Solved

WAN Virus problems

Posted on 2006-10-29
4
219 Views
Last Modified: 2008-02-20
I've inherited a large 12 building WAN.  All 12 buildings connect to a core switch that feeds into our PIX firewall and then out into our high speed internet.  We have some very old windows 98 clients on our network.  If I could wave my magic wand and make them go away, I would, but I can't.  We're being told by our ISP that a machine on our network is infected with the Bagel virus, and is sending out lots of SMTP traffic.  I do want to get to all these clients and check their AntiVirus status, however, that may not be the most time-cost effective measure for finding the infected machine.

I'm thinking I should be able to view the traffic at the firewall, and see where the SMTP traffic is coming from.  There should not be any except from our Lotus server.  So my question is, does this sound like the best way to find the culprit.

Obvously we need a border device that has AV capability.  Obviously we need to update our clients.  But for now, I need to track down who's infected.

I'm open to any other suggestions.

Thanks in advance,
Scott
0
Comment
Question by:scottman29
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 9

Assisted Solution

by:crawfordits
crawfordits earned 50 total points
ID: 17829504
Yes should be able to view the active connections of the firewall.  The one with the most connections is the culprit.  I would block on all LAN->WAN traffic on Port 25 except for your mail server.
0
 
LVL 25

Assisted Solution

by:Ron Malmstead
Ron Malmstead earned 150 total points
ID: 17829781
FIRST....setup a syslog server
try kiwi syslog daemon.
http://www.kiwisyslog.com/downloads.php

THEN....enable logging on the pix.  http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801727a9.html#wp1028090

This will give you a live update of everything hitting the firewall from the inside, just look for port 25.

PS: You really should get rid of those 98 machines....they are always virus laden, POS ...for a corporate network environment you should be on xp/2003.
0
 
LVL 5

Author Comment

by:scottman29
ID: 17829832
I know about the 98 machines... it's been rough.  We're a school district, and the money is just not there to replace everything at once.  I'm lucky to have just been able to purchase a network backup system.  Some of the servers are 10+yrs old...  Netware 5.1...  it's bad... but, in the past year, it's only been getting better :)

I'll try the logging daemon and get back to you.

Thanks!
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 300 total points
ID: 17829868
>Obvously we need a border device that has AV capability.
Upgrade the PIX to Cisco's new ASA...

>with the Bagel virus, and is sending out lots of SMTP traffic
Block all outbound SMTP traffic except for your own email server at the PIX
 
   access-list Bagel permit tcp host <mymailserver IP> any eq smtp
   access-list Bagel deny tcp any any eq smtp log
   access-list Bagel permit ip any any
  access-group Bagel in interface inside

The 'log' keyword in the acl will send syslog messages for all denied traffic. Assuming that you have a syslog server as suggested by xuserx2000, it should be readily apparent who the culprit is...




0

Featured Post

Salesforce Made Easy to Use

On-screen guidance at the moment of need enables you & your employees to focus on the core, you can now boost your adoption rates swiftly and simply with one easy tool.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question