Question

A workstation is scanning ports in the LAN; however virus scan have not picked anything up (McAffee, Sophos, MS).

Is the only option to clean the hard drive?

Are there any new malware of this description that have not yet been picked-up for scanning by the anti-virus software vendors.

Answer 1

If no one is running legitimate port scans from it:

1. Pull it off the network immediately.
2. If you have the time, pull it on a dedicated, private loop and watch what it’s doing.
3. If you are doing that, have scanning software ready, restart the system in safe mode, and run the scans.
4. If you are doing that, check the typical known locations in the registry for start-up files to see if there’s anything unusual.

Whether or not you find anything, wipe the HD and restore from an image. You’ll spend more time trying to clean the system than you would re-imaging it and you won’t be 100% sure you got the system clean.