What I am about to cover here is not exactly about virus detection, well at least not in the traditional way. This is about other steps that you can make to give you a chance. Do occasional search on your file servers (and especially the user directories) for certain pattern files that could call for bad luck. This would include .exe, .com, .scr (not necessarily a virus, but potential software instability), .vbs, .dot and the like. If your site policies are strict about drive space usage (for business purpose only), you can include .jpg, .gif, .mpg, ... It is also a good idea to make a search for known trojan horses, password crackers and stuff like that (you'd be surprised to see that some other people shares the same hobbies as you do). I used to do it with a Find files request sent over my user directories, then capture the graphical output with a automatic scrolling window capture utility, then pasted it in a .BMP file. This was ugly, but I had the job done. But this could probably be more convenient and easier to schedule such searches with batch files. I let you write this one. One last word of advice about this, especially if you're consulting: depending on where you work, some places are pretty uptight about what can actually be done by a system admin. I have seen a lawyer department referring to as "unethical" to perform such searches over the file servers, as it could reveal confidential information to prying eyes (corrupted network admins). They claimed that in some cases, the filename alone could reveal too much. I wouldn't debate about that last claim, but when you conduct a search for specific patterns for anomalies, you expect to only rake anomalies (or most of it anyway). While it is true that a business having contracts with the filename containing all the references needed to clearly identify the files content may want to over-protect such information, these files are expected to have .doc, .wks, .wp, .ppt, ... extensions. You don't expect that much company-related info when searching for executable files (which should be considered as your exclusive privilege, the same way they want to take privilege from you about what you should do with their data files). Unless management are afraid that XXX .jpg files show up at inconvenient places. So document these procedures, have them approved by whoever wants to take the responsibility of approving it, and keep secured logs of the information obtained that way and which files were discarded, and for what reason. In three words: Cover Your Ass!
Table of contents