The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    How to know which computer in the LAN dropped a malicious file?

    Discussion in 'Security and Anti-Virus Software' started by agusman, Sep 1, 2009.

  1. agusman

    agusman when the going gets weird

    Reputations:
    440
    Messages:
    794
    Likes Received:
    0
    Trophy Points:
    30
    At work we a LAN set up with over 100 computers, and everyone has shared folders.

    Lately, in many different computers our antivirus sotware has been finding infected files, which ussually are 6 random letters and .exe, and these files always show up in shared folders.

    I assume having this file doesn't mean the computer is infected, but that another infected computer in the network dropped the file there.

    Now, is there a way to know which computer in the network dropped the file?

    I would *really* like to go over to that person's computer and politely update their antivirus...

    thanks is advance
     
    agusman, Sep 1, 2009
    #1
  2. DetlevCM

    DetlevCM Notebook Nobel Laureate

    Reputations:
    4,843
    Messages:
    8,389
    Likes Received:
    1
    Trophy Points:
    205
    I suppose you can try the owner's details via explorer...
     
    DetlevCM, Sep 1, 2009
    #2
  3. agusman

    agusman when the going gets weird

    Reputations:
    440
    Messages:
    794
    Likes Received:
    0
    Trophy Points:
    30
    tried that, but there is no info on the properties that could lead me to the infected computer...
     
    agusman, Sep 4, 2009
    #3
  4. NlightN

    NlightN Notebook Guru

    Reputations:
    27
    Messages:
    70
    Likes Received:
    0
    Trophy Points:
    15
    Do users need to login to use the PC?
    Start looking at timestamps and traffic logs

    Just guess here

    N
     
    NlightN, Sep 4, 2009
    #4
  5. kegobeer

    kegobeer 1 hr late but moving fast

    Reputations:
    836
    Messages:
    3,682
    Likes Received:
    0
    Trophy Points:
    105
    What server OS are you running (or is this just a large workgroup)?
     
    kegobeer, Sep 4, 2009
    #5
  6. agusman

    agusman when the going gets weird

    Reputations:
    440
    Messages:
    794
    Likes Received:
    0
    Trophy Points:
    30
    The server runs on Linux. I am not the network administrator, so I don't have much access or knowledge about the network.

    Someone suggested me to take captions with WireShark, while connected to a switch, but I am not sure how to spot virus movements in those logs (captions)...
     
    agusman, Sep 15, 2009
    #6
  7. kegobeer

    kegobeer 1 hr late but moving fast

    Reputations:
    836
    Messages:
    3,682
    Likes Received:
    0
    Trophy Points:
    105
    The network administrator will know if it's possible to track where the files came from. I'd start with him/her.
     
    kegobeer, Sep 15, 2009
    #7
  8. surfasb

    surfasb Titles Shmm-itles

    Reputations:
    2,637
    Messages:
    6,370
    Likes Received:
    0
    Trophy Points:
    205
    That's too bad. I know Windows has Object Access Audit Policy specifically for situations like this.
     
    surfasb, Sep 16, 2009
    #8