Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
Computer is infected by a virus or a malware, what do I do now?

We have a user that got several viruses. It has been deleted and cleaned but now, I need to find how she got these viruses on her computer.

I would like to know what you use to check, remotely, what can be the cause of this issue.

  • Internet logs (Browsing history)
  • Cookies
  • Tools to analyse
  • Tools that can check remotely all intrusion possibility.

I'm also looking for software that can extract info on the remote computer that can give me hints or info regarding this.

Hope this question won't be closed. It might be a good idea to write here everything to do when a virus is found on a PC on a domain but need to clean and check logs remotely.

Regards,

David.

share|improve this question

marked as duplicate by slhck, Oliver Salzburg, Simon Sheehan, Sathya Mar 7 '12 at 17:40

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
Come on! This question deserve a LOT of upvotes :) –  r0ca Oct 7 '10 at 18:57

2 Answers 2

up vote 1 down vote accepted

We periodically get viruses which install themselves into user's profiles. While these viruses don't run with admin privileges, they do get copied to every computer the user logs in as, and can send and receive data on the network, which is almost just as bad.

To detect the viruses, we scan the the fileserver where our user profiles are stored with antivirus software, and actively monitor the network for virus activity using an array of tools such a snort and firewall IP blacklists.

When we discover a virus, we make sure it is wiped from the user's roaming profile, and reimage any computers that got the virus installed in the user's local profile (which is stored on that computer, and not the fileserver).

share|improve this answer

I'd first look at whether she was somehow running as an administrator. Running as an unprivileged user is the most important way to avoid catching viruses.

Then I'd check your SUS server or in System Center, if you have them, because the #2 way to catch a virus is to use a machine that's not fully patched.

Next up is to make sure her antivirus software was up to date. Note that this is not nearly as important as the first two items - running fully-patched and unprivileged will do far more to preventing malware infection than antivirus software will. However, there's no point even thinking about looking at things like internet logs or cookies until you've checked all three of these.

share|improve this answer
    
Yes I have a WSUS server. The computer is fully (99%) updated. And she is not local admin but good idea! +1 –  r0ca Oct 7 '10 at 18:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.