Hello guys,
A client is having issues that I deal with regularly which I originally found was infected with some variants of Conficker.
However, the delicate balance to this is their environment has CNC machines that have integrated hardware into the CNC machine which makes upgrading the hardware/software near impossible without a new machine/manufacturing tech.
So about 10 machines are running Windows 2000 which are obviously the ones that cannot be rid of Conficker. (It keeps re-infecting the machines through file sharing)
So, the remaining computers on the network almost all run Win7 and are more or less immune from Conficker, and the next problem that occured was those machines were spamming BOTNETs and get us on the CBL ABUSE RBL list.
Since they have a pretty new and solid Sonicwall NSA250 firewall, I did some research and made a rule...