Solved

Network hit with sexy.exe, porn.exe, secret.exe, password.exe etc.

Posted on 2013-01-18
7
1,938 Views
Last Modified: 2013-01-21
Looks like our network got smashed with the above virus. They are worms it looks like.

we have sophos

When accessing our network drives on various servers it has changed the file structure and folders to .EXE's etc and files are being hidden.
how to stop this from spreading and how to clean this up
0
Comment
Question by:Lidka
  • 3
  • 2
  • 2
7 Comments
 
LVL 23

Accepted Solution

by:
Thomas Grassi earned 500 total points
ID: 38794372
0
 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794388
You can remove it with malwarebytes antimalware and combofix from bleepingcomputer.com. To help stop it from spreading while cleaning I would disconnect everything from the domain and start from the servers and work my way down.
0
 

Author Comment

by:Lidka
ID: 38794461
this is spreading fast how do I know where it originated
0
Don't lose your head updating email signatures!

Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users do...so should you!

 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794473
It would be hard to determine where it originated but you can use wireshark to filter packets being sent and try to go from there.
0
 

Author Comment

by:Lidka
ID: 38794862
what is the best tool to remove this virus ?
0
 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794886
Malwarebytes antimalware, spybot search & destroy, and combofix from bleeping computer are good.
0
 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 38795451
I would use a more well known company would not use freeware or shareware prodcuts to protect your server.

I suggest Kaspersky

http://www.kaspersky.com/virus-removal-tools
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
laptop problem 21 96
Software that will scan Windows license from external disk. 2 45
Delayed service start 8 28
Windows 10 Mail Sync Error 6 31
A few months ago I had an issue with LaserJet 1020 printer which was installed to XP and Windows 7.  It was installed to XP and working, but when I tried to connect from a Windows 7 PC, it would attempt connection and then fail.  Sometimes the Spool…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup" or a blinking cursor with black screen. A loop for Auto repair will start but fix nothing.  You will be panic as there are no back…
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now