6

My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the tech department, and they simply told him not to worry about it and continue his work as normal, as they will look at it at the end of the day after he is out of work. I was pretty surprised by this, as I would assume that a virus detection could possibly be any form of malicious code that could potentially infect the network, and compromise my colleague's data. A virus could potentially lead to stolen confidential data.

Am I missing something here? Do companies monitor the network in a way that they feel secure about a potential virus on one user's machine.

Improve this question
4
  • 8
    There's two possible states I can think of: 1) The AV caught it on 'entry', stopped it, removed it, and logged it, at which point there's nothing else for anybody to really do; and 2) The AV just now noticed something that's been present for a while, so you're already 'compromised'; potentially, any data would have been already exfiltrated, and there's nothing to do but check the logs...
    – Clockwork-Muse
    Commented Nov 27, 2012 at 0:58
  • 2
    @Clockwork-Muse: you might want to make a full-fledged answer out of that comment; it seems right on spot to me.
    – Thomas Pornin
    Commented Nov 27, 2012 at 2:11
  • @Clockwork-Muse I second that, and think a full answer would benefit this site's users
    – makerofthings7
    Commented Nov 27, 2012 at 17:42
  • Fine, twist my arm will you...
    – Clockwork-Muse
    Commented Nov 27, 2012 at 18:10

2 Answers 2

Reset to default
7

There's two possible states I can think of:

  1. The AV caught it on 'entry', stopped it, removed it, and logged it, at which point there's nothing else for anybody to really do
  2. The AV just now noticed something that's been present for a while, so you're already 'compromised'; potentially, any data could have already been exfiltrated, and there's nothing to do but check the logs. Analysis of the logs could take a while, can be done remotely, and would include checks of other resources (say, network connections) that likely have higher priority.
Improve this answer
3
  • "nothing else for anybody to really do"? I would personally wipe the computer and restore it to a clean image (or restore from backups if there's anything important on the machine itself).
    – Tom Marthenal
    Commented Nov 29, 2012 at 17:18
  • @Tom - Depending on how your AV is setup, it'll popup notifications for even (failed) drive-by-downloading attempts, which never make it past the firewall, let alone being able to install. You'd wipe the machine for something like that?
    – Clockwork-Muse
    Commented Nov 29, 2012 at 17:36
  • If I'm responsible for ensuring the security of private financial data... probably. Better safe than sorry. I definitely would for anything that actually gets downloaded or installed. I can re-image a computer in 10 minutes of my time (and an hour or so of waiting). I'd guess that my_hourly_rate * 1 > probability_vulnerability_still_exists * cost_of_data_leak.
    – Tom Marthenal
    Commented Nov 30, 2012 at 3:13
4

If the AV is centrally managed using something like ePO (McAfee) the tech support guys probably knew what happened before he called. If the virus/trojan/worm/malware was something that was caught before it ran or is a low-threat file it's not a big deal and waiting a few hours to pick up on it isn't too unusual. Without knowing what was detected it's hard to say what I would do but I wouldn't go running off to the desktop for something that was caught either. Adding to that; there's plenty of things they can do across the network without needing to visit the workstation.

There are quite a few bits of nasty code out there that can be brought down by simply browsing the web that are caught by most up-to-date antivirus solutions. If it was caught and prevented from running then there's really not much to do other than slap the user's hand for browsing unsafe sites.

To address your title question; 'How serious is a local virus in terms of network security?'

The severity depends on what the virus is, how it was caught, where it was caught, and also what it's impact to the network or system would be if executed. For little drive-by downloaders it's really not as scary. If the detection was a rootkit related file in C:\Windows\sytem32 then I'd be more concerned.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .