Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website.

3 out of 6 people in the office have gotten viruses in the last week. Our IT consultant assures us that the virus would not be on the central server and that we all must have got it from the same website. Does that sound legitimate?

We now want to investigate to see if our website could be the source of the infection. What are the first steps into investigating the possibility that our website is infected?

share|improve this question
    
But your website is on the central server, and your consultant says it is not from the central server. Why do you suspect your website, then? –  schroeder May 1 '12 at 14:21
1  
@schroeder In a way, I almost don't care why he suspects it. He's finding the root cause and reviewing his internal systems. That mindset goes miles in security as long it's paired with sane risk analysis. –  Jeff Ferland May 1 '12 at 14:25
    
@JeffFerland Granted. But if the consultant is saying that the infection is not from a specific source, and the OP is wanting to focus on that very source, knowing why might help us be more efficient in our own root cause analysis. "When you hear hoof-steps, think 'horse' not 'zebra' " From the OP's text, it would seem to me that the common cause of infection was outside the company, either a website or an email. To focus on an internal server means there might be more to the story that we will need to hear. –  schroeder May 1 '12 at 14:53
add comment

2 Answers

up vote 7 down vote accepted

The best thing you can do is have a known clean copy of your site that you can compare the server's files against. Most hacked webservers that serve virus infections come from changing the content of scripting files that server is offering to clients. Look for files with different checksums or new files.

There are also cases with forums type sites where the infection will come through XSS. In an effort to hide infections from site owners, sometimes infections are only served up if the visitor has a referrer tag from a search engine in their request.

You can also run 3rd party scanners against your website. http://www.antihacksecurity.com/scan-a-website-for-virus-malware lists some of those options.

Since you're talking about your machines connected to the same server, I'm assuming you mean a LAN environment where that server also offers file sharing. Among other things, it's often very good practice to split servers that offer external facing services from those offering internal facing services. Further, that poses the idea that the server may have been compromised and then used as a launching point to infect your machines.

Identifying the particular infection will also allow you to research the most common way that it is transmitted. Most virus packages are full packages that an attacker can drop & move on. That means they'll behave the same way.

Ultimately, verification breaks down into two possible areas: scan try to find "bad stuff" or authoritatively certify that everything on your server is "good stuff." The second one is more secure, but requires the right type of environment and planning.

share|improve this answer
1  
+1 for splitting the website from the central server. If that website is your main internet-facing website, you've GOT to move that to a DMZ and off your main server. If not, you're just letting the world into your company. –  schroeder May 1 '12 at 14:23
    
Thanks this was a huge help. I've posted the results of my scan in another question security.stackexchange.com/questions/14474/… –  PhilipK May 1 '12 at 15:16
add comment

You should use a firewall on your server to protect these kind of viruses coming from a website.Most of the times firewall can detect the viruses and discard them.And if there are certain cases where a virus can bypass the firewall in this case run an antivirus on each of the system to detect and remove the virus.

share|improve this answer
    
Thanks, I will keep this in mind. However we still want to investigate our own website, to protect our users. –  PhilipK May 1 '12 at 13:52
2  
A firewall will not normally inspect outgoing traffic from your website for viruses. Check to see if your firewall even has this capability. That said, firewalls are not the best at virus detection (they add a nice to have layer, but it's not dependable). –  schroeder May 1 '12 at 14:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.