tracking source of virus

tracking source of virus

Secure Home | Search | About
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
tracking source of virus Eddie 12-14-2005
Posted by Bearmann on December 14, 2005, 3:58 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Norton Corporate 7 is too old. That is probably why they all got infected.
Symantec corp 10 is the latest




>I hope I'm in the right place for this question.
>
> Recently, we are being attacked by several viruses. There are
> appromximately
> 200 computers and we are cleaning them up one at a time. Is there any way
> to
> find the source or the culprit who is spreading the viruses?
>
> We use Microsoft 2000 server and Novell 6,
> Norton Corporate edition 7
>
> Thanks



Posted by Robert Moir on December 14, 2005, 4:40 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Eddie wrote:
> I hope I'm in the right place for this question.
>
> Recently, we are being attacked by several viruses. There are
> appromximately 200 computers and we are cleaning them up one at a
> time. Is there any way to find the source or the culprit who is
> spreading the viruses?

Depends on the virus as to what kinds of traces it leaves. It might be easy
to get a rough idea and very difficult to know for sure.


--
--
Rob Moir
Website - http://www.robertmoir.co.uk
Virtual PC 2004 FAQ - http://www.robertmoir.co.uk/win/VirtualPC2004FAQ.html
Kazaa - Software update services for your Viruses and Spyware.



Posted by Leythos on December 14, 2005, 4:45 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Eddie@discussions.microsoft.com says...
> I hope I'm in the right place for this question.
>
> Recently, we are being attacked by several viruses. There are appromximately
> 200 computers and we are cleaning them up one at a time. Is there any way to
> find the source or the culprit who is spreading the viruses?
>
> We use Microsoft 2000 server and Novell 6,
> Norton Corporate edition 7

Using Norton 7 is a massive hole - the latest engine is 10, and if you
were maintaining your security subscription, which you were suppose to
renew each year, you would have been entitled to the upgrades for free,
so 10 would be free.

I suspect that you don't have a secure network to begin with - meaning
that you don't filter SMTP sessions for malware/content, that you don't
filter HTTP sessions for malware/content, that you let users run as
Local Administrators when they don't really need to.

Don't worry about where it came from, worry about how you're going to
stop the next outbreak with such a lax security
plan/method/implementation.

--

spam999free@rrohio.com
remove 999 in order to email me

Posted by =?Utf-8?B?RWRkaWU=?= on December 15, 2005, 11:50 am
If you were  Registered and logged in, you could reply and use other advanced thread options
We are definately behind the times here. We have not updated to av 10 because
our server is NT based and AV does not support it. (according to my boss).

I will reccomend that we update our spam server to track malware, and get a
new server as well.

I can use these suggestion to prove to my boss that we are looking for these
problems because of our poor security.

Thanks again,

Ed

"Leythos" wrote:

> Eddie@discussions.microsoft.com says...
> > I hope I'm in the right place for this question.
> >
> > Recently, we are being attacked by several viruses. There are appromximately
> > 200 computers and we are cleaning them up one at a time. Is there any way to
> > find the source or the culprit who is spreading the viruses?
> >
> > We use Microsoft 2000 server and Novell 6,
> > Norton Corporate edition 7
>
> Using Norton 7 is a massive hole - the latest engine is 10, and if you
> were maintaining your security subscription, which you were suppose to
> renew each year, you would have been entitled to the upgrades for free,
> so 10 would be free.
>
> I suspect that you don't have a secure network to begin with - meaning
> that you don't filter SMTP sessions for malware/content, that you don't
> filter HTTP sessions for malware/content, that you let users run as
> Local Administrators when they don't really need to.
>
> Don't worry about where it came from, worry about how you're going to
> stop the next outbreak with such a lax security
> plan/method/implementation.
>
> --
>
> spam999free@rrohio.com
> remove 999 in order to email me
>

Posted by Charlie Tame on December 17, 2005, 12:58 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I can't speak from experience administering it but our IT people chose Trend
Corporate AV software and from what I see it's a viable alternative,
installs on whatever joins the domain etc. I don't know how it compares
price wise with Norton but it seems very light on resource usage so it's an
alternative and frankly anything is better than what you have which is by
now virtually nothing.

Have looked briefly at Panda and AVG corp as well and they all look much the
same. They tell me Kaspersky is the best but every time I've tried it it's
gotten screwed up somehow so I don't know about that... Certainly while
working it was very good.

If you suspect malicious trojans I also suggest a look at BoClean from
www.nsclean.com because it too is very light on resources and even if you
don't leave it on machines it's far quicker than "Scanning" type utilities
and makes a very useful tool while cleaning up.

You might also mention that spyware is a huge problem these days and
becoming infected is not a reflection on admin competence, it's a fact of
life that there are skilled professionals working against us all.

Charlie


> We are definately behind the times here. We have not updated to av 10
> because
> our server is NT based and AV does not support it. (according to my boss).
>
> I will reccomend that we update our spam server to track malware, and get
> a
> new server as well.
>
> I can use these suggestion to prove to my boss that we are looking for
> these
> problems because of our poor security.
>
> Thanks again,
>
> Ed
>
> "Leythos" wrote:
>
>> Eddie@discussions.microsoft.com says...
>> > I hope I'm in the right place for this question.
>> >
>> > Recently, we are being attacked by several viruses. There are
>> > appromximately
>> > 200 computers and we are cleaning them up one at a time. Is there any
>> > way to
>> > find the source or the culprit who is spreading the viruses?
>> >
>> > We use Microsoft 2000 server and Novell 6,
>> > Norton Corporate edition 7
>>
>> Using Norton 7 is a massive hole - the latest engine is 10, and if you
>> were maintaining your security subscription, which you were suppose to
>> renew each year, you would have been entitled to the upgrades for free,
>> so 10 would be free.
>>
>> I suspect that you don't have a secure network to begin with - meaning
>> that you don't filter SMTP sessions for malware/content, that you don't
>> filter HTTP sessions for malware/content, that you let users run as
>> Local Administrators when they don't really need to.
>>
>> Don't worry about where it came from, worry about how you're going to
>> stop the next outbreak with such a lax security
>> plan/method/implementation.
>>
>> --
>>
>> spam999free@rrohio.com
>> remove 999 in order to email me
>>



Similar ThreadsPosted
Tracking Cookie January 13, 2008, 7:09 am
THE > SUPER-MONEY-SOURCE < December 22, 2005, 6:56 pm
How to find detected "hijacker" source March 20, 2008, 12:15 pm
Open Source Internet Filtering application April 2, 2007, 4:18 pm
HELP: Virus is preventing me from installing anti virus software!! January 11, 2007, 2:17 am
I have a virus that uses "anti virus software" downloads as a cover up March 24, 2007, 1:40 pm
I have a worm or virus that does not allow me to go to ANY anti-virus website January 28, 2006, 10:29 pm
Caught a Virus: Virus:Trj/Shutdown.Z -- need advice June 13, 2007, 12:59 am
Vundo fix not finding vundo virus - windows tool deletes virus May 14, 2008, 2:06 pm
Does anybody know what virus i've got? July 5, 2005, 8:23 am

The site map in XML format XML site map

Contact Us | Privacy Policy