[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Network hit with sexy.exe, porn.exe, secret.exe, password.exe etc.

Posted on 2013-01-18
7
Medium Priority
?
1,976 Views
Last Modified: 2013-01-21
Looks like our network got smashed with the above virus. They are worms it looks like.

we have sophos

When accessing our network drives on various servers it has changed the file structure and folders to .EXE's etc and files are being hidden.
how to stop this from spreading and how to clean this up
0
Comment
Question by:Lidka
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
7 Comments
 
LVL 23

Accepted Solution

by:
Thomas Grassi earned 2000 total points
ID: 38794372
0
 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794388
You can remove it with malwarebytes antimalware and combofix from bleepingcomputer.com. To help stop it from spreading while cleaning I would disconnect everything from the domain and start from the servers and work my way down.
0
 

Author Comment

by:Lidka
ID: 38794461
this is spreading fast how do I know where it originated
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794473
It would be hard to determine where it originated but you can use wireshark to filter packets being sent and try to go from there.
0
 

Author Comment

by:Lidka
ID: 38794862
what is the best tool to remove this virus ?
0
 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794886
Malwarebytes antimalware, spybot search & destroy, and combofix from bleeping computer are good.
0
 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 38795451
I would use a more well known company would not use freeware or shareware prodcuts to protect your server.

I suggest Kaspersky

http://www.kaspersky.com/virus-removal-tools
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
Know the reasons and solutions to move/import EDB to New Exchange Server. Also, find out how to recover an Exchange .edb file and to restore the file back.
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question