About Expert


Key Topics
Explain the steps you would take if one of your organization. Main servers was infected by malware. Use outside research to support your process. Be sure to cite the resources you use in proper APA formatting.
When the server gets affected, it becomes really hard for the organization to make it functional again. This is so because as described in the scenario that it is one of the main servers. Thus all important files, user load, user requests and all other attached processes are affected due to this. Yet there are certain measures that can be taken in advance to protect the server and avoid any attacks like malware, spyware, worms, viruses etc.
But as we see that the system has already been infected, thus the certain steps that can be followed to disinfect the server are:
1. DISABLE ALL THE PROTOCOLS: firstly all the protocols being supported by the server, for example, if it is a mail server, SMTP or PO3 must be disabled. This will help to stop all the traffic that is being currently directed on to the server. Hence, no load or infected files from the internet will be received.
2. DISCONNECT FROM THE INTERNET: unplug the server from the internet. This is an important step because there will be no more transfer of the infected files to the server. And if an attacker is sending the malware files, then it will be stopped.
3. FREEZE MESSAGES: there may exist certain messages in the server queue that may be infected. Thus it is important to remove the infected messages from the system and thus we have to freeze the messages so that they do not infect other messages.
4. REMOVE OR DELETE THE INFECTED MESSAGES: look out for undesirable messages and remove them.
5. USE ANTI-MALWARE SOFTWARE: anti-malware software must be installed so as to scan the server and find any infected files, programs etc. so as to remove them. This will help in making the serverless vulnerable and help in bringing it back to the functional state.
6. CLEAN THE TEMPORARY INTERNET FILES AND OTHER UNDESIRED DATA: once the scan has been completed, all the temporary and useless data must be removed from the server. This should be done because these temporary data files may contain some infected files which may again get saved on the server when connected to the internet.
7. MAKE SERVER FUNCTIONAL: once all the infected files have been removed from the server, it must be brought back to the functional state so as to test it and use it. The server must be plugged to the internet and all the protocols must be enabled and then it should be tested for the use.
8. FIX POST- PROCEDURE PROBLEMS: once the problem has been resolved, there may be certain functions that may not work properly. Hence the affected areas like permissions, registry, firewall and other updates must be fixed using desired software to make the server completely functional.
[1] Couch, A. (2013, August 27). 10 Steps To Take When You Discover Malware On Your Computer. Retrieved from www.makeuseof.com: http://www.makeuseof.com/tag/10-steps-to-take-when-you-discover-malware-on-your-computer/
[2] Posey, B. (2007, March). Five steps to cleaning a virus-infected Exchange server. Retrieved from searchitchannel.techtarget.com: http://searchitchannel.techtarget.com/tip/Five-steps-to-cleaning-a-virus-infected-Exchange-server