Some serious advice needed here. Virus/Exploit/attack

[roddyp]

Sorry if this post is a touch long, but i am really at a loose end here and need some advice...

Scenario
My brother runs a small company in Cape Town with about 20 staff. He is running SBS2003, fully patched and updated and a combination of windows 7 and XP machines.
All users connect to a "General" folder on the SBS server for storing data etc.
All machines "protected with NOD32"

3 weeks ago, files and folders start dissapearing from the "General" Folder. As you browse, files and folders literally start moving and disapearing. Run NO32 and Nothing i picked up. (fully up to date) About 20 gigs of data is randomly deleted.

As i am in JHB, by brother calls "Company X" and they come in. Their solution is to re-install the server (why i dont know). After re-install happens, they load the data back on and same thing happens. Their next solutions is tell my brother that its a hardward fault and make him change to a new server. Once again, data is loaded. Problem seems to abate for a few days. It now starts again.

"Company X" stop taking my brothers call.... So, we load MS Security essentials on every machine and run a scan. Nothing is picked up. We run the scan on the portable HDD that contains a backup of the "General Folder" and we find a few virus. Clean it out as best we can.

Thinking NOD might not be able to pick up the virus's we install AVG server edition onto the server. Run full scan and nothing happens. (We have now used 3 products. NOD, MS SE, AVG.)

So i look at the network configuration and its as safe as swiss cheese. (Nerds forgot to install a firewall) One was needed as the server had two network ports but one was disabled. The ADSL hardware they supplied had the firewall turned off. I sorted this out and i thought it might be some form of sustained attacked as he is in a pretty competitive industry. I'm no network expert though, so i was probably grabbing at straws.

So after doing three virus checks, patching the obvoius holes, making sure every machine is running the latest updates the problem still persists. (Now random files are also being created)

Now, yesterday he tries BIT-Defender. He pickups at 60 viruses on the portable HDD backup. How the hell did AVG, NOD and MS essentials miss these?

I am flying down to assist him as "Company X" he is using are worse than useless.

How do i ensure that his network is now clean? Any suggestions would be welcome.

My brother has lost over R200k in business now and has to retrench a few staff becase of some script kiddy prick that wrote this ***. (venting)
I need to make sure i leave him 100% and ready to continue to do business.

 

[Obelix]

activate auditing on those shared folders so you can see where the deletes come from..... then go hunt down tat machine ( and grill the user at the same time aswell )

 

[Mars]

I find it hard to believe that all those apps would miss all those viruses.
Honestly, its sounds more like some one has something similar to back-orifice installed onto the server, and when you restore, you are also restoring the malware.
I would think that someone is logging onto the machine and planting the viruses and deleting the files....

I would also take legal action against unnamed comapny. They should bear the cost of the new server and refund the labor costs because they where clearly not capable of solving the issue.

 

[Abe]

This sounds to me like someone either at the office or off site using something like back orifice is trying to cause trouble.

 

[Avenue]

switch to linux....

Now, yesterday he tries BIT-Defender. He pickups at 60 viruses on the portable HDD backup. How the hell did AVG, NOD and MS essentials miss these?

they update their signatures daily, and are always a few steps behind the latest threats... even the best only have something like a 50% success rate against unknown strains. These could be some new form of malware that the anti viruses are only just now starting to pick up....
Bit-Defenders pretty good- I would stick to that

This sounds to me like someone either at the office or off site using something like back orifice is trying to cause trouble.

+1

 

[The_Unbeliever]

Agreed - a virus/trojan is not able to move folders/files around intelligently.

So it must be some form of remote control either onsite or from offsite.

Put in a proper hardware firewall like Smoothwall with which you can also log incoming connections. The firewall supplied with Windows is not up to the task, and can be overrided quite easy with the neccessary knowledge.

Points to consider :

1. Do you have any VNC software installed, or Remote Desktop activated on any machines? Disable Remote Desktop completely if you're not going to use it.
2. When doing the reinstall - do you first load the antivirus, update it, and scan the backup for nasties before restoring?
3. Use a hardware firewall (smoothwall or ipcop) instead of a software firewall.
4. Enable auditing (as said before).

Keep the PC's disconnected from the network whilst reinstalling Windows. Ensure that Windows firewall is enabled before connecting the cleaned PC back to the network, and run WindowsUpdates on all the PC's.

 

[Random717]

Interesting. Try narrow it down a bit. Disconnect from the internet, shut down all client computers. Start turning on the client computers and browsing the share until the weird things start happening again.

Try Avast on the server and a client. 32 bit version allows you to do a full scan during the Windows boot process so it can locate things that are hidden when Windows is fully loaded. It might also detect commercial backdoor software that the other AVs couldn't find...

 

[PsyWulf]

Setup a virtual XP in a sandbox using a program like Sun Virtualbox

Copy those virus-laden files to the sandboxed VPC,upload them to http://www.virustotal.com/ and see how the virus scanner detection compares,also post which viruses and variants it is.

This week we had a particularly nasty Virut attack which Symantec Endpoint wasn't detecting till they released new signatures 3 days after the fact,cost me 2 days overtime to get it off -.-

 

[roddyp]

THanks for the advice.

Just to fill you all in. My first thought was to slowly reduce the factors to get to an easier answer.

I disconnected the server from the net as a first call. Installed a hardware firewall (will check on teh detials), removed my brother domain for the DYNDNS.BIZ service. (this was a HUGE risk as you could simply ping the domain name and get his IP.) Ran a scan and then connected him back onto the net. (Don't think much happned while i was off the net)

Then after the users went home, continued to work and the problem reared its head again.

From this i can definately eliminate it being a disgruntled employee, and i thought i should be able to elimininate it being an outside remote attack. The wierd thing is, now random files are being created as well. Everytime someone saves, 5 new files appear.

I will go through and try all solutions posted here, so thanks for you help so far. I will update as i go along.

 

[Nod]

What type of files are created automatically?
Putting the names into google might also get results.

 

[ponder]

switch to linux....

Or BSD, but at the end of the day pick what works for you. Just to many threats on the MS front if you ask me, you fix it now and later on you have a similar problem again.

 

[Abe]

Then after the users went home, continued to work and the problem reared its head again.

From this i can definately eliminate it being a disgruntled employee, and i thought i should be able to elimininate it being an outside remote attack. The wierd thing is, now random files are being created as well. Everytime someone saves, 5 new files appear.

I will go through and try all solutions posted here, so thanks for you help so far. I will update as i go along.

You can't eliminate the employees. There is software that you can run on your PC at the office that uses a normal internet connection to remotely control a PC. No incoming link required. Its all initiated by the workstation being controlled.

 

[yaseenkriel]

Sorry if this post is a touch long, but i am really at a loose end here and need some advice...

Scenario
My brother runs a small company in Cape Town with about 20 staff. He is running SBS2003, fully patched and updated and a combination of windows 7 and XP machines.
All users connect to a "General" folder on the SBS server for storing data etc.
All machines "protected with NOD32"

3 weeks ago, files and folders start dissapearing from the "General" Folder. As you browse, files and folders literally start moving and disapearing. Run NO32 and Nothing i picked up. (fully up to date) About 20 gigs of data is randomly deleted.

As i am in JHB, by brother calls "Nerds on site" and they come in. Their solution is to re-install the server (why i dont know). After re-install happens, they load the data back on and same thing happens. Their next solutions is tell my brother that its a hardward fault and make him change to a new server. Once again, data is loaded. Problem seems to abate for a few days. It now starts again.

Nerds stop taking my brothers call.... So, we load MS Security essentials on every machine and run a scan. Nothing is picked up. We run the scan on the portable HDD that contains a backup of the "General Folder" and we find a few virus. Clean it out as best we can.

Thinking NOD might not be able to pick up the virus's we install AVG server edition onto the server. Run full scan and nothing happens. (We have now used 3 producst. NOD, MS SE, AVG.)

So i look at the network configuration and its as safe as swiss cheese. (Nerds forgot to install a firewall) One was needed as the server had two network ports but one was disabled. The ADSL hardware they supplied had the firewall turned off. I sorted this out and i thought it might be some form of sustained attacked as he is in a pretty competative industry. I'm no network expert though, so i was probably grabbing at straws.

So after doing three virus checks, patching the obvoius holes, making sure every machine is running the latest updates the problem still persists. (Now random files are also being created)

Now, yesterday he tries BIT-Defender. He pickups at 60 viruses on the portable HDD backup. How the hell did AVG, NOD and MS essentials miss these?

I am flying down to assist him as the "Nerds on site" he is using are worse than useless.

How do i ensure that his network is now clean? Any suggestions would be welcome.

My brother has lost over R200k in business now and has to retrench a few staff becase of some script kiddy prick that wrote this ***. (venting)
I need to make sure i leave him 100% and ready to continue to do business.

Hi There. I'm Yaseen, the Head Nerd for Nerds On Site in Cape Town. There are only 3 Nerds working in CPT at the moment and none of us have worked on an SBS 2003 server in the last year or so. In fact, I am the only one qualified and certified by Nerds On Site to work on SBS 2003. We do have customers with SBS 2003 and none of them have logged any complaints recently.


Now, I can't rule out the possibility that one of my guys tried to fix this thing on his own, without letting the rest of us know. Get in touch with me and lets see if we can get to the bottom of this. Could you get a copy of the invoice to me, so I can be certain that it wasn't one of my guys that had a hand in this mess?

 

[The_Unbeliever]

@OP :

1. Wireless. Do you have any open/unsecured wireless AP's or other wireless devices connected to the network?

2. File names : As asked before, what is the file names of the files being created?

How long will you be on site?

@yaseenkriel - welcome to the forum. I do hope we can help sort this mess out.

 

[roddyp]

Hi all,

I want to offer my sincere apology to "nerds on site". I got the name of the company a bit mixed up. Not acceptable on my part, but my unreserved apologies to Nerds On Site. I don't want to name the other company, as the intention of the thread was not to flame.

@Yaseenkriel, apologies for the mix up.

 

[The_Unbeliever]

roddyp - did you manage to sort the system out?

 

[AK65]

Hi all,

I want to offer my sincere apology to "nerds on site". I got the name of the company a bit mixed up. Not acceptable on my part, but my unreserved apologies to Nerds On Site. I don't want to name the other company, as the intention of the thread was not to flame.

@Yaseenkriel, apologies for the mix up.

I would suggest that you edit your references to Nerds on Site, since your posts accusing them of being incompetent are going to hurt their brand image......

 

[yaseenkriel]

Hi all,

I want to offer my sincere apology to "nerds on site". I got the name of the company a bit mixed up. Not acceptable on my part, but my unreserved apologies to Nerds On Site. I don't want to name the other company, as the intention of the thread was not to flame.

@Yaseenkriel, apologies for the mix up.

@roddyp apology accepted and no hard feelings. getting good IT help is not easy. if you brother still needs help or if he has any issue in the future, have him give me a call. i will do the first call out free.