Solved

Network hit with sexy.exe, porn.exe, secret.exe, password.exe etc.

Posted on 2013-01-18
7
1,934 Views
Last Modified: 2013-01-21
Looks like our network got smashed with the above virus. They are worms it looks like.

we have sophos

When accessing our network drives on various servers it has changed the file structure and folders to .EXE's etc and files are being hidden.
how to stop this from spreading and how to clean this up
0
Comment
Question by:Lidka
  • 3
  • 2
  • 2
7 Comments
 
LVL 23

Accepted Solution

by:
Thomas Grassi earned 500 total points
ID: 38794372
0
 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794388
You can remove it with malwarebytes antimalware and combofix from bleepingcomputer.com. To help stop it from spreading while cleaning I would disconnect everything from the domain and start from the servers and work my way down.
0
 

Author Comment

by:Lidka
ID: 38794461
this is spreading fast how do I know where it originated
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794473
It would be hard to determine where it originated but you can use wireshark to filter packets being sent and try to go from there.
0
 

Author Comment

by:Lidka
ID: 38794862
what is the best tool to remove this virus ?
0
 
LVL 13

Expert Comment

by:Gabriel Clifton
ID: 38794886
Malwarebytes antimalware, spybot search & destroy, and combofix from bleeping computer are good.
0
 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 38795451
I would use a more well known company would not use freeware or shareware prodcuts to protect your server.

I suggest Kaspersky

http://www.kaspersky.com/virus-removal-tools
0

Featured Post

The problems with reply email signatures

Do you wish that you could place an email signature under a reply? Well, unfortunately, you can't. That great Exchange/Office 365 signature you've created will just appear at the bottom of an email chain. What a pain! Is there really no way to solve this? Well, there might be...

Join & Write a Comment

A few months ago I had an issue with LaserJet 1020 printer which was installed to XP and Windows 7.  It was installed to XP and working, but when I tried to connect from a Windows 7 PC, it would attempt connection and then fail.  Sometimes the Spool…
If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now