Viruses on Server. Best Approach?

[Gongalong]

Hi All,

 

Following on from my other post, what would others do if suffering a mass virus infection on their servers?

 

It's a difficult balance between keeping the system in production, but not allowing more infection to spread.

 

In our case it looks like the anti-virus (Sophos) is at least identifying the virus now, and cleaning or quarantining (oddly it seems to vary).

 

I've also taken some steps to ensure every endpoint is working correctly.

 

Based on the above I've left the servers in production, because of the huge issues it would cause to take them offline.

 

The worst of this is the SIMS share on the SIMS server appears to have been partly corrupted, but that was using some other LA provided anti-virus (McAfee).

 

Is/was this a good approach, or would you have approached differently?

 

TIA

[Gongalong]

(Just to clarify, in this case only the data shares on the servers were infected. The servers themselves weren't running the virus.)

[fairm010]

I'd back up any configuration / data and nuke the VM then reinstall. Seems like a lot of work but I'm my opinion the only way to ensure all traces are removed.

[ColinP]

I'd back up any configuration / data and nuke the VM then reinstall. Seems like a lot of work but I'm my opinion the only way to ensure all traces are removed.

 

The VM isn't infected just shared data- Its tricky because restoring from a backup of the shared files would re introduce the virus - depending on the number of infected files I would move them off the share, and see if that version is actually still used, and try to clean it on an off-network machine if required

[Gongalong]

Because tens of thousands of PDFs are infected, and the Sophos on-access scanner is stopping people from executing them, I'm leaving them there for the moment. I'm monitoring the generation of EXE files and there's no growth, in fact they are slowly reducing as some are getting cleaned up.

 

I'm creating a belt and braces backup, because we use DPM with retention periods, so just in case those retention periods expire I have what should be a clean set of files to hand.

 

Certainly a lesson in dealing with a virus and disaster recovery...