Gameover Zeus
I have an outside company monitoring my traffic coming and going for my ISP and recently I was told that it possible that there is a PC on my network that might be infected with the Gameover Zeus virus is there a good way to track this down to see what user might be causing this problem?
Thanks
Thanks
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Guess it depends on the setup;
1 - for small business, standard router to a small amount of workstation PCs, you should install and run Malwarebytes Antimalware (MBAM), the free version is fantastic and removes alot of problems. A simple email asking users if anyone is having major problems with popups or redirects might narrow your search or give you a good starting point.
2 - if you have a firewall/domain/some monitoring software, you can try to start with traffic logs. A bot infected PC alot of times will be using traffic even after hours. So if you see traffic at 10 at night while everyone is away you can narrow it down to that.
As for the removal itself, I usually run;
1 - Combofix, safe mode if possible
2 - MBAM
3 - SuperAntispyware
That's a good start.
1 - for small business, standard router to a small amount of workstation PCs, you should install and run Malwarebytes Antimalware (MBAM), the free version is fantastic and removes alot of problems. A simple email asking users if anyone is having major problems with popups or redirects might narrow your search or give you a good starting point.
2 - if you have a firewall/domain/some monitoring software, you can try to start with traffic logs. A bot infected PC alot of times will be using traffic even after hours. So if you see traffic at 10 at night while everyone is away you can narrow it down to that.
As for the removal itself, I usually run;
1 - Combofix, safe mode if possible
2 - MBAM
3 - SuperAntispyware
That's a good start.
If so don't they report into a console centrally. You can either run the Anti-Virus's on all machines and see if one detects the infection (most AV's will have their definitions up to date to look for the Gameover Zeus infection)
Or look into getting an AV which can report into a console centrally like a managed AV solution:
http://www.avast.com/en-gb/endpoint-protection-suite
http://www.avg.com/gb-en/product-avg-admin