Re: Analyzing Suspicious Attachment

Hello Al,

I recommend you this book:

http://www.amazon.com/gp/product/0321240693

It's a great introduction to the topic of digital forensics. In fact,
it has an entire chapter devoted to your specific question ("I have
one of my host infected, how can I know if any damage has been done to
my network?").

Regards

Dante


2008/1/17, Al Cooper <cooper@xxxxxxxxxxxxxxx>:
We had a user open a suspicious attachment. The attachment did not open so
she sent it to two of her colleges. One of her colleges was also unable to
open the file, but the third person did successfully open the file. The
attachment did not match the original email and IT was eventually called, a
few hours later. The three computer have been removed from the network.

I have the attachment. It is a zip file. Inside the zip file is one .scr
file. The antivirus (Symantec) did not catch anything when the file was
opened. The email is an HTML email and there are pictures that can be
downloaded.

Outside of the obvious policy and training issues, what is the best way to
determine what if any damage has been done to the network? What tools do I
need to analysis the attachment to see what it is and how it works?

Thanks for your help,




--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.



Relevant Pages

  • Re: ANy University/COllege admins out there?
    ... >> I find the approach to network security borders on schitzoid. ... Well the Colleges named in the RIAA lawsuits miraculously found legal ... Especially since they do residences and open public areas. ... I'm currently jockeying to use a firewall to implement the residences ...
    (comp.security.firewalls)
  • Re: The Lasting Impact of Sonys Rootkit
    ... "The Internet was built for maximum survivability in a nuclear war. ... point-to-point circuits of dedicated wiring. ... "Damage, as in, nuclear damage. ... When a segment of the network ...
    (comp.dcom.telecom)
  • RE: Analyzing Suspicious Attachment
    ... from an unidentified source (if you can't walk over and smack them, ... We had a user open a suspicious attachment. ... she sent it to two of her colleges. ... The three computer have been removed from the network. ...
    (Security-Basics)
  • Re: Damaged book
    ... of smoke and water damage, so it can be done, you'll just have to ... Most big cities and towns with large colleges have them. ... Most rebind jobs get a plain heavy-duty cover and plain endsheets, ... They also usually trim the page edges, so if there is any applied gold and such, it will be lost unless you tell them not to trim. ...
    (misc.consumers)
  • Re: Theft of WiFi charge in Florida
    ... >> unfair discrimination against computer networks, ... > It is theft of service; no damage has to be proven. ... > computer network. ... Following the idea that you must have explicit permission to use someone ...
    (comp.sys.mac.comm)