5Mar
Streamer Virus on offline network [closed]
I have an offline network with 200 users. and routers, switches, 4 esxi servers and 1 netapp rack.
After about a year, my team found out that we have a virus in the network called streamer.exe that is a coin miner but because the network is offline I think it's not really mining but is doing other things such as:
- copying to random places as shortcut with path to the streamer called "games.lnk" and "downloads.lnk"
- It blocks the option to write to a network drive and it shows that the drive is full while it isn't.
What we did and tried so far:
- we have Trellix Epo server with strong ens policy that when a virus is found on some PC it reports and deletes it immediately
- weekly scans over the network drives - it's not helping because while the Trellix scans, the virus copies itself to places that have already been scanned
- we did a script that will disable any PC that is not connected for more then 10 days and will demand new installation (we did this because we are afraid that there are some computers that are not connected that may contain the virus)
- we created a GPO that will block the execution of the streamer.exe but it is not helping
- we are trying to implement Trellix storage protection with netapp av connector
