tracking source of virus

tracking source of virus
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
tracking source of virus Eddie 12-14-2005
Posted by Leythos on December 17, 2005, 1:06 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
says...
> You might also mention that spyware is a huge problem these days and
> becoming infected is not a reflection on admin competence, it's a fact of
> life that there are skilled professionals working against us all.

Spyware can be stopped by the firewall, but only for a company that is
willing to filter HTTP content and email content. We actually filter all
HTTP session content to block anything that could be malicious, same in
SMTP Sessions, and have not had any malware on our clients machines -
for the ones that can live with the filtered SMTP and HTTP method.

As an example, in my home, all HTTP and SMTP traffic is filtered, and
even with 3 teens, going where they can, nothing makes it to their PC's
that could be considered malware.

--

spam999free@rrohio.com
remove 999 in order to email me

Posted by Charlie Tame on December 17, 2005, 5:17 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> says...
>> You might also mention that spyware is a huge problem these days and
>> becoming infected is not a reflection on admin competence, it's a fact of
>> life that there are skilled professionals working against us all.
>
> Spyware can be stopped by the firewall, but only for a company that is
> willing to filter HTTP content and email content. We actually filter all
> HTTP session content to block anything that could be malicious, same in
> SMTP Sessions, and have not had any malware on our clients machines -
> for the ones that can live with the filtered SMTP and HTTP method.
>
> As an example, in my home, all HTTP and SMTP traffic is filtered, and
> even with 3 teens, going where they can, nothing makes it to their PC's
> that could be considered malware.

Yes of course there's usually some 'Ifs" involved, but the OP has enough
problems with plain viruses if they don't do something to protect the
ordinary users. I think a large part of the problem is that people now
recognize "Viruses" as being "Nasty" but as yet haven't got spyware labeled
as such... That they recognize viruses does not prevent accidents of course
:)

Charlie



Posted by David H. Lipman on December 14, 2005, 4:54 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| I hope I'm in the right place for this question.
|
| Recently, we are being attacked by several viruses. There are appromximately
| 200 computers and we are cleaning them up one at a time. Is there any way to
| find the source or the culprit who is spreading the viruses?
|
| We use Microsoft 2000 server and Novell 6,
| Norton Corporate edition 7
|
| Thanks

Track the source ?

Microsoft offers rewards $250,000 to find the "source". This is not an easy
task.

Some may be easy, for example the Melissa Virus. Others have never been solved
and have
caused 10's to 100's of millions of dollars in losses.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Charlie Tame on December 15, 2005, 7:57 am
If you were  Registered and logged in, you could reply and use other advanced thread options
As a first step look at the Norton site and see which of the virus problems
can spread through network shares etc. I don't know if it would be worth
noting the file times and dates to see if you can work backwards to a
starting location - I guess that depends on how closely the clock are
synchronized etc.

You said "We" so can someone keep an eye on cleaned machines for signs of
reinfection? No AV is perfect so it is possible that some Virus or some
variant could reinfect a cleaned machine and you will just go around in
circles.

I agree with other replies, if you could list what it's found it may be
easier to help you out ...

Charlie

>I hope I'm in the right place for this question.
>
> Recently, we are being attacked by several viruses. There are
> appromximately
> 200 computers and we are cleaning them up one at a time. Is there any way
> to
> find the source or the culprit who is spreading the viruses?
>
> We use Microsoft 2000 server and Novell 6,
> Norton Corporate edition 7
>
> Thanks



Posted by =?Utf-8?B?RWRkaWU=?= on December 15, 2005, 11:42 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks guys,

We're getting Mirc, spybotw32, nqhkiss you, lots of them.
I'm trying to track the pc in our network that may be infecting us.

The problem is that we share our internet network with the State. We know it
came from them, but can't locate the actual computer that's causing the
problem.

We did find two pc's with no virus protection (darn interns) but they are
cleaned up now.

Hope this is enough info. I will certainly appreciate any other comments and
suggestions for avoiding this again.

Thanks,

Ed

"Charlie Tame" wrote:

> As a first step look at the Norton site and see which of the virus problems
> can spread through network shares etc. I don't know if it would be worth
> noting the file times and dates to see if you can work backwards to a
> starting location - I guess that depends on how closely the clock are
> synchronized etc.
>
> You said "We" so can someone keep an eye on cleaned machines for signs of
> reinfection? No AV is perfect so it is possible that some Virus or some
> variant could reinfect a cleaned machine and you will just go around in
> circles.
>
> I agree with other replies, if you could list what it's found it may be
> easier to help you out ...
>
> Charlie
>
> >I hope I'm in the right place for this question.
> >
> > Recently, we are being attacked by several viruses. There are
> > appromximately
> > 200 computers and we are cleaning them up one at a time. Is there any way
> > to
> > find the source or the culprit who is spreading the viruses?
> >
> > We use Microsoft 2000 server and Novell 6,
> > Norton Corporate edition 7
> >
> > Thanks
>
>
>

Similar ThreadsPosted
Tracking Cookie January 13, 2008, 7:09 am
THE > SUPER-MONEY-SOURCE < December 22, 2005, 6:56 pm
How to find detected "hijacker" source March 20, 2008, 12:15 pm
Open Source Internet Filtering application April 2, 2007, 4:18 pm
HELP: Virus is preventing me from installing anti virus software!! January 11, 2007, 2:17 am
I have a virus that uses "anti virus software" downloads as a cover up March 24, 2007, 1:40 pm
I have a worm or virus that does not allow me to go to ANY anti-virus website January 28, 2006, 10:29 pm
Caught a Virus: Virus:Trj/Shutdown.Z -- need advice June 13, 2007, 12:59 am
Vundo fix not finding vundo virus - windows tool deletes virus May 14, 2008, 2:06 pm
Does anybody know what virus i've got? July 5, 2005, 8:23 am

The site map in XML format XML site map

Contact Us | Privacy Policy