I am working in a company which have two different local networks, one for the server computers infected by a virus that had not any antivirus. I want to know which PC is responsible for the outbreak of this virus to that server. Is there any way or software to tell me the source of a virus outbreak?

  • 3
    Scan every other computer on the network with the same antivirus that detected the virus on the server. This will tell you which machines were infected, from which you may be able to map the problem to its source. If no other machines are infected, it may be possible that the virus was downloaded directly to the server by an administrator; hopefully accidentally as part of some 3rd-party software package. – Dan Jun 7 '16 at 18:43
  • This isn't related to security but to anti virus. This belongs more on Super User. – Robert Mennell Jun 7 '16 at 18:46

Do Forensics.

Capture the traffic of your local network.

Analyze the traffic, site any anomalous connection, is there any machine/s communicating with Malicious Domains or IPs?

From that stand point, you can locate the compromised computer/s.

Isolate those machines, capture images. (Date/Time, Drives, Caches, Memory etc...)

Capture System Logs, see who has been compromised first, then you can site who is the source of the outbreak.

Eradicate the infected machines or should we say, clean them, re-image them.

Lessons Learned: Implement Firewalls/IDS/IPS/Anti-Malware Softwares

Do a defense-in-depth approach.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.