• RSS
  • Twitter
  • FaceBook

Security Forums

Log in

FAQ | Search | Usergroups | Profile | Register | RSS | Posting Guidelines | Recent Posts

Incident Question - User Profiles - Trojan

Users browsing this topic:0 Security Fans, 0 Stealth Security Fans
Registered Security Fans: None
Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Spyware // Adware // Trojans Discussion

View previous topic :: View next topic  
Author Message
Miaminola
Just Arrived
Just Arrived


Joined: 02 Mar 2009
Posts: 0


Offline

PostPosted: Mon Mar 02, 2009 5:26 pm    Post subject: Incident Question - User Profiles - Trojan Reply with quote

Hey All -

I'm looking into a incident on a number of users' computers.

Over the weekend upwards of 100 new user profiles (60 gig of data) were created on each of five systems.

Event logs show many (> 300) anonymous logon/logoff, as well as <100 user and <50 System logon/logoff.

Virus scan picked up Trojan.Clampi. Users report error message with 2.exe

I've isolated hosts, and continuing investigation. Hosts are running MS XP Pro SP2

Has anyone run into similar? My feeling is that each host that attempted a login is infected - which could be upward of +200 systems. Network-wide virus/trojan or hack attempt are high concerns.

Any information would be appreciated. Thanks in advance!
Back to top
View user's profile Send private message
su007
Just Arrived
Just Arrived


Joined: 03 Mar 2009
Posts: 0


Offline

PostPosted: Tue Mar 03, 2009 2:22 am    Post subject: Unfotunately yes Reply with quote

I had the exact same issue with our domain, and I am still looking. It actually got on my machine despite me having exclusive access. My system was only missing 4 patches, I guess 4 too many. I wound up disabling the Symantec option "network: trust others running auto-protect" because it now seems stupid after seeing how well auto-protect works.
Back to top
View user's profile Send private message
Display posts from previous:   

Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Spyware // Adware // Trojans Discussion All times are GMT + 2 Hours
Page 1 of 1


 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Community Area

Log in | Register