tracking the virus

[superdave1984]

How do I go about trying to track down where a virus came from? We get few here, but I would like to try to see where they come from. They are coming from the internet, but there doesn't seem to be a pattern.

 

[talldude123]

Viruses are usually hidden in EXE files, and are very hard to find out where they came from, or how they were designed.

Are you trying to send a hatemail to the creator of the virus?

 

[superdave1984]

Viruses are usually hidden in EXE files, and are very hard to find out where they came from, or how they were designed.

Are you trying to send a hatemail to the creator of the virus?

Nah, I just want to see WTF is going on. We have a pretty tough internet filter here. There's no way anybody is getting porn or anything. And 75% of the users don't have rights to install anything. It isn't the same PC getting them either. It varies. Maybe find out the website that it was on or something.

 

[Jam3s-Zer0]

Do you still have the virus quarantined?

Tell me the name and if you want, upload it to www.megaupload.com in a passworded rar file, then pm me the link and password and i'll take a look. If you do, call the rar file a random name not the virus name :>

 

[superdave1984]

They have been deleted, but this is what the log says.
One is named: price20-Dec-2006[1].zip
The other is: xyhtlpweim.exe

 

[Osiris]

Nah, I just want to see WTF is going on. We have a pretty tough internet filter here. There's no way anybody is getting porn or anything. And 75% of the users don't have rights to install anything. It isn't the same PC getting them either. It varies. Maybe find out the website that it was on or something.

well that leaves 25% more to get viruses on their machines. Those names arent helpful at all. Either is a network virus that is shooting from machine to machine or whatever program that is finding the file is flagging in as a virus because its an unknown .exe If its a different machine and different files then it may be the user. .exe's dont always need admin right to run anyways. If that was true it would be a lot easier on us admins

 

[Jam3s-Zer0]

Is this still occuring on your network and if so, do you still need support?

 

[superdave1984]

Is this still occuring on your network and if so, do you still need support?

Haven't gotten one in a few days. Symantec catches them, but I'm just irritated about it all. Maybe I'm just stressing over something that gets handled automatically and quarrantined anyway.

 

[Jam3s-Zer0]

Well, I guess its ok as long as its not causing any problems