Link to home
Start Free TrialLog in
Avatar of garywowen
garywowen

asked on

Tracking virus contaminated LAN client

I run a Win2003 server with GFI Mail Security. Unlike other AV products I have used, especially on Linux platforms, GFI does not indicate where the virus came from, no IP, nothing. Does anyone know of any software which I can run analyse the LAN and can tell me the IP of the client(s) which are sending mass emails because of virus infection.
I have used ethereal but the info it produces on all network traffic is just too much!
Avatar of shahrial
shahrial
Flag of Singapore image

Ethereal is a good choice...set filter to capture only SMTP, POP3, IMAP, HTTP traffic.
For best effect, read the manual...;-)

Ethereal User Guide V2.00 for Ethereal 0.10.5
http://www.ethereal.com/docs/user-guide/
ASKER CERTIFIED SOLUTION
Avatar of shahrial
shahrial
Flag of Singapore image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Errr... btw, you can download a free trial,
http://www.gfi.com/downloads/downloads.asp?pid=8&lid=1

This should get you started...;-)
Avatar of thegeezer
thegeezer

consider a program like Norton SAV? this will let you install to, keep updated and scan the whole network with three mouse clicks... alternatively Panda Software do somethin that works well too