Virus/Windows Firewall
Discussion
Win XP sp2 running Avast, spybot, ccleaner, windows firewall and Adware
Avast("has been updated"!) has just detected two infections (netsky-bg & trojan-gen) That's all sorted now. The question is how to make the system more secure.
On this machine it uses Windows firewall. Would ZoneAlarm be better? Is it likely the infection came through a "hole" in the firewall?
Avast("has been updated"!) has just detected two infections (netsky-bg & trojan-gen) That's all sorted now. The question is how to make the system more secure.
On this machine it uses Windows firewall. Would ZoneAlarm be better? Is it likely the infection came through a "hole" in the firewall?
Others will disagree but Windows Firewall is A-OK for most things.
Generally speaking it isn't that a virus will get through the firewall directly. Normally it'll be carried down by someone using the computer and downloading/running either a bad e-mail attachment or program.
It is possible to get a "drive by" infection from certain websites if you are using IE and not applied all the security updates to Windows.
Question is, what files was this fella found in? It might give you a clue as to where it appeared from?
Generally speaking it isn't that a virus will get through the firewall directly. Normally it'll be carried down by someone using the computer and downloading/running either a bad e-mail attachment or program.
It is possible to get a "drive by" infection from certain websites if you are using IE and not applied all the security updates to Windows.
Question is, what files was this fella found in? It might give you a clue as to where it appeared from?
Windows firewall is pretty pants in all fairness and the free version of Zone Alarm provides a considerably better defense.
I recall reading the spec of the windows firewall when it was first launched and it didn't do simple things like monitor outgoing data and connections! whoops!
The fact the firewall only protects against incoming traffic immediately means that once a machine is infected with something it can quite happily transmit data out to anywhere, a good example would be if a key logger (a application that records all keyboard actions) is downloaded by a Trojan (very, very common) the key logger can send data to somebody’s email address and the firewall will never alert this.
The machine could also potentially be used for spamming, ddos attacks (zombie pc) and many more things.
What is even worse is the fact once something gets on the machine, the firewall can be deactivated by a Trojan which means the user could end up running without a firewall for a long period of time.
Microsoft did contend these things as limitations of the firewall when it was first launched and up to a point they may be right but why not use a free firewall that isn't vulnerable to all of these things?
I recall reading the spec of the windows firewall when it was first launched and it didn't do simple things like monitor outgoing data and connections! whoops!
The fact the firewall only protects against incoming traffic immediately means that once a machine is infected with something it can quite happily transmit data out to anywhere, a good example would be if a key logger (a application that records all keyboard actions) is downloaded by a Trojan (very, very common) the key logger can send data to somebody’s email address and the firewall will never alert this.
The machine could also potentially be used for spamming, ddos attacks (zombie pc) and many more things.
What is even worse is the fact once something gets on the machine, the firewall can be deactivated by a Trojan which means the user could end up running without a firewall for a long period of time.
Microsoft did contend these things as limitations of the firewall when it was first launched and up to a point they may be right but why not use a free firewall that isn't vulnerable to all of these things?
leorest said:
Avast("has been updated"!) has just detected two infections (netsky-bg & trojan-gen) That's all sorted now. The question is how to make the system more secure.
Beware they may be bogus spots by the virus killer, where it thinks it sees the signature of something dodgy, but it's actually OK. AVG has for years spotted the foreign language resource files of the product we resell (and I once developed) as infested with a virus. The files are plain text of an unusual form but do not in any way contain anything dodgy, but none-the-less is screams at the top of it's voice. I've seen a few other virus killers do this over the years, so it could just be...
Thanks for the replies all.
I will convert over to ZoneAlarm when I get five minutes.
C:/system volume information/_restore{7fe861....../a0146639.sys (infected with netsky-bg)
It couldn't be fixed so I moved it to the virus chest and as everything seems to be working and booting OK I will probably delete it next week.
The other file was in c:/documents and settings/another user/local setting/emppft3D~tmp/Winxp/LMouFrc.dll (infected with trojan-gen)
This (non administrator)user has not logged on for at least six months and I think the file is part of a temporary folder for a logitec mouse installation which happened years ago! don't even know where the crappy old mouse is now. I've binned the whole contents of the /.../temp folder.
I will convert over to ZoneAlarm when I get five minutes.
ThePassenger said:
Question is, what files was this fella found in? It might give you a clue as to where it appeared from?
BTW one of the infected files was... C:/system volume information/_restore{7fe861....../a0146639.sys (infected with netsky-bg)
It couldn't be fixed so I moved it to the virus chest and as everything seems to be working and booting OK I will probably delete it next week.
The other file was in c:/documents and settings/another user/local setting/emppft3D~tmp/Winxp/LMouFrc.dll (infected with trojan-gen)
This (non administrator)user has not logged on for at least six months and I think the file is part of a temporary folder for a logitec mouse installation which happened years ago! don't even know where the crappy old mouse is now. I've binned the whole contents of the /.../temp folder.
Edited by leorest on Friday 3rd November 14:23
leorest said:
Thanks for the replies all.
I will convert over to ZoneAlarm when I get five minutes.
C:/system volume information/_restore{7fe861....../a0146639.sys (infected with netsky-bg)
It couldn't be fixed so I moved it to the virus chest and as everything seems to be working and booting OK I will probably delete it next week.
The other file was in c:/documents and settings/another user/local setting/emppft3D~tmp/Winxp/LMouFrc.dll (infected with trojan-gen)
This (non administrator)user has not logged on for at least six months and I think the file is part of a temporary folder for a logitec mouse installation which happened years ago! don't even know where the crappy old mouse is now. I've binned the whole contents of the /.../temp folder.
I will convert over to ZoneAlarm when I get five minutes.
ThePassenger said:
Question is, what files was this fella found in? It might give you a clue as to where it appeared from?
BTW one of the infected files was... C:/system volume information/_restore{7fe861....../a0146639.sys (infected with netsky-bg)
It couldn't be fixed so I moved it to the virus chest and as everything seems to be working and booting OK I will probably delete it next week.
The other file was in c:/documents and settings/another user/local setting/emppft3D~tmp/Winxp/LMouFrc.dll (infected with trojan-gen)
This (non administrator)user has not logged on for at least six months and I think the file is part of a temporary folder for a logitec mouse installation which happened years ago! don't even know where the crappy old mouse is now. I've binned the whole contents of the /.../temp folder.
Edited by leorest on Friday 3rd November 14:23
Ok. System Restore is annoying in some respects as Windows doesn't like AV products tinker with it. You have to disable Sys Restore and then scan. Just an FYI for future.
Sounds like the non-admin user got whacked and Windows parked the infected file as part of its restore system. Considering it came from a Logitech installation (maybe) it could be a false positive, still as you don't use the mouse or the driver any more safe to let your AV product play
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff