Storm worm virus incident.

[rurbaniak]

A long story, but I'll try to keep it on the short side.

A client of ours with 25 computers, contacts us and says that they couldn't send email to anyone at Comcast. We host their email and website, so I look in to it. I create a account on their account, and send mail from it to my comcast account without any problems. I used the webmail portion of the website, and that worked fine, however when sending from outlook/express it wasn't being received.

So I checked their IP against some RBL's (Real Time Black Lists), which basically in this case told us that they were spamming. Contacting SPAMCOP.net, and also cbl.abuseat.org I found out that they had the Storm Worm, or something like it.

From cbl.abuseat.org:

ATTENTION: This IP is infected with the Storm worm, and emitting spam and/or propagation attempts.

It was detected at 2008-02-14 23:00 GMT (+/- 30 minutes), approximately 2 hours ago.

Headers from Spamcop.net didn't tell me which workstation it was coming from only their public IP.

Since we host their email, I quickly checked to make sure they were not spamming through us and they were not. Last thing you want as a webhost / email provider is to end up on a spamming blacklist.

Anyhow, the client is running Symantec Corporate Edition, and all scans come up clean with it. So decided to tackle it with Spybot, Adaware, HiJackthis, and several others. Those found alot of spyware in the network, but didn't eliminate the problem.

The cbl.abuseat.org tells you the last time it was detected, which really helps , and checking the next day we could see that it was still happening.

Now it came down to how to find the culprit, it was either:

A: Packet Sniffer on the network capture all traffic and examine.

or

B: Rip out Symantec, install NOD32 Smart Security Edition.

We went with the NOD32 and glad we did. It found a Bunch more items that the above programs did not even find, eliminated the storm worm.

I was a big fan on NOD32 before, but now it's really solidified it.

 

[iladelf]

Interesting info, thanks!

BTW, I've often read that the Rolls Royce programs of spyware/virus removal are NOD32 and Kaspersky. Only once have I used KAV to knock down something that nothing else could, but from what I've read, many techs like both programs. So I'd say you picked a good one.

 

[nonchalant]

So Symantec didnt detect it? How surprising..

I reckon the guys that make that software should all be made by law to use it themselves..

 

[rurbaniak]

In hind sight, I should of used Nod32 first, then the rest..

 

[Blues]

I have had a similar incident where my company ended up on CBL but they wouldn't give us an ounce of detail to help us find and remove it to keep us off thier list. We finally got off the list but not by finding an infected machine as we couldn't. We believe it had to do with having two exchange servers using the same IP address and they weren't liking our DNS records. We do run Symantec Corperate AV and well changing it is not a good option as we have hundreds of PCs here at this location. Fortunately We use two IP addresses to send email and only one was blocked so we were only half shutdown people had to resend messages a few times. We haven't been back on thier list in a while and never found a virus or spyware infection. Our firewall doesn't really permit traffic from anything but the servers anyhow so it was unlikely to be them either. Bottom line CBL was no help at all to us and it seems there never was anything wrong with our system.