Solved

Network hit with sexy.exe, porn.exe, secret.exe, password.exe etc.

Posted on 2013-01-18
7
1,952 Views
Last Modified: 2013-01-21
Looks like our network got smashed with the above virus. They are worms it looks like.

we have sophos

When accessing our network drives on various servers it has changed the file structure and folders to .EXE's etc and files are being hidden.
how to stop this from spreading and how to clean this up
0
Comment
Question by:Lidka
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
7 Comments
 
LVL 23

Accepted Solution

by:
Thomas Grassi earned 500 total points
ID: 38794372
0
 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794388
You can remove it with malwarebytes antimalware and combofix from bleepingcomputer.com. To help stop it from spreading while cleaning I would disconnect everything from the domain and start from the servers and work my way down.
0
 

Author Comment

by:Lidka
ID: 38794461
this is spreading fast how do I know where it originated
0
Save the day with this special offer from ATEN!

Save 30% on the CV211 using promo code EXPERTS30 now through April 30th. The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794473
It would be hard to determine where it originated but you can use wireshark to filter packets being sent and try to go from there.
0
 

Author Comment

by:Lidka
ID: 38794862
what is the best tool to remove this virus ?
0
 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794886
Malwarebytes antimalware, spybot search & destroy, and combofix from bleeping computer are good.
0
 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 38795451
I would use a more well known company would not use freeware or shareware prodcuts to protect your server.

I suggest Kaspersky

http://www.kaspersky.com/virus-removal-tools
0

Featured Post

Why Off-Site Backups Are The Only Way To Go

You are probably backing up your data—but how and where? Ransomware is on the rise and there are variants that specifically target backups. Read on to discover why off-site is the way to go.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The Windows functions GetTickCount and timeGetTime retrieve the number of milliseconds since the system was started. However, the value is stored in a DWORD, which means that it wraps around to zero every 49.7 days. This article shows how to solve t…
There are many software programs on offer that will claim to magically speed up your computer. The best advice I can give you is to avoid them like the plague, because they will often cause far more problems than they solve. Try some of these "do it…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
In this video, viewers will be given step by step instructions on adjusting mouse, pointer and cursor visibility in Microsoft Windows 10. The video seeks to educate those who are struggling with the new Windows 10 Graphical User Interface. Change Cu…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question