Tracking the source of a virus

[licarse]

Hi,

Something strange is happening on our LAN. Suddenly, some computers (including mine) started to detect some other(s) computer(s) trying to infect them. Infections haven't been successful, as Norton always delete security risks/viruses.

However, it's annoying that whenever a computer detects a virus, users start to get anxious and think that their computers were infected. The typical scenario is this:

1. Computer A says that a virus has been detected (for instance, a troyan, a virus, etc. in the hard disk) and that the risk has been eliminated.

2. A technician checks the computer. No virus is found.

All computers in the network are up-to-date with security patches (all running XP SP2), and virus definitions are also up-to-date.

My only guess is that maybe one (or maybe more, but it is not likely) computer got somehow infected, and it is trying to infect others. Is there any way to trace the source easily, like using some kind of software?

 

[kjv1611]

Is this network on a Windows domain, or is it just a small network of PCs in a workgroup? I'm sure that'll make a difference. I would think that there are logs kept on the domain server somewhere that would keep track of that sort of thing, or that it could be enabled.

Also, just in case, you are aware that SP3 is the latest service pack from MS, right? I know that corporations cannot always be up to the minute updated to the service packs due to concerns about issues with all the various applications accross various PCs, but if that is no concern, you might want to make sure all PCs are updated to SP3.

--

"If to err is human, then I must be some kind of human!" -Me

 

[licarse]

Thanks for your prompt reply kjv1611.

Yes, it is a windows domain, it is running on 2003 server.

Domain logs are not showing up anything abnormal... that's why I wanted to get some advice on software for tracking the source.

And yes, I'm aware of SP3, but as you said, we can't install it right now... however, all other patches are already installed on all pcs and servers.

 

[Salem]

Setup

http://www.wireshark.org/

on a spare machine, let it record ALL the local network traffic.

When the next alert happens, you can correlate that with the recorded network traffic, and hopefully figure out who's sending the problem data which triggers the virus scanners.



--
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.