Tracking virus contaminated LAN client

I run a Win2003 server with GFI Mail Security. Unlike other AV products I have used, especially on Linux platforms, GFI does not indicate where the virus came from, no IP, nothing. Does anyone know of any software which I can run analyse the LAN and can tell me the IP of the client(s) which are sending mass emails because of virus infection.
I have used ethereal but the info it produces on all network traffic is just too much!
Who is Participating?
shahrialConnect With a Mentor Commented:
Next, you can use GFI LANguard Network Security Scanner (N.S.S.)

Automatically detect security vulnerabilities on your network
GFI LANguard Network Security Scanner (N.S.S.) checks your network for all potential methods that a hacker might use to attack it. By analyzing the operating system and the applications running on your network, GFI LANguard N.S.S. identifies possible security holes. In other words, it plays the devil's advocate and alerts you to weaknesses before a hacker can find them, enabling you to deal with these issues before a hacker can exploit them.

Provides in-depth information about all machines/devices
GFI LANguard N.S.S. scans your entire network, IP by IP, and provides information such as service pack level of the machine, missing security patches, open shares, open ports, services/applications active on the computer, key registry entries, weak passwords, users and groups, and more. Scan results can easily be analyzed using filters and reports, enabling you to proactively secure your network - for example, by shutting down unnecessary ports, closing shares, installing service packs and hotfixes, etc.

Patch management
GFI LANguard N.S.S. is also a complete patch management solution. After it has scanned your network and determined missing patches and service packs - both in the operating system (OS) and in the applications - you can use GFI LANguard N.S.S. to deploy those service packs and patches network-wide. It can also deploy custom software network-wide.

Good Luck ...;-)

Ethereal is a good choice...set filter to capture only SMTP, POP3, IMAP, HTTP traffic.
For best effect, read the manual...;-)

Ethereal User Guide V2.00 for Ethereal 0.10.5
Errr... btw, you can download a free trial,

This should get you started...;-)
consider a program like Norton SAV? this will let you install to, keep updated and scan the whole network with three mouse clicks... alternatively Panda Software do somethin that works well too

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.