Help with exploit in windows/inf folder

Hi,

Please ensure that the latest copy of Antivirus is running on the sytems with latest definitions. In your case, you may lodge a complaint with your Incident Response team (if you have one) or take the next steps depending upon your security policy. This could mean interrogating users, checking their permissions, etc.... You may also approach Law Enforcement agencies to help you out in nabbing the intruder.

You may have the machine cloned for a forensic analysis. You may choose to lurethe intruder to continue using the system (This seems to be a Trojan program like Back Orifice or Subseven ..)and then catch hold of the guy red handed. Examine issues like employee cooperation in intruder's attempt to compromise the system or non-compliance of security policy.

Finally, when you are done with this, examine organizational security policy, examine assets, threats to those assets and then devise strategies to mitigate them. You may choose to get a consultant to help you chalk out a roadmap for you. If possible, upgrade to Windows 2000 professional for enhanced security and other administrative enhancements that accompany the OS.

Thanks,
--Rookie

PS: Let me know, if you need more help in each of these areas

Hummmmm....
email address from college in Santa Barbara,
running Windows 98,
have movies and MP3s,
just a couple of users

How do you know that the files are from an "outside source" ? What happens if the files are removed (moved or deleted), do they or others reappear ? I assume the couple of users know nothing about how the the files got there and that they are connected to a college network.

I would first look for a P2P file sharing system like Napster, Gnutella, Morpheus, Kazaa, etc on those machines. Then check the settings of any instant messenger software (ICQ, AOL IM ,etc) to see if they have allowed file sharing and to where. Also see if the users have shared their drives locally. If that fails, blame it on the janitorialstaff. d:)

If you do find the any of the above, what you do about it will depend on whose machines they are: yours(the college) or theirs(the users).

The following link will give you a wealth of security, virus, exploit links plus security news.

http://www.infosyssec.com/infosyssec/index.shtml

PS: have fun

PPS: which movies/MP3s are showing up ? I may not have them yet.