Need a little help with a virus...

[karmic]

Have a 2000 server being infected once in a while with W32.Randex.gen periodically. Trying to find out where in the world this is coming from and it's driving me nuts.

The virus drops into the default users profile at C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\PC3PC6QA\
and tries to infect but norton is picking it up and dropping it in quarantine.

Problem is this... This company is connected (and recieves internet) thru a vpn line to their head office half way across the country. I know for a fact that norton always had a problem with virii coming across any vpn. I'm suspecting that it's coming from the head office and trying to find a way to prove it.

I have no control of internet security as of yet, and it's doubtful the head office will ever give me any type of control in the future. This client has been hacked in the past (with a virus called sdbot, same situation) proving that the security was terrible at one point, something I was trying to prove. Since the hack, a new cisco firewall has been installed in the office here (I still have no control).

I've been all around the network checking for the virus (same as last time with sdbot) and i'm confident it doesn't exist on the internal network so the only other place to look is the VPN. The server here is a basic DC running print services, DNS, DHCP and file storage, nothing else.

Any other ideas, short of installing a software firewall, to help track where this virus is coming from? BTW, there's nobody but me surfs the web thru the server, then it's only tek-tips

Thanks

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[paulray]

Most virii are resident in memory, so even if you remove infected file(s), it will re-appear. Most AV apps suggest 1) take the system off the network
2) run the av software
3) reboot the machine to clear memory
You may already be doing this, but just a thought!
Paul

 

[karmic]

thanks for the reply, that's been done several times... the virus only shows up every few weeks, really strange.
Think it's time just to bite the bullet and install a software firewall for a short time and see whats hitting the server from the outside.

Any suggestions are appreciated tho.

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[grshpr]

I used a program from systernals called TDImon and it helped to track down a few pc's that were infected still with the nachi virus. I left 1 pc on my desk, unpatched and very well virus proteted (scanned the winnt dir every 15 minutes and checked for new updates every 30 minutes. It might help you backtrack the location of where your virus is coming from.

It may not be ideal to run this on your server, as there will be a lot of traffic on it since there are a lot of connections are coming into the server. It's going to log every one of those things until you shutdown the software. I had it lock up my test pc once in a while, and the pc did nothing but sit there and wait to be infected.

It might be worth a shot, but I would monitor it fairly closely. You might even want to run it on another test box first just so you get an idea of how much information it is going to generate.

Here is a link to the web page.

http://www.sysinternals.com/ntw2k/freeware/tdimon.shtml