Continue Reading This Article
Enjoy this article as well as all of our content, including E-Guides, news, tips and more.
How do you prevent that from occurring? First, thoroughly clean the infected machine. One way to remove the pathogens from the system would be to run a couple of passes from two different antivirus tools. While that might eliminate the pathogen, you could go even further -- back up the user data from the machine, reformat the hard drive and then reinstall the operating system. That takes time, of course, but will give you a more thorough and trustworthy clean system.
To prevent the malware from spreading, make sure your network's systems have up-to-date antivirus tools with real-time protection. Carefully scrutinize any systems on which the users of the infected system have accounts, including server machines and those of other clients. The malware may have spread using the credentials of the users logged into "patient zero." Also, unless you have a defined business need for protocols like those supporting file and print sharing (using TCP and UDP ports 135-139 and 445), filter these Windows-associated systems at your network borders, and even on your internal network. If you do need these protocols, you likely only need to support them to and from file servers, printers, and perhaps Exchange mail servers. You most likely don't need them from client to client. Consider such filters as a preventative step for the next time around. If you are into scripting, you could write a login script on other systems that will look for the registry keys you found on the one infected machine. Then, you can see if the keys have been compromised.
This was first published in September 2006