Good afternoon,
One of our clients has been getting alerts from their ISP (Cox Business) alerting that one or more computers in their business are infected with Alureon / TDSS. I've been doing everything in my knowledge to hunt it down, but this is an area I'm not the strongest in and I could use some help. Furthermore the environment contains a few dozen workstations and I'm only one person working remotely (most of the time), so in depth scanning at each workstation could be costly and fruitless unless I can narrow some things down.
Our monitoring package integrates AV Defender (BitDefender) and I have daily quick scans and weekly full scans scheduled. I have also used PSexec to run TDSSKiller on all workstations over the network. From the log files it looks like nothing was found on any of them.
Some other potential issues: their...