I had a user that was getting FunLove virus alerts on a daily basis. Ran the anti-virus, ran the update, ran custom anti-virus manual cleansing routines. Finally checked her permissions. Duh! File and print sharing was on and her C: drive was open to anyone who could get through our firewall. Disallowed sharing and taadaa! no more virus alerts.

I figured the source of these infections had to be within the company somewhere but we have business units all over the world and what with the trusted/ing relationships with NT networks, there was no way of telling just where the attacks were originating. Until I thought of using a packet sniffer.

Since I wasn't getting any other reports of virus activity, I decided on a little experiment. I found an old unused box and set it up with file and print sharing on, attached a packet sniffer to it and started logging all ip activity. Less than 12 hours later we had contact. Looking through the logs, I found a few bits of clear text in the packets that showed the offending box was based at one of my parent company's subsidiaries, Penguin books, UK. Other business units have been infected by this box and finding it's IP address and general location has made me the hero for the day.

Obviously, the question that is implied is, "Where the hell should I post this?"

And, just as obviously, your answer is "Not here."