Dear All,

I suspect my LAN infected by Malware, because our IP was black listed, I am running CentOS 6.5 x64 running as gateway, is there any tools that can help me to determine the problem?

Need advise

Thanks

I might be tempted to install a firewall _going_out_ and log what's blocked. Allow ports 25, 110, 80(for smtp, pop, and http), and any others you know should be there. Look for strange ports. Log everything and read what's going out.

That being said, I believe clamav is the program to reach for.

Hello,
I am running iptables-1.4.7-11.el6.x86_64
is it possible to log the smtp, pop3, http on it?

clamav?.. do you meant to install clamav on linux gateway?

Yes, yes, all these things are possible. But you are the sysadmin, and know what you have got. You can set logging levels - you may have to restart daemons with -l or something, but it's all doable.

need your advise, according to my iptables forward config:.. did I miss something?

-A FORWARD -m string -j DROP --string "web-messenger" --algo bm --to 65535
-A FORWARD -m string -j DROP --string "webmessenger" --algo bm --to 65535
-A FORWARD -m string -j DROP --string "buddy" --algo bm --to 65535
-A FORWARD -m string -j DROP --string "meebo" --algo bm --to 65535
-A FORWARD -m string -j DROP --string "messenger" --algo bm --to 65535
-A FORWARD -m string -j DROP --string "YMSG" --algo bm --to 65535
-A FORWARD -m string -j DROP --string "hi5" --algo bm --to 65535
-A FORWARD -m string -j DROP --string "facebook" --algo bm --to 65535
-A FORWARD -m string -j DROP --string "twitter" --algo bm --to 65535
-A FORWARD -m string -j DROP --string "instagram" --algo bm --to 65535

-A FORWARD -p tcp -m tcp -m state -s 10.100.100.0/24 -d 10.100.100.6/32 --dport 25 --state NEW -j ACCEPT
-A FORWARD -p tcp -m tcp -m state -s 10.100.100.0/24 -d 10.100.100.6/32 --dport 587 --state NEW -j ACCEPT
-A FORWARD -p tcp -m tcp -m state -s 10.100.100.0/24 -d 10.100.100.6/32 --dport 110 --state NEW -j ACCEPT

-A FORWARD -j REJECT

That's pretty vague. Blacklisted where exactly?

MAILSPIKE BL and MAILSPIKE Z

any comment or idea?

thanks

Just a couple...

Static or dynamic IP?
What does the blacklist entry say?
Is it identified as a netblock that possibly includes other ranges typically assigned to "home use" computers?
Are there any Windows hosts behind this LAN?
What do the logs on the gateway host suggest is going on?

static IP
malware
not yet identified
yes there are windows in the LAN
I dont know the what log should I check and how to turn on the related log for investigating this..

thank you

You are the sysadmin.
If I applied for the job of sysadmin in this country, I wouldn't even get an interview. My CV wold go straight in the bin; and you want advice from me??

My advice is: Do your job. Log everything in and out and read those logs to find out what's going on. Make sensible decisions and implement them. Search every PC on your network for malware with the best tools you can get. Don't think you can solve this with a point and click. Sysadmins do have to work.

2 members found this post helpful.

You could watch network traffic broken down by endpoints and sorted by data volume using the iptraf utility, which is quite intuively to work with.

Scan them all with say, MalwareBytes

Thanks a lot to everyone here for the idea, sharing and comment.. make this forum is very useful to share the idea and or problem..especially for newbie to get know how .. etc

to. business_kid.. this is a free public forum and that's why everyone here could ask some idea or at least share the experience or something... you need something like commercial forum, I think you should send private message to someone looks facing un-solve problem and ask them if they need to resolve their problem soon then you offer your technical service to help them.. hopefully your CV will not go in bin again... skill + attitude is a combination that can help you to get a job, the rest you give it to God.. good luck

You are not a "newbie" if you run such a site as http://www.calistasoft.com/
that states "We provide setup and configuring routing and security for internet, intranet and extra-networking solutions for your company."

wrt: I find that I don't have to respond to every post that irritates me personally. Sometimes, you just have to exercise some discretion and ignore replies you don't like, especially on a public forum where people volunteer their time and expertise. And at least express some gratitude for any feedback.

Your claim vs. Good Luck with that.

1 members found this post helpful.

Thanks a lot Habitual!..
And you are right that I am not newbie in Linux.. again I just want to get know how other people dealing with this and also get little bit discussion about this..

Well my thought to know what other people do if they face this problem also useful


Have a nice day ahead to everyone!

1 members found this post helpful.