows 2003 Server, SBS Small Business Server, Microsoft Server

Tags: Windows, Virus

I have a few servers under my control and of these 8 of them are exhibiting something strange. The only thing these 8 servers have in common is that they are Windows 2003 ... we found some ports open to vip762.3322.org on these servers the other night and are trying to figure out what is happening ...

What we know -

The ports are NOT the same on each box, although there are some common ports but not across all of the boxes, i.e. - 3 or 4 of them may have port 1114 open, but not the other 4 boxes ...

Some of the ports connect to microsoft-ds, some to LDAP, some to just other ports ...

There doesn't seem to be a huge decrease in available bandwidth across the network

the 3322.org is the Chinese DNS Responder that had something to do with the SQL Injection Attacks from not too long ago, and the same one from the ActiveX Video vulnerability.

Blackholeing thru DNS doesn't stop the connections

Antivirus (AVG, McAfee Stinger, and the MSRT) does not find any problems on these machines, it does occasionally find bad files in user folders, or email (if the server has exchange running)

These servers are both Standard 2003, and SBS 2003 ... some of them have the websites running on them and others have absolutely no firewall ports open for inbound connections.

The only software in common between these servers is our Kaseya Agent software, and Kaseya's version of VNC, along with standard security patches (all boxes are completely patched up to date) - Some boxes run QuickBooks Server, some run QuickBooks (07 thru 09) and some run MSDE 2000, some don't run any SQL at all .... some can be accessed via RDP and others can not be accessed at all (except thru Kaseya)

This is really annoying as it appears to be something new and latent, perchance a new version of COnficker or something like that?

Anyone got any ideas on what to try and what to look for, etc ...

View the Solution FREE for 30 Days

20091111-EE-VQP-92 - Hierarchy / EE_QW_3_20080625

Hall of Fame

1. rpggamer...264,501
2. warturtle159,232
3. xmachine121,568
4. Admin3k95,624
5. David-Ho...76,727
6. johnb676736,082
7. optoma32,538
8. Computer...32,298
9. greyknigh...32,017
10. moh10ly28,014
11. surfer2423,430
12. JeremySB...19,636
13. MikeHolcomb19,486
14. legalsrl17,600
15. Jonvee17,494
16. IndiGenus16,830
17. ljones_cna16,825
18. dstewartjr14,680
19. jhyiesla14,398
20. NaturaTek13,331
21. torimar12,825
22. LeeTutor11,684
23. bRvO11,500
24. younghv11,462
25. thinkpads...11,310

1. rpggamer...732,346
2. IndiGenus287,259
3. warturtle159,232
4. Admin3k151,164
5. younghv126,007
6. xmachine122,968
7. David-Ho...102,152
8. phototropic85,780
9. moh10ly77,373
10. johnb676772,495
11. r-k71,908
12. Sheharya...49,873
13. legalsrl41,275
14. war138,050
15. greyknigh...33,742
16. optoma32,538
17. orangutang32,309
18. Computer...32,298
19. briancassin30,806
20. jimmymcp0229,920
21. rindi26,614
22. michko26,180
23. Tolomir25,100
24. jhyiesla25,098
25. surfer2423,430

New Virus/Malware ...

Asked by TBK-Consulting in Anti-Virus, Windows 2003 Server, SBS Small Business Server, Microsoft Server

Tags: Windows, Virus

About this solution