Solved

Virus or Spam attack, how to remove ?

Posted on 2007-03-20
4
299 Views
Last Modified: 2013-11-22
Hello experts,
I have a serious virus issue in our office

We have windows 2003 standard server running exchange 2003 and a windows 2000 server as a file server. Desktops are running XP and 2000 with Norton/Symantec antivirus corp edition 7.5 and some pc running 10.0
Few days ago a virus hit us (spybot and downloader). Some pc's were rebuit from scartch and put back onto window 2000. The problem i have is this

1. The newly rebuilt pc's once put on the network gets a qurantine message from NAV saying it qurantined downloader and or "i". Does this mean the virus is coming from the outside or is inside the network.
2. When a pc boots up, if the user dosnt login with a few minutes it comes up with "network request not supported" and if i reboot the pc and login again it is fine.
3. On 2000 boxes the network drives "disconnect" after a while.
4. Email runs fine
5. Network runs slow

My feeling is that there is still 1 or 2 pcs with some sort of spam that is spiting out data onto the network. Can you please let me know what tools i can use to remove this and also how to determine which pc's are infected.

Thanks in advance
0
Comment
Question by:jiveman74
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 27

Accepted Solution

by:
Rainer Meller earned 250 total points
ID: 18763078
you could install zonealarm on some computers to log intrusion attempts:

http://www.zonealarm.com/store/content/company/products/znalm/freeDownload.jsp

After installation, go to the "log" tab and select "firewall" log in the menu.

0
 
LVL 27

Expert Comment

by:Rainer Meller
ID: 18763084
0
 
LVL 6

Assisted Solution

by:shayneg
shayneg earned 250 total points
ID: 18767154
do you have windows defender installed to stop spyware, malware etc
0
 

Author Comment

by:jiveman74
ID: 18787757
Hello experts,
Sorry for the delay and thanks for responses. I have been working full nights to sort this out. It turns out one box in the network didnt have av installed so got infected with Spybot and other viruses. Some of this was not also picked up by norton av 8.0. I had to rebuild a 2000 server and put av, windows update etc. The network request not supported error went off after I did the windows updates.

Cheers
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Getting to know the threat landscape in which DDoS has evolved, and making the right choice to get ourselves geared up to defend against  DDoS attacks effectively. Get the necessary preparation works done and focus on Doing the First Things Right.
Part One of the two-part Q&A series with MalwareTech.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question