I am working in a company which have two different local networks, one for the server computers infected by a virus that had not any antivirus. I want to know which PC is responsible for the outbreak of this virus to that server. Is there any way or software to tell me the source of a virus outbreak?
closed as too broad by Robert Mennell, André Borie, Anders, Mike Ounsworth, tlng05 Jun 8 '16 at 0:14
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Capture the traffic of your local network.
Analyze the traffic, site any anomalous connection, is there any machine/s communicating with Malicious Domains or IPs?
From that stand point, you can locate the compromised computer/s.
Isolate those machines, capture images. (Date/Time, Drives, Caches, Memory etc...)
Capture System Logs, see who has been compromised first, then you can site who is the source of the outbreak.
Eradicate the infected machines or should we say, clean them, re-image them.
Lessons Learned: Implement Firewalls/IDS/IPS/Anti-Malware Softwares
Do a defense-in-depth approach.