Solved

Tracking virus contaminated LAN client

Posted on 2004-10-28
374 Views
Last Modified: 2011-10-03
I run a Win2003 server with GFI Mail Security. Unlike other AV products I have used, especially on Linux platforms, GFI does not indicate where the virus came from, no IP, nothing. Does anyone know of any software which I can run analyse the LAN and can tell me the IP of the client(s) which are sending mass emails because of virus infection.
I have used ethereal but the info it produces on all network traffic is just too much!
0
Question by:garywowen
    4 Comments
     
    LVL 7

    Expert Comment

    by:shahrial
    Ethereal is a good choice...set filter to capture only SMTP, POP3, IMAP, HTTP traffic.
    For best effect, read the manual...;-)

    Ethereal User Guide V2.00 for Ethereal 0.10.5
    http://www.ethereal.com/docs/user-guide/
    0
     
    LVL 7

    Accepted Solution

    by:
    Next, you can use GFI LANguard Network Security Scanner (N.S.S.)
    http://www.gfi.com/lannetscan/

    Automatically detect security vulnerabilities on your network
    GFI LANguard Network Security Scanner (N.S.S.) checks your network for all potential methods that a hacker might use to attack it. By analyzing the operating system and the applications running on your network, GFI LANguard N.S.S. identifies possible security holes. In other words, it plays the devil's advocate and alerts you to weaknesses before a hacker can find them, enabling you to deal with these issues before a hacker can exploit them.

    Provides in-depth information about all machines/devices
    GFI LANguard N.S.S. scans your entire network, IP by IP, and provides information such as service pack level of the machine, missing security patches, open shares, open ports, services/applications active on the computer, key registry entries, weak passwords, users and groups, and more. Scan results can easily be analyzed using filters and reports, enabling you to proactively secure your network - for example, by shutting down unnecessary ports, closing shares, installing service packs and hotfixes, etc.

    Patch management
    GFI LANguard N.S.S. is also a complete patch management solution. After it has scanned your network and determined missing patches and service packs - both in the operating system (OS) and in the applications - you can use GFI LANguard N.S.S. to deploy those service packs and patches network-wide. It can also deploy custom software network-wide.

    Good Luck ...;-)

    0
     
    LVL 7

    Expert Comment

    by:shahrial
    Errr... btw, you can download a free trial,
    http://www.gfi.com/downloads/downloads.asp?pid=8&lid=1

    This should get you started...;-)
    0
     
    LVL 1

    Expert Comment

    by:thegeezer
    consider a program like Norton SAV? this will let you install to, keep updated and scan the whole network with three mouse clicks... alternatively Panda Software do somethin that works well too

    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    This is a short article about OS X KeRanger, and what people can do to get rid of it.
    Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…
    Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

    913 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    13 Experts available now in Live!

    Get 1:1 Help Now