Find out source of viruses?

[pelajhia]

I have recently inherited some servers at my workplace; I know next to nothing about dealing with viruses.
One of the servers just recently received updated security patching (previous admin did not make sure this was up to date). Since then the virus scan has been daily deleting viruses (mostly adware) from the ie cookies folder of one particular user.
Could I assume this user's machine is also infected? I did not assume this at first, but after a few days of this, I am beginning to wonder. They have logged on from time to time. Could they be re-infecting the server?

thanks!

 

[sggaunt]

Any machine that's regularly used for 'surfing' will pick up lots of 'Tracking cookies' these are not very dangerous.
What exactly is detected?

If your server based AV/AS application is up to the job it will have stopped the adware getting past, but I would check the workstation/s anyway.

A lots depends on the scale and type of your network, Mine is small and its not worth installing high end AV/As on it.
So it just runs a NAT/Proxy router, and all the workstations have local security.

I cannot stop my boss (and director) surfing the web, so I cannot setup blocking policies, but that might be an option for you.







Steve [The sane]: Delphi a feersum engin indeed.

 

[Trevatwork]

Hi

You can use wireshark to check the the suspect machine for spyware virus activity etc.

There are some great tutorials for doing this just google wireshark or ethereal

Trevor

 

[Trevatwork]

This is a good tutorial

http://www.chrissanders.org/?p=47

Trevor

 

[pelajhia]

thanks everybody!