Some of our computers in our company has been infected with the worm Conficker. We don't know the source of the infection, but I want to monitoring the outside activity to see if we are still infected (we have already "protect" some computers). That's important to ensure that I can ask for being unlisted.
My question is: which means does I have to monitor the whole outbound traffic from my source IP, and/or the specific trafic to a concrete IP, and/or the outbound traffic in a port-based manner (the traffic from each port together with its destination port/IP), everything remotely (outside the infected network)?
I don't ask here for ways to detect infected PCs, but to see the outside activity as an indirect proof of "cleanliness".
You can see our IP and the description of our infection from the following link:
The destination IP is 220.127.116.11. If I
dig in it:
$ dig -x 18.104.22.168 109.64-22.214.171.124.in-addr.arpa. 3600 IN PTR sinkhole-iad1-1.cwg.fsi.io.
No surprises here (clearly stated as a sinkhole).
I can explore from home (Ubuntu 14.04), but, if my ISP or router blocks me in some way, I can ssh-connect to a public server of our company (Ubuntu Server 14.04) to scan from there. So, let's assume I've no restrictions to make that sort of scanning.