Viruses...Need some help

[ppaik]

Does anyone know all the possible ways of getting trojan viruses and any other viruses?

I always thought trojans are attached to an .exe file I read that it can actually be put in a computer as well. Is this true? Also what are the other possible ways of getting viruses besides uploading an infected file and being on the same Network as an infected computer? I guess people can hack a computer and install one...but I would assume that to be more difficult.

Some people also added that you can also get a trojan from browsing the net?

The reason I ask this...I found a trojan on a computer and wanted to know all the possible ways it got there...

 

[n0cmonkey]

Anyway to interact with the machine over a network or the user is a possible opening.

 

[ppaik]

well i have it for a webserver only...and i have a firewall blocking all ports except www on it.

 

[n0cmonkey]

Originally posted by: ppaik
well i have it for a webserver only...and i have a firewall blocking all ports except www on it.

Then it probably came through a misconfigured or unpatched webserver or web application. Have you run the Microsoft security baseline analyzer?

 

[mechBgon]

What antivirus software found the Trojan? What is the exact name of the Trojan? If you don't remember, look in your antivirus software's logs/reports for it.

 

[ppaik]

ok ill look at the virus log...its Norton btw

 

[ppaik]

hmm cant find anything...just says smartnav.asp backdoor.trojan

 

[mechBgon]

Originally posted by: ppaik
hmm cant find anything...just says smartnav.asp backdoor.trojan

Here is Symantec/Norton's page on that: Backdoor.Trojan

Backdoor.Trojan is a generic detection for a group of Trojan horse programs that open a back door and allow a remote attacker to have unauthorized access to the compromised computer.

I dunno about you, but I would burn that OS installation to the ground, sprinkle the computer lightly with the blood of goats, and start over. If you have other computers on the same router, scan them too.

If you have to browse the Internet from the server, then don't do it with an Administrator-class account. What operating system does the server run?