Virus found on a domain computer... What to do!¿

Question

Possible Duplicate:
Computer is infected by a virus or a malware, what do I do now?

We have a user that got several viruses. It has been deleted and cleaned but now, I need to find how she got these viruses on her computer.

I would like to know what you use to check, remotely, what can be the cause of this issue.

• Internet logs (Browsing history)
• Cookies
• Tools to analyse
• Tools that can check remotely all intrusion possibility.

I'm also looking for software that can extract info on the remote computer that can give me hints or info regarding this.

Hope this question won't be closed. It might be a good idea to write here everything to do when a virus is found on a PC on a domain but need to clean and check logs remotely.

Regards,

David.

Answer 1

We periodically get viruses which install themselves into user's profiles. While these viruses don't run with admin privileges, they do get copied to every computer the user logs in as, and can send and receive data on the network, which is almost just as bad.

To detect the viruses, we scan the the fileserver where our user profiles are stored with antivirus software, and actively monitor the network for virus activity using an array of tools such a snort and firewall IP blacklists.

When we discover a virus, we make sure it is wiped from the user's roaming profile, and reimage any computers that got the virus installed in the user's local profile (which is stored on that computer, and not the fileserver).

Answer 2

I'd first look at whether she was somehow running as an administrator. Running as an unprivileged user is the most important way to avoid catching viruses.

Then I'd check your SUS server or in System Center, if you have them, because the #2 way to catch a virus is to use a machine that's not fully patched.

Next up is to make sure her antivirus software was up to date. Note that this is not nearly as important as the first two items - running fully-patched and unprivileged will do far more to preventing malware infection than antivirus software will. However, there's no point even thinking about looking at things like internet logs or cookies until you've checked all three of these.