Kenzero Virus

[slgrieb]

I have a client who owns two hotels, and within a 4 month period, I had to reformat and reload Windows on each of the front desk computers at one property. That was a trivial task, but afterwards, reinstalling printers, Symantec Endpoint Security, and reconfiguring their hotel management software took about 2 hours. When I had to do the second machine, I came on site with an external hard drive, imaged both machines, and promptly had the manager lock it in the safe.

Not surprisingly, both times I nuked the machines was due to malware infections. Where this really gets sorta interesting is that the 2 front desk computers, printers, reservation system, credit card processing, and the server for the system as well as the manager's office are on their own LAN and router entirely separate from the remainder of the property. The router in the system has most ports that aren't actually in use by the system closed, and the connection uses the franchise's corporate proxy server as the DNS server. The proxy server is also supposed to incorporate extensive site blocking.

Nevertheless, both machines were so infected that I could reformat and reinstall faster than I could disinfect. In each case the only warning reported by Endpoint Security was a false positive about a LogMeIn component.