Jump to content

mattspchelp

Members
 View Profile  See their activity

  • Posts

    18

  • Joined

  • Last visited

 Content Type 

Posts posted by mattspchelp

    Can I manually delete quarantine files?

    in ESET Endpoint Products

    Posted

    This is also an issue I reported months ago , as we have a server that quarantined all .zip files to prevent them being deleted or being delivered to customers, I was advised that the self defence module needs to be disabled and then the quarantine folder emptied , however I did ask if a pagination feature could be added or a limit of 30 records loaded at a time as we have had the same issue where the server becomes unresponsive,

    Files corrupted by unidentified virus. Server protected with NOD32.

    in Malware Finding and Cleaning

    Posted

    if you have shadow copies enabled on the server you will be able to restore all the files without this corruption , I would however ensure your server is clear and run a full network scan via remote admin, aswell as enabling audit logging on file reads and writes this may then show you where these infections came from , potentially an employee using facebook or opening infected zip files from fake  hrmc, tnt, dhl accounts.

     

    We have recently overcome this same infection for a new client,

     

    Regards

     

    Matt

    Best Practices when Machines Remotely Access ERA Server?

    in ESET Endpoint Products

    Posted

    The easier option would be to open 2221 and 2222 for internal access at the server level and leave your external firewall as it is, but allow all laptops to connect via VPN, this adds security while allowing clients to update there status and doesn't open any ports on the external firewall. if these are business laptops used at remote locations its more than likely they will be using VPN's already.

    Files corrupted by unidentified virus. Server protected with NOD32.

    in Malware Finding and Cleaning

    Posted · Edited by mattspchelp

    Hi Ocean LC ,

     

    We have also experienced this infection getting past Eset, I believe this was accomplished by hiding inside a zip file as an attachment on an email, but also would have been opened by a member of staff, luckily any of our customers with eset mail secuirty for exchange we have enabled rules to remove any files that are .exe .zip .rar ect... which has prevented the infection on a lot of customers, however standard antivirus protection from eset doesn't stop the infection at all, we are beginning to look into the lockdown bleeping computer have suggested as a preventative measure by using software security via group policy.

     

    Block CryptoLocker executable

    Path: %AppData%\*.exe

    Security Level: Disallowed

    Description: Don't allow executables to run from %AppData%
    .

    Block Zbot executable

    Path: %AppData%\*\*.exe

    Security Level: Disallowed

    Description: Don't allow executables to run from immediate subfolders of %AppData%.

    Block executables run from archive attachments opened with WinRAR:

    Path: %Temp%\Rar*\*.exe

    Security Level: Disallowed

    Description: Block executables run from archive attachments opened with WinRAR.

    Block executables run from archive attachments opened with 7zip:

    Path: %Temp%\7z*\*.exe

    Security Level: Disallowed

    Description: Block executables run from archive attachments opened with 7zip.

    Block executables run from archive attachments opened with WinZip:

    Path: %Temp%\wz*\*.exe

    Security Level: Disallowed

    Description: Block executables run from archive attachments opened with WinZip.

    Block executables run from archive attachments opened using Windows built-in Zip support:

    Path: %Temp%\*.zip\*.exe

    Security Level: Disallowed

    Description: Block executables run from archive attachments opened using Windows built-in Zip support.

    hxxp://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information

    google redirect virus

    in Malware Finding and Cleaning

    Posted

    Good Afternoon Jim Cherry,

     

    I would advise using malwarebytes to remove the infection the software is freely available online however you may or may not be able to get to download the software from your infected machine due to thye redirects on google, I would advise downloading the software to a usb drive and then transferring the installer, once installed this should allow you to scan the machine and remove the infection ,

     

    Regards

     

    Matt

    So hard to Purchase

    in ESET Endpoint Products

    Posted

    If you need any renewal licenses I would be more than happy to sell them to you as reseller we would love the business, we sell the product at the same price as everyone else, no extras or hidden cost.

     

    PM me for any details

     

    Regards

     

    Matt

    w32/blaster worm - help!

    in Malware Finding and Cleaning

    Posted

    Sorry Janices, I work with the business versions and they are now called "endpoint antivirus/ endpoint security" the home software is still nod32 my apologies, Can I ask what software reported you had this infection as in your original post it stated eset wouldn't open, keep me updated, there are several different tools we can run to try and get rid of the infection,

    w32/blaster worm - help!

    in Malware Finding and Cleaning

    Posted

    When you say nod32 , the actual nod32 product was stopped several years ago and new products where brought out, I would suggest you find your eset username and password and download the latest product from esets website, also you can run a malwarebytes scan whilst eset online scanner runs.

×
×
  • Create New...