Virus or Spam attack, how to remove ?

Hello experts,
I have a serious virus issue in our office

We have windows 2003 standard server running exchange 2003 and a windows 2000 server as a file server. Desktops are running XP and 2000 with Norton/Symantec antivirus corp edition 7.5 and some pc running 10.0
Few days ago a virus hit us (spybot and downloader). Some pc's were rebuit from scartch and put back onto window 2000. The problem i have is this

1. The newly rebuilt pc's once put on the network gets a qurantine message from NAV saying it qurantined downloader and or "i". Does this mean the virus is coming from the outside or is inside the network.
2. When a pc boots up, if the user dosnt login with a few minutes it comes up with "network request not supported" and if i reboot the pc and login again it is fine.
3. On 2000 boxes the network drives "disconnect" after a while.
4. Email runs fine
5. Network runs slow

My feeling is that there is still 1 or 2 pcs with some sort of spam that is spiting out data onto the network. Can you please let me know what tools i can use to remove this and also how to determine which pc's are infected.

Thanks in advance
jiveman74Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

TolomirAdministratorCommented:
you could install zonealarm on some computers to log intrusion attempts:

http://www.zonealarm.com/store/content/company/products/znalm/freeDownload.jsp

After installation, go to the "log" tab and select "firewall" log in the menu.

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
TolomirAdministratorCommented:
0
shaynegCommented:
do you have windows defender installed to stop spyware, malware etc
0
jiveman74Author Commented:
Hello experts,
Sorry for the delay and thanks for responses. I have been working full nights to sort this out. It turns out one box in the network didnt have av installed so got infected with Spybot and other viruses. Some of this was not also picked up by norton av 8.0. I had to rebuild a 2000 server and put av, windows update etc. The network request not supported error went off after I did the windows updates.

Cheers
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.