|
Posted by Mathieu CHATEAU on September 8, 2007, 9:13 am
Please log in for more thread options So you already pushed the red button...
Change all password (admins one at least)
check firewall for opened back door
close all traffic except the really needed one
You may go faster by building again workstations from a trusted source.
--
Cordialement,
Mathieu CHATEAU
http://lordoftheping.blogspot.com
> I'm the new network admin. The owner of the company is the only other
> person above me and he didn't authorize the installation of any such
> software. It was not due to company policy. It was a bad network admin.
> Removing it isn't at my risk... removing it is a due of my job!
>
>
>
> Steve Riely got it right with the articles he referenced. How do you
> secure the network from the person in charge of overseeing that it's
> secure? What steps do you take when network admin leaves to make sure
> he/she didn't leave backdoors, keyloggers, software bombs, etc.??
>
>
>
> What I need now is to find a company that can come in with special
> equipment/software that can detect such software/packets, etc. log it,
> track it, remove it and then be willing to present the evidence in court.
> How does one go about find a *good* company like this? Does anyone have
> any article that reference picking such a company... what questions to
> ask, etc.
>
>
>> It sounds as if one, or more, people in your organization bear watching -
>> and "are" being watched.
>>
>> Nothing you can do legally if it was installed due to corporate policy.
>> Remove it at your own risk. Believe me, you "will" be found out.
>>
>> --
>>
>>
>> Regards,
>>
>> Richard Urban
>> Microsoft MVP Windows Shell/User
>> (For email, remove the obvious from my address)
>>
>>
>>> The person who did this was the network admin. not a "standard" user.
>>>
>>>> Some anti-spyware products can detect certain loggers, if they've been
>>>> updated to look for the particular signatures of them.
>>>>
>>>> Certainly if you format the drive and reinstall Windows, then the
>>>> malware will be gone. Then it's important to think about how to lessen
>>>> the likelihood of another infection occurring. The best thing you can
>>>> do is run as standard user, not administrator. Loggers typically need
>>>> admin privileges to install and function correctly. By running as
>>>> standard user, these things won't work.
>>>>
>>>> --
>>>> Steve Riley
>>>> steve.riley@microsoft.com
>>>> http://blogs.technet.com/steriley
>>>> http://www.protectyourwindowsnetwork.com
>>>>
>>>>
>>>>>I believe one or more of our computers in our corporate network have
>>>>>keylogger/screen capture software installed. What software can detect
>>>>>these? I contacted http://www.spectorsoft.com and they claim there is
>>>>>nothing that can detect their software. This is very troubling if not?
>>>>>
>>>>>
>>>>>
>>>>> Does anyone know if the hard drive is re-formatted will that remove
>>>>> these applications or are they put someplace harder to get rid of?
>>>>>
>>>>>
>>>>>
>>>>> Thanks!
>>>>>
>>>>>
>>>
>>>
>>
>
>
| 
XML Sitemap