Software

Ask something
Question Locked

How to detect a corrupted computer in a network?

0 helpful
7 replies

by lmayeda 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
We have a small office network of about a dozen local PCs on a domain with another 5 remote users. I'm told by my ISP that it appears that at least one of my computers has been hijacked and is sending out intermittant spam at a low level. I've sat at most of the pCs and checked them out with both Symantec Antivirus and Malwarebytes. I found 1 PC with a lot of MyWebSearch type malware (256) and cleaned it out. How can I tell which of the computers has been hijacked and if we are no longer compromised? We have a limit of X MB/3-hour period. If this limit is reached, our ISP shuts down all outgoin mail for 3 hours before it is resumdn. Any suggestions?

7 replies

by lmayeda

I installed Wireshark on my PC first rather than trying it on the server ... just to familiarize myself with how it works. There is a ton of "stuff" being generated even with my PC being pretty much idle. For me it is somewhat like learning Korean by watching a Korean movie and trying to glean what's happening. The User's Guide is helpful and I expect this to be an excellent learning experience as I fumble around. Thanks a lot!

by rob miners

is a lot of email being sent to odd addresses and you can pickup the IP address of the offending System. Good luck.

by kingbackwards

Talk with your ISP and have them set a log/trap on port 25 (if they can confirm thats the port being used for the spam) and monitor what IP's are generating information.

Obviously you'll need to sort out what is going to your actual mail server (unless you don't use the default SMTP port)

by lmayeda

I was troubleshooting why we exceeded our email quota (on a Saturday with only 3 users online) with our ISP who we use for our mail server(s). It was then that they were able to determine that one of the computers on our DSL was spamming but at an intermittant and low level. Will confer with them further. Thanks.

This discussion is closed to new replies.