Re: Conficker - your opion on how to determine the source of infection on a given network

[Gerardo Castillo Alvarado <gecastillo () edelca com ve>]

> I would like to identify the SOURCE computer where the "downadup.a" worm variant originated a given network which has 
> been infected.
>   

you can check the netlogon to look for lockout accounts or failure code.
otherwise, check this tool [1] to remotely detect the Conficker worm.


[1] http://seclists.org/nmap-hackers/2009/0001.html

Best regards!


------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------