Re: what is the best procedure to track down a potentially new virus/worm/etc?

John - 

What version of OfficeScan are you using? OfficeScan 6.5 does detect
malware and spyware... If you are using that version, you can try and
use Spybot and/or adaware. PestPatrol is another good product for
eradication of those little pests.

Good luck... 



On Tue, 14 Dec 2004 14:19:34 -0600, John Barton
<jbarton@technicalworks.net> wrote:
> > It it were UNIX, I could use commands like socklist and netstat to
> > track down the malware processes. But in Windows XP, I don't know what
> > to use. Are there any built-in utilities? Some freeware stuff? All
> > help is welcome.
>
> There should be something here you can use to determine which process is
> the culprit...
>
> > And regarding the IRC server IPs, is it worthwhile to report them to
> > the authorities specified in the whois databases?
>
> It can't hurt, the ISP may or may not act on your information, but it is
> worth a shot. It would greatly help your case if you sent them copies of
> your logs containing the pertinent information..
>
> > Cheers,
> >
> > Rodrigo
> Regards,
> -John
>
> John Barton
> jbarton@technicalworks.net