I post with great desperation and am in need of some serious assistance. One of the computers is infected with some botnet that is reaching out to two different sinkhole ip addresses. I know this because the CBL keeps listing us on their blacklist. I have been emailing with them back and forth and they provided which IPs to look for. I have been running wireshark on all the PC's on my network with filters set up so that I can see the specific IP's that the CBL provided me with. My issue....I checked with the CBL and 8.30am this morning there was another hit to one of the sinkhole websites but wireshark did not pick it on any of the computers.
I am stumped.....
please help!!!
The only computer that I am not monitoring is the server which no one goes on.