1

Scenario is my friend works in company where they use more than 1200 computers. They have 2 domains. Employees are given same user accounts as per their designation.

  • i.e. Operator, Marker, Accountant, Manager. All Manager uses "Manager" account and all operators uses Operaor account

The problem is their network got virus infected named "W32.Sality" virus. What this virus does is, it access shared folders in network and drop infected files and as soon as user opens infected files that system got infected too.

My friend has antivirus software but the problem is he does not have any record of which computers have antivirus in it.

I just want know is it possible to find out which computer has dropped that file and we will install antivirus in it.

  • Antivirus runs on 5040 port number i.e. It communicates to it's console via this port. If there's any way to find which computers are not using this port using power shell script or command line or using any tool that would be a great help. I've seen this type of problem in many companies. Because of laziness of the IT Dept. whole company has to bear the loss. – arjavlad Apr 4 '14 at 19:10
0

I would strongly sugget you to go the other way around - find out which computers dont have AV.

The simplest way I can think of is by connecting to each computer C$ share (preferably using a script), and check if the AV folder exists.

0

Which computer dropped the file is totally irrelevant at this point - and you will not be able to find that out because Windows does not register it. The same goes for finding out which account created the file: since several human beings use the same account, you can't locate the user.

Sality is an old virus, and actually it's by now an entire family so it's unsure what variant you're dealing with. Quoting from that Wikipedia article:

"Since 2010, certain variants of Sality have also incorporated the use of rootkit functions as part of an ongoing evolution of the malware family. Because of its continued development and capabilities, Sality is considered to be one of the most complex and formidable forms of malware to date."

Also:

"Sality uses stealth measures to maintain persistence on a system; thus, you may need to boot to a trusted environment in order to remove it. Sality may also make changes to your computer such as changes to the Windows Registry, which makes it difficult to download, install and/or update your virus protection. Also, since many variants of Sality attempt to propagate to available removable/remote drives and network shares, it is important to ensure the recovery process thoroughly detects and removes the malware from any and all known/possible locations."

For now, assume all computers in your network infected.

Step 1: Disconnect and shut down all computers.
Step 2: Plan how to clean it up.
Step 3: Do the cleanup

The second step is the most important, if your plan does not work correctly you'll end up with an infected network all over. It is also a step that cannot be described here in a few sentences. I suggest you get some people together and start researching:

https://www.google.com/search?q=clean+up+infected+computer

https://www.google.com/search?q=clean+up+infected+network

The primary advice for any infected computer is a full hard disk wipe and a full reinstall of the OS and/or restore of your backups.

To emphasize: from your question it seems as if you think you can get away with cleaning up one computer. You can't.

  • Already done more than 500 computers full scanned and cleaned up. Now I know which systems have antivirus in it(at least 60% of them have AV). I know that manually checking systems is the best way. But because of virus whole network is working slow and this time I'll do manual check but what if same problem arise!!? – arjavlad Apr 4 '14 at 19:04
  • This manual checking is taking too much time. Whole network is down from nearly a week. I know there are so many experienced IT Professionals which can help me to boost this process. – arjavlad Apr 4 '14 at 19:15

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.