2

We're an office of web developers, so we mostly don't download things. I'm the most recent victim of this virus, however I was able to halt it's progress. At first, this virus showed up as Blacole.Q and was located in my Google Chrome cache. Upon further scans, a few Trojans showed up, and were subsequently removed. Upon restart, a couple more showed up, and after removing those, my scans are clean.

Tools Used:

  • Microsoft Security Essentials
  • Hitman Pro 3.6
  • Mbam (Didn't do anything nominal)

The first two virus' showed up as Vista Security 2012 and were too deep to remove effectively, we had to start entirely fresh.

My question

What are the chances that this virus is moving through LAN connection (or even DropBox)? Is it possible that this is just a coincidence?

IF this is cause for concern:

What steps should I take to sanitize the network? How can I detect a network virus?

3

1 Answer 1

1

It's more likely that there's a common vulnerability on your systems and your users are visiting related sites. This may be a hacked site feeding malware or it might be an infected ad running on some sites.

I've had to clean a few systems recently where (based on infection locations) Java exploits were the attack vector; where viable I've started to steer folks toward Brian Krebs' advice on Java - If you don't know that you need it, remove it.

The most important thing is to keep the systems up to date, but that's not always going to be enough. If you're not using a tool like Secunia's PSI or CSI or (apparently, I've never used it) FileHippo's Update Checker, you should start. Along with notifying and sometimes auto-installing updates, the Secunia products will warn you of unpatched vulnerabilities; FileHippo looks like a simpler updater without vulnerability warnings.

1
  • Where viable it may also make sense (on Firefox at least) to run NoScript (disables JavaScript on sites, allows selective enabling) and RequestPolicy (disables cross-site or cross-domain file requests, allows selective enabling). Both are somewhat intrusive, particularly until you've set up your initial permissions for sites that you visit regularly. NoScript won't help with infected sites that you visit regularly but may help on sites visited casually. Recommended for savvy users only due to intrusiveness and need for selective enabling.
    – fencepost
    Jan 2, 2012 at 20:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .