I am running Windows 2003 R2 and had the box compromised by a virus.
Symantec cleaned it all up I think, but I keep getting reinfections.
After investigating the windows firewall, it had been disabled.
Further, it appears that a group policy has been applied to it that I
can't edit.

When I open the firewall admin, I see an entry in the exceptions:
2941:TCP is allowed from all IPs. The problem is, I cannot edit it,
it's grayed out. Also, explorer.exe has been added to the list and is
also grayed out (that might have been there before though, I'm not
sure). In the exception config box, all entries do say group policy =
no. However, when I run "netsh firewall show state" it says "Group
policy version = Windows Firewall" which from what I'm reading, means
that it's using a group policy indeed. Also, when I run gpedit.msc
and go to Admin templates -> ... -> Windows Firewall, it indicates
"Not configured" for every entry.

In article <1187709590.202986.120610@g4g2000hsf.googlegroups.com>,
sean.blaes@hifiit.com says...

Unless you're just trying to clean it for the experience and fun, wipe
it and rebuild it.

There is no way to be sure that a machine is 100%% clean using any
automated tools and certainly not by even a skilled network admin.

While I've cleaned some, I've never "certified" them as clean for
customers, and I never will. The only "SECURE" way to clean a
compromised box is to wipe (flatten) completely and rebuild in a clean
area.

You need to keep your servers behind a proper firewall too, do not
connect them without an appliance in front of them - and I'm not talking
some cheap NAT router that claims to be a firewall.

--

I totally agree, normally. But regretfully we're dealing with a
horrible ISP that will take weeks to wipe the box. We also have no
clean area to do a reinstall in because it's remote. Also, it's
supposed to be behind a firewall, but I just don't think the ISP has
very strict rules on the firewall.

On Aug 21, 12:37 pm, Leythos wrote:

In article <1187719486.791080.45070@g4g2000hsf.googlegroups.com>,
sean.blaes@hifiit.com says...

Why are you using ISP's hardware if they have shown they can't protect
the OS/apps?

Either get your own servers and firewall or find another ISP to host
your applications.

--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

On Aug 21, 8:10 pm, Leythos wrote:

Hi Cloud9Flyer,

First of all, get your AV vendor envolved!
If your box gets reinfected, it means that it is not properly cleaned or
that there is still other malware envolved controlling your box.
Inform your AV vendor about the reinfection and provide them with the binary
of the virus (if possible).

You can run below online scanners to verify if your box is clean, as said by
Leythos, there is never a guarantee that your system is clean after a
compromise.

OneCare: http://safety.live.com
Kaspersky: http://www.kaspersky.com/virusscanner
eTrust Antivirus Web Scanner:
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Trend Micro HouseCall: http://housecall.trendmicro.com/
Panda ActiveScan:
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
McAfee FreeScan: http://us.mcafee.com/root/mfs/default.asp?cid=9914
F-Secure Online Virus Scanner:
http://support.f-secure.com/enu/home/ols.shtml

On Aug 23, 10:45 am, "Kurt Sarens [MSFT]"
online.microsoft.com> wrote: