The primary machines on my network are
1. A Win XP laptop. This machine got it itself thoroughly compromised by an inexperienced user (not me!) and I took it off line for a while, and subsequently did a fresh restore of WinXP from the restore CD. In addition, the hard disk has a bad sector and I needed to do a format.
2. A MacBook running Snow Leopard (OS/X 10.6)
3. A new Win 7/64 box, barely used at all
4. A 10-year old SONY Vaio tower running WinXP SP3
Machines #1 and 4 were supposedly protected by McAfee Anti-Virus. The entire network is gated to the internet by a router with wireless.
Machine #3 was the greatest concern: I was wondering how a machine that had (almost) never been used, despite the lack of an anti-virus solution on it, could show signs of a virus.
On Friday night, I worked with a paid anti-virus expert (Nick Lockhard: see www.nicklockard.com) to examine Machine #3 in detail. During this process we discussed various types of active anti-virus systems (like McAfee) and periodic malware scanners (like Search and Destroy which I have used in the past). For the problem at hand, various web postings had noted that a malware scanner called Malwarebytes was capable of removing my problem.
Therefore attention turned to getting this program onto my Win7 machine (Machine #3) and doing a scan. Before involving Nick I had done so. The next step was to update the database of problems (the rule-set), but I found that this part of the program did not work. This is why I involved Nick. As a re-seller of this product, he had the latest rule-set available on his equipment. He uploaded it to my machine. Before doing this, he ran various tools to clean out my registry -- and found numerous problems -- remarkable for a "fresh" install!.
After doing all this we ran a scan but nothing was found -- possibly the earlier tools (making it possible for Malwarebytes to run properly!) had helped.
After this, on his recommendation I installed the free edition of AVG anti-virus and ran scan using that tools. That tool, unlike Malwarebytes, is active. I then tried some more network activity and then AVG reported that the same problem that had bothered me to begin with (on 3 machines) was blocked.
This was an improvement of course, but didn't reveal the complete story of what the real problem was. In other words, Machine #3 was now protected. I did the same for Machine 4. I installed Malwarebytes on it. However, as with Machine 3, Malwarebytes at first could not work properly. But I copied the rulesets by hand from Machine 3 and then all was well.
Running Malwarebytes on Machine 4 turned up two registry problems: security was turned off! This took all night (Machine 1 has 300,000 files).
On Saturday, I turned my attention to machine 1. I installed Win XP from the restore CD. However, I could not get the network to work correctly. Finally, after after much fighting Microsoft's obscure network controls, I logged into my home router, for no other reason than to find out the correct DNS settings.
I use a static IP address. This address and fixed DNS values are programmed into my router. I discovered that the values in the router were compromised. I called Shaw (my service provider), and got the correct value, put them in the router, and then changed the password on my router!.
In hindsight, it seems clear that a virus on Machine 1 (the WinXP laptop) had compromised the router, and everything else flowed from there. In particular, that explained how the Macbook could be experiencing the same problem.
No comments:
Post a Comment