If you're worried about getting hacked....

To continue a thread below, let me make a few comments and answer a few questions. First off, it is IMPERATIVE, IMHO, that you get a firewall program of some kind. Trojans can come disguised as many things, and there are many ways to break into systems. If you have a firewall installed, you've cut your threat level way down. ZoneAlarm (http://www.zonelabs.com) comes highly recommended, for one, any program that attempts to access the internet will cause ZoneAlarm to send you an alert, requiring you to acknowledge whether or not the program gets access or not. DO NOT GIVE A PROGRAM ACCESS IF YOU DO NOT KNOW WHAT IT IS! Even if you are computer 'clueless', ask friends that are not before allowing a program to get access to the outside world. For more information about firewalls and how to configure them for racing, see our writeup on firewalls at The Pits (Hardware section). Tiny firewall is another good one to look at http://www.tinysoftware.com . Process 2000 is a process viewer that shows EVERYTHING running on your system, including all threads that may be spawned by the process. The difference between P2k viewer and the system info viewer is that P2k will allow you to KILL processes, sysinfo will not. If you are attempting to diagnose what may be causing system slowdown, or even attempting a shutdown of a virus or trojan, P2k will allow you to kill the process, and then you can remove it. Insure after removal that you check your registry, startup files (autoexec.bat, win.ini, system.ini) for references to that program, and remove them. P2k can be found at http://www.blehq.org/ . And Rik A., an A/B switch does nothing that shutting your computer down doesn't. If you accidentally get a trojan, it will initiate when you go back online, and Sub7 even has the capability of alerting it's controller when you do get online. At that point the controller can automatically 'cue' commands to the trojan while you were shut down, and the trojan can automatically send info from your computer (such as password files) to it's controller. Hope this helps... Cheers! -- �� Jan Kohl �� SECURITY CONSULTANT The Pits - http://www.theuspits.com Castle Graphics - http://www.castlegraphics.com

Thanks for the info Jan. Doug D Jan Kohl <[email hidden]> wrote in message news:sSCI6.121$[email hidden]... > To continue a thread below, let me make a few comments and answer a fewquestions. > > First off, it is IMPERATIVE, IMHO, that you get a firewall program of somekind. > Trojans can come disguised as many things, and there are many ways tobreak into > systems. If you have a firewall installed, you've cut your threat levelway down. > ZoneAlarm (http://www.zonelabs.com) comes highly recommended, for one, any > program that attempts to access the internet will cause ZoneAlarm to sendyou an > alert, requiring you to acknowledge whether or not the program gets accessor not. > DO NOT GIVE A PROGRAM ACCESS IF YOU DO NOT KNOW WHAT IT > IS! Even if you are computer 'clueless', ask friends that are not beforeallowing a > program to get access to the outside world. For more information aboutfirewalls > and how to configure them for racing, see our writeup on firewalls at ThePits (Hardware section). > > Tiny firewall is another good one to look at http://www.tinysoftware.com . > > Process 2000 is a process viewer that shows EVERYTHING running on your > system, including all threads that may be spawned by the process. Thedifference > between P2k viewer and the system info viewer is that P2k will allow youto KILL > processes, sysinfo will not. If you are attempting to diagnose what maybe causing > system slowdown, or even attempting a shutdown of a virus or trojan, P2kwill allow > you to kill the process, and then you can remove it. Insure after removalthat you check > your registry, startup files (autoexec.bat, win.ini, system.ini) forreferences to that program, > and remove them. P2k can be found at http://www.blehq.org/ . > > And Rik A., an A/B switch does nothing that shutting your computer downdoesn't. If you > accidentally get a trojan, it will initiate when you go back online, andSub7 even has the > capability of alerting it's controller when you do get online. At thatpoint the controller > can automatically 'cue' commands to the trojan while you were shut down,and the trojan > can automatically send info from your computer (such as password files) toit's controller.

Quoted text (12 lines)

> > Hope this helps... > > Cheers! > > -- > �� Jan Kohl �� > SECURITY CONSULTANT > The Pits - http://www.theuspits.com > Castle Graphics - http://www.castlegraphics.com > >

Thanks for the info Jan. Doug D Pits (Hardware section). references to that program, point the controller

> And Rik A., an A/B switch does nothing that shutting your computer downdoesn't. Well sure it does, I can use the computer when I'm not online! Can't do that when it's shut off! ;-) If you > accidentally get a trojan, it will initiate when you go back online, andSub7 even has the > capability of alerting it's controller when you do get online. At thatpoint the controller > can automatically 'cue' commands to the trojan while you were shut down,and the trojan > can automatically send info from your computer (such as password files) toit's controller. Is this with file sharing off or does it make no difference? Thanks, rik

How about just releasing your IP using winipcfg? Coaxial A-B switches feature some insertion loss, resulting in poorer quality signal for both your cable modem and your TV. An bidirectional active splitter with adjustable gain might be a better choice. Don't know if they're sold where you're at, but Kathrein have some excellent examples of those in their range (and you could still unplug the cable modem should you insist on it). Jan. =---- "Pay attention when I'm talking to you boy!" -Foghorn Leghorn. rik anthrax wrote... > > > And Rik A., an A/B switch does nothing that shutting your computer down > doesn't. > > Well sure it does, I can use the computer when I'm not online! Can't dothat

Quoted text (10 lines)

> when it's shut off! ;-) > > If you > > accidentally get a trojan, it will initiate when you go back online, and > Sub7 even has the > > capability of alerting it's controller when you do get online. At that > point the controller > > can automatically 'cue' commands to the trojan while you were shut down, > and the trojan > > can automatically send info from your computer (such as password files)

to

Quoted text (7 lines)

> it's controller. > > Is this with file sharing off or does it make no difference? > Thanks, > rik > >

"rik anthrax" <[email hidden]> wrote in message news:wJEI6.2291$[email hidden]... > Well sure it does, I can use the computer when I'm not online! Can't do that > when it's shut off! ;-) LOL! Yes, this is true... ;] > Is this with file sharing off or does it make no difference? Makes no difference. Trojans operate as any other program when initiated, they follow their program path to do what they were written for. Modern Trojans (such as Sub7) are very dangerous, at least as far as personal security goes. The remote administrator has just as much control over your system as you do...at least, if you don't realize that you have one. Trojans can be installed from a very small program, and now have the capability to actually go to remote websites and add additional modules to their composition. This works in their benefit by A) keeping the initial filesize very small to keep suspicion down and B) if there are updated modules to provide added capabilities, they can add them as they go. Many of the newer Trojans can evade detection by anti-virus programs (even with the latest updates) by 'binding' with other programs to disguise their signature. Here's a quick synopsis of the abilities that a trojan gives a remote user... 1) modify and change your registry 2) read all keystrokes (including credit card numbers, ect) from the keyboard 3) see anything using your webcam, open up windows on your desktop, send messages to your desktop 4) copy any file from your system to theirs 5) create backup copies of itself, attempt to disguise itself, rename itself, uninstall itself and install other backdoor programs 6) conduct attacks against other systems 7) read network information to gain access to other systems 8) shut down/restart your system, uninstall programs, delete files, corrupt system files 9) see all URLs and cookies from websites that you visit 10) send themselves to other users, using your email program 11) use a proxy server to send information (so that the end user remains unknown) 12) add modules and update information to itself 13) shut down or uninstall virus programs and software firewalls 14) continuously poll for network connections and send information when a connection becomes active 15) recieve 'queued up' commands from a remote controller when a connection becomes active Think that's pretty comprehensive...hope this helps... Cheers! -- �� Jan Kohl �� SECURITY CONSULTANT The Pits - http://www.theuspits.com Castle Graphics - http://www.castlegraphics.com

On Fri, 04 May 2001 18:51:04 GMT, "Jan Kohl" <[email hidden]> wrote: <snip the good advice> Jan, would you recommend firewall software on top of a hardware firewall built into a broadband router, such as the products from Linksys, SMC, and Netgear? That's my current solution, it's a must for anyone with multiple computers in terms of ease, convenience, and safety. -- Andy Carabino to email, remove the 'fat'

"Andy Carabino" <[email hidden]> wrote in message news:[email hidden]... > Jan, would you recommend firewall software on top of a hardware > firewall built into a broadband router, such as the products from > Linksys, SMC, and Netgear? Definitely. They (hardware) only protect (and marginally at that) inbound connections, they do nothing against a program which has installed itself and is attempting outbound. See our writeup in the hardware section for details... All the mini-firewall/routers are really just a convenience...they do not provide a really solid firewall (as compared to things like Checkpoint, Cisco PIX, ect). That's not to say that they don't work well, but if someone REALLY wanted to attempt to break into your system, a Linksys/Netgear/whatever would not stop them... Cheers! -- �� Jan Kohl �� SECURITY CONSULTANT The Pits - http://www.theuspits.com Castle Graphics - http://www.castlegraphics.com

Since reading the thread yesterday about JV being hacked, I checked with sysinfo and found a distributed computing client installed with a -hide switch. I have no idea what it is/was (and have disabled it) but I don't like the sound of it...I do my banking from this computer! Dialup only, so I wasn't too concerned about security, but I suppose an installed program can communicate with the outside without a static IP.....not good! Ben Jan Kohl wrote in message ... >To continue a thread below, let me make a few comments and answer a fewquestions. > >First off, it is IMPERATIVE, IMHO, that you get a firewall program of somekind. >Trojans can come disguised as many things, and there are many ways to breakinto >systems. If you have a firewall installed, you've cut your threat levelway down. >ZoneAlarm (http://www.zonelabs.com) comes highly recommended, for one, any >program that attempts to access the internet will cause ZoneAlarm to sendyou an >alert, requiring you to acknowledge whether or not the program gets accessor not. >DO NOT GIVE A PROGRAM ACCESS IF YOU DO NOT KNOW WHAT IT >IS! Even if you are computer 'clueless', ask friends that are not beforeallowing a >program to get access to the outside world. For more information aboutfirewalls >and how to configure them for racing, see our writeup on firewalls at ThePits (Hardware section). > >Tiny firewall is another good one to look at http://www.tinysoftware.com . > >Process 2000 is a process viewer that shows EVERYTHING running on your >system, including all threads that may be spawned by the process. Thedifference >between P2k viewer and the system info viewer is that P2k will allow you toKILL >processes, sysinfo will not. If you are attempting to diagnose what may becausing >system slowdown, or even attempting a shutdown of a virus or trojan, P2kwill allow >you to kill the process, and then you can remove it. Insure after removalthat you check >your registry, startup files (autoexec.bat, win.ini, system.ini) forreferences to that program, >and remove them. P2k can be found at http://www.blehq.org/ . > >And Rik A., an A/B switch does nothing that shutting your computer downdoesn't. If you >accidentally get a trojan, it will initiate when you go back online, andSub7 even has the >capability of alerting it's controller when you do get online. At thatpoint the controller >can automatically 'cue' commands to the trojan while you were shut down,and the trojan >can automatically send info from your computer (such as password files) toit's controller.

Quoted text (12 lines)

> >Hope this helps... > >Cheers! > >-- >�� Jan Kohl �� >SECURITY CONSULTANT >The Pits - http://www.theuspits.com >Castle Graphics - http://www.castlegraphics.com > >

Jan, Don't know if you are aware of this, but here are some things I have discovered over the years rgarding Trojans/Viruses/Etc.: 1) The writers can sit down and spent multiple hours/days/months writing these stupid things, but they almost always seem to use Visual Basic to write them (easy entry through your browser I suppose is why). God only knows why these idiots can't spend that time learning a REAL programming language like C/C++. So... the very nature of VBscript, requires a Windows System executable in order to run them (wscript.exe), which is usually found in the following directories: %SystemRoot%\WINNT\System32\ %SystemRoot%\Windows\System\ You can easily change the MAPI (program 'OPEN' mapping) to not have 'wscript.exe' open up vbscript files. I personally map notepad.exe to my vbscript MAPI, and have not had a single trojan/virus/etc. running on my system. I may have more than a few ON my system... but they are essentially quarantined, without any means to run themselves. Just thought I'd pass that along. Remember... these trojans/viruses MUST be executed in some way in order to initiate the function. You cripple their ability to run (nip it in the bud), you effectively negate most of the risk. Although... people reading this please take very careful note: I am NOT telling you to avoid firewalls, etc. In fact, I highly recommend them, but as Jan eluded to... many of these trojans/viruses like to 'piggyback' other programs, and simply have their script run to initiate themselves. Basically... they get past many of the most advanced firewalls through the back-door so-to-speak. Please take this advice as an 'additional security precaution'. That's my 2 cents.. hope it helps. Cheers, Schumi "Jan Kohl" <[email hidden]> wrote in message news:sSCI6.121$[email hidden]... > To continue a thread below, let me make a few comments and answer a fewquestions. > > First off, it is IMPERATIVE, IMHO, that you get a firewall program of somekind. > Trojans can come disguised as many things, and there are many ways tobreak into > systems. If you have a firewall installed, you've cut your threat levelway down. > ZoneAlarm (http://www.zonelabs.com) comes highly recommended, for one, any > program that attempts to access the internet will cause ZoneAlarm to sendyou an > alert, requiring you to acknowledge whether or not the program gets accessor not. > DO NOT GIVE A PROGRAM ACCESS IF YOU DO NOT KNOW WHAT IT > IS! Even if you are computer 'clueless', ask friends that are not beforeallowing a > program to get access to the outside world. For more information aboutfirewalls > and how to configure them for racing, see our writeup on firewalls at ThePits (Hardware section). > > Tiny firewall is another good one to look at http://www.tinysoftware.com . > > Process 2000 is a process viewer that shows EVERYTHING running on your > system, including all threads that may be spawned by the process. Thedifference > between P2k viewer and the system info viewer is that P2k will allow youto KILL > processes, sysinfo will not. If you are attempting to diagnose what maybe causing > system slowdown, or even attempting a shutdown of a virus or trojan, P2kwill allow > you to kill the process, and then you can remove it. Insure after removalthat you check > your registry, startup files (autoexec.bat, win.ini, system.ini) forreferences to that program, > and remove them. P2k can be found at http://www.blehq.org/ . > > And Rik A., an A/B switch does nothing that shutting your computer downdoesn't. If you > accidentally get a trojan, it will initiate when you go back online, andSub7 even has the > capability of alerting it's controller when you do get online. At thatpoint the controller > can automatically 'cue' commands to the trojan while you were shut down,and the trojan > can automatically send info from your computer (such as password files) toit's controller.

Quoted text (12 lines)

> > Hope this helps... > > Cheers! > > -- > �� Jan Kohl �� > SECURITY CONSULTANT > The Pits - http://www.theuspits.com > Castle Graphics - http://www.castlegraphics.com > >

Jan, Don't know if you are aware of this, but here are some things I have discovered over the years rgarding Trojans/Viruses/Etc.: 1) The writers can sit down and spent multiple hours/days/months writing these stupid things, but they almost always seem to use Visual Basic to write them (easy entry through your browser I suppose is why). God only knows why these idiots can't spend that time learning a REAL programming language like C/C++. So... the very nature of VBscript, requires a Windows System executable in order to run them (wscript.exe), which is usually found in the following directories: %SystemRoot%\WINNT\System32\ %SystemRoot%\Windows\System\ You can easily change the MAPI (program 'OPEN' mapping) to not have 'wscript.exe' open up vbscript files. I personally map notepad.exe to my vbscript MAPI, and have not had a single trojan/virus/etc. running on my system. I may have more than a few ON my system... but they are essentially quarantined, without any means to run themselves. Just thought I'd pass that along. Remember... these trojans/viruses MUST be executed in some way in order to initiate the function. You cripple their ability to run (nip it in the bud), you effectively negate most of the risk. Although... people reading this please take very careful note: I am NOT telling you to avoid firewalls, etc. In fact, I highly recommend them, but as Jan eluded to... many of these trojans/viruses like to 'piggyback' other programs, and simply have their script run to initiate themselves. Basically... they get past many of the most advanced firewalls through the back-door so-to-speak. Please take this advice as an 'additional security precaution'. That's my 2 cents.. hope it helps. Cheers, Schumi Pits (Hardware section). references to that program, point the controller

Hey old buddy.... I agree... even MS Proxy Server 2 I wouldn't consider a "great" firewall. would you really put PIX and Checkpoint in the same league? just curious... However, NAT should do the trick for most home users, and throw in something like black ice stopping outbounds from weird ports and stuff... what I like about Black Ice is the user doesn't have to learn a bunch of technical information and therefore mess up the security configuration. On Sat, 05 May 2001 01:15:13 GMT, "Jan Kohl" <[email hidden]> wrote:

Quoted text (16 lines)

>"Andy Carabino" <[email hidden]> wrote in message news:[email hidden]... > >> Jan, would you recommend firewall software on top of a hardware >> firewall built into a broadband router, such as the products from >> Linksys, SMC, and Netgear? > >Definitely. They (hardware) only protect (and marginally at that) inbound connections, they >do nothing against a program which has installed itself and is attempting outbound. >See our writeup in the hardware section for details... > >All the mini-firewall/routers are really just a convenience...they do not provide a really >solid firewall (as compared to things like Checkpoint, Cisco PIX, ect). That's not to >say that they don't work well, but if someone REALLY wanted to attempt to break >into your system, a Linksys/Netgear/whatever would not stop them... > >Cheers!

"George Lewis" <[email hidden]> wrote in message news:[email hidden]...

Quoted text (11 lines)

> Hey old buddy.... > > I agree... even MS Proxy Server 2 I wouldn't consider a "great" > firewall. would you really put PIX and Checkpoint in the same league? > just curious... > > However, NAT should do the trick for most home users, and throw in > something like black ice stopping outbounds from weird ports and > stuff... what I like about Black Ice is the user doesn't have to > learn a bunch of technical information and therefore mess up the > security configuration.

GEORGE!!!!!!!!!!!!!! Geez, it's been a long time! Nice ta see you! ;] Well, what I was referring to was the fact that a properly set up 'real' firewall will only allow connections that have been designated as 'ok', all other inward/ outbound connections are halted at the firewall. With Linksys/Netgear/whatever, there are certain programs on the operating system which could be given a buffer overflow and thus give access to the target computer. Not *quite* so likely on something such as Checkpoint, but combined with a good IDS it would be much more difficult. I know Black Ice on previous versions did not stop outbound connections, but I heard they were going to fix that. I've not tried it recently to see... Cheers! -- �� Jan Kohl �� SECURITY CONSULTANT The Pits - http://www.theuspits.com Castle Graphics - http://www.castlegraphics.com

"Jan Kohl" <[email hidden]> wrote: >First off, it is IMPERATIVE, IMHO, that you get a firewall program of >some kind. Trojans can come disguised as many things, and there are many >ways to break into systems. Well if you're really concerned about being hacked the first thing to do is to stop running programs from sources that you don't trust. A firewall will not stopping trojans from infecting your system at all. It might have difficulties reporting your data to someone but that does't stop a trojan from doing anything to your system. Since trojans -once installed- have the same rights as any other program they can do pretty much the same things you can do - e.g. disable your (software) firewall, send emails, read/format your disk, etc. The ONLY way to be safe is to prevent trojans (and other nasties) from getting onto your system, i.e. don't install software of questionable origin, use an email client without all the fancy automation stuff, browse with the highest possible security settings, etc. Also check for secutity updates for your programs/OS. The best way is of course to store sensible data on an extra machine that connects to the net only when absolutly neccessary. Don't get me wrong: PFWs are nice for what they do, however don't fool yourself by thinking that you're safe just because you've a firewall and virus scanner. On an unsafe system the scanner is IMO even more important than a PFW since it will detect most trojans/virii when they arrive on your system - unlike the FW that will only _attempt_ to stop them from talking/listening to the outside world. However a clever virus/trojan will fool/shutdown both. Knowledge and caution with installing new programs is by far the safe approach than just installing a fancy FW and forget about security because "I have a firewall installed". Regards Martin

"Martin" wrote:. clipped

Quoted text (7 lines)

> The ONLY way to be safe is to prevent trojans (and other nasties) from > getting onto your system, i.e. don't install software of questionable > origin, use an email client without all the fancy automation stuff, > browse with the highest possible security settings, etc. Also check for > secutity updates for your programs/OS. The best way is of course to store > sensible data on an extra machine that connects to the net only when > absolutly neccessary.

I've been following this thread with interest and appreciate the info. Since many viruscheckers don't detect trojans (if I understand this correctly) then what's the best way to check for them on your system? I've recently installed a firewall and other protective measures but want to be sure that there's nothing already on my system tia for any advice

"Martin" <[email hidden]> wrote in message news:[email hidden]... > Knowledge and caution with installing new programs is by far the safe > approach than just installing a fancy FW and forget about security > because "I have a firewall installed". You are correct, Martin, a safe approach is to be suspicious of all executables. However, I don't think I was insinuating that installing a firewall and forgetting about security was the idea. The problem is that even the most careful person can get a virii or trojan, and at the moment, the only recourse is to block it's transmission back to it's sender until you remove it. Any program can be 'bound' with a trojan, and even with the best virus scanners it can be difficult to discover it...until it begins operation. I've even found brand new commercial software that inadvertently was infected with a virus, and while it was easily picked up (due to the type of virus), there's nothing to say that a more lethal trojan couldn't find it's way into a commercial release. There have been several cases in recent years (notably the Quake server platform) that had built in 'backdoors' that were released by the company! Your only defense in these cases is to have something that will notify you when unknown or unauthorized network transmissions are being made. The bottom line is this...any machine that is connected to a network is at risk, and is never 100% secure. By keeping this in mind, using good security practices and updated scanners and firewalls, you certainly reduce the chances of getting hacked. Cheers! -- �� Jan Kohl �� SECURITY CONSULTANT The Pits - http://www.theuspits.com Castle Graphics - http://www.castlegraphics.com

"womt" <[email hidden]> wrote: >I've been following this thread with interest and appreciate the info. >Since many viruscheckers don't detect trojans (if I understand this >correctly) then what's the best way to check for them on your system? Well a scanner basically does a pattern match to search your HD (or downloaded files) for files containing patterns that are known to belong to a virus (or trojan). Which viruses or trojans can be found depends on the database that holds the patterns of all threats known to this scanner. Keeping this database up to date is important if you want to protect your system against newly discoverd viruses/trojans. There is also a method to find not-yet-dicovered virii by searching for certain pattern that viruses often contain. Obviously this method isn't perfect since a new virus don't have to use those "suspicious patterns" and it might also produce false alarms. So basically it depends on a scanners database if and how many trojans it'll find. You'd have to check the vendors docs (or site) for a list of the detected trojans/viruses. >I've recently installed a firewall and other protective measures but >want to be sure that there's nothing already on my system Well if you want to be _sure_ you'd have to reinstall the system (+format the disk including the bootrecords) from a virus-free source. Plus install only software that you _completely_ trust. However a good scanner (regular updates, protection against most known trojans/viruses, auto-scanning of incoming files/emails) and being selective about what you download and install should be enough in most cases. For those email threats it helps to get an extra ("dumb")email client and/or disable scripting on your system. At least use all the safety features your client provides. Martin

"Jan Kohl" <[email hidden]> wrote:

Quoted text (10 lines)

>"Martin" <[email hidden]> wrote in message >news:[email hidden]... > >> Knowledge and caution with installing new programs is by far the safe >> approach than just installing a fancy FW and forget about security >> because "I have a firewall installed". > >You are correct, Martin, a safe approach is to be suspicious of all >executables. However, I don't think I was insinuating that installing a >firewall and forgetting about security was the idea.

Of course not, but a lot of people seem to get on that track, that why is I thought I'd mention it. >The problem is that even the most careful person can get a virii or >trojan, and at the moment, the only recourse is to block it's >transmission back to it's sender until you remove it. Well if a trojan is sophisticated enough to slip by "the most careful person"(TM) it may as well be able to disable a personal firewall and disguise itself so it can sneak by external FWs . In any case a FW can only detect that your system has been infected and the trojan code is already executing - the secutity has been breached and if you had sensible data on that machine you'd have to consider that data exposed and been tampered with. It is of course better than being infected and not knowing it.

Quoted text (7 lines)

>Any program can >be 'bound' with a trojan, and even with the best virus scanners it can >be difficult to discover it...until it begins operation. I've even found >brand new commercial software that inadvertently was infected with a >virus, and while it was easily picked up (due to the type of virus), >there's nothing to say that a more lethal trojan couldn't find it's way >into a commercial release.

Yeah happened to me too, fortunatly chances are quite good that this will be discoverd pretty fast - if you're using a popular commercial software. >There have been several cases in recent >years (notably the Quake server platform) that had built in 'backdoors' >that were released by the company! Your only defense in these cases is >to have something that will notify you when unknown or unauthorized >network transmissions are being made. In those cases it's hard to distinguish between authorized and unauthorized network access. After all the purpose of the program is to communicate with the outside world and a FW cannot tell a "good" from a "bad" connection unless you verify each connection attempt by hand or the "bad" connections are easy to detect (e.g. using a special port or ip - which they don't have to do). >The bottom line is this...any machine that is connected to a network is >at risk, and is never 100% secure. ACK. >By keeping this in mind, using good >security practices and updated scanners and firewalls, you certainly >reduce the chances of getting hacked. Right, I just wanted to point out that you need all of that. And not just get a FW and a scanner and feel safe and install every piece of crap you can download. Regards, Martin

> Well if a trojan is sophisticated enough to slip by "the most careful > person"(TM) it may as well be able to disable a personal firewall and > disguise itself so it can sneak by external FWs . Yes, and I've even got a trojan at the moment that another security guy sent to me that is purposely built to disable ZA and then create a running icon in it's place so that you don't realize ZA has been compromised... > In those cases it's hard to distinguish between authorized and > unauthorized network access. After all the purpose of the program is to > communicate with the outside world and a FW cannot tell a "good" from a > "bad" connection unless you verify each connection attempt by hand or the > "bad" connections are easy to detect (e.g. using a special port or ip - > which they don't have to do). as well, you really have to know what network connections are going on in the first place...for people that do network admin, that's usually not TOO big of a problem, but for the common user, they probably wouldn't know what to look for... > Right, I just wanted to point out that you need all of that. And not just > get a FW and a scanner and feel safe and install every piece of crap you > can download. Yep, I figured we were on the same sheet of music... <grin> Cheers! -- �� Jan Kohl �� SECURITY CONSULTANT The Pits - http://www.theuspits.com Castle Graphics - http://www.castlegraphics.com

I bought BID (Black Ice Defender) the day I got a cable modem (a few years ago) and kept up with the updates. I tried Zone Alarm but it drove me nuts. I'm also running an internal LAN with a W2K server and a few PCs, which caused me all sorts of grief. BID worked great for me, plus let me know who was doing what. The later versions did stop outbound stuff. Now I use it in conjuction with the NAT firewall (very basic, but does the trick). On Sat, 05 May 2001 16:19:29 GMT, [email hidden] (Todd Walker) wrote:

Quoted text (47 lines)

>I agree George except with your choice of firewall. Black Ice is a >good firewall but IMHO Zone Alarm is much better and it's FREE (which >is amazing.) I have a Linksys router and run ZA on all my workstations >and I have never had a problem. Basically, the router gets the attacks >that originate from the outside and ZA gets them from the inside. > >Todd Walker >twalker at jam dot rr dot com >http://twalker.d2g.com > > > >On Sat, 05 May 2001 11:49:16 GMT, George Lewis ><[email hidden]> wrote: > >>Hey old buddy.... >> >>I agree... even MS Proxy Server 2 I wouldn't consider a "great" >>firewall. would you really put PIX and Checkpoint in the same league? >>just curious... >> >>However, NAT should do the trick for most home users, and throw in >>something like black ice stopping outbounds from weird ports and >>stuff... what I like about Black Ice is the user doesn't have to >>learn a bunch of technical information and therefore mess up the >>security configuration. >> >> >>On Sat, 05 May 2001 01:15:13 GMT, "Jan Kohl" <[email hidden]> >>wrote: >> >>>"Andy Carabino" <[email hidden]> wrote in message news:[email hidden]... >>> >>>> Jan, would you recommend firewall software on top of a hardware >>>> firewall built into a broadband router, such as the products from >>>> Linksys, SMC, and Netgear? >>> >>>Definitely. They (hardware) only protect (and marginally at that) inbound connections, they >>>do nothing against a program which has installed itself and is attempting outbound. >>>See our writeup in the hardware section for details... >>> >>>All the mini-firewall/routers are really just a convenience...they do not provide a really >>>solid firewall (as compared to things like Checkpoint, Cisco PIX, ect). That's not to >>>say that they don't work well, but if someone REALLY wanted to attempt to break >>>into your system, a Linksys/Netgear/whatever would not stop them... >>> >>>Cheers!

Jan! I'll drop you an email and catch up.... Yeah, sorry... I'm suffering the same problem. trying to keep it basic and simple but still satisfy the techies :) Black Ice did fix the outbound stuff. Zone Alarm caused me too many hassles with questions and stuff for my LAN setup (a server and 4 PCs) At work I have a Cisco setup with ACLs and stuff, but not at home. Nice hearing from you! On Sat, 05 May 2001 15:53:26 GMT, "Jan Kohl" <[email hidden]> wrote:

Quoted text (28 lines)

>"George Lewis" <[email hidden]> wrote in message news:[email hidden]... >> Hey old buddy.... >> >> I agree... even MS Proxy Server 2 I wouldn't consider a "great" >> firewall. would you really put PIX and Checkpoint in the same league? >> just curious... >> >> However, NAT should do the trick for most home users, and throw in >> something like black ice stopping outbounds from weird ports and >> stuff... what I like about Black Ice is the user doesn't have to >> learn a bunch of technical information and therefore mess up the >> security configuration. > >GEORGE!!!!!!!!!!!!!! >Geez, it's been a long time! Nice ta see you! ;] > >Well, what I was referring to was the fact that a properly set up 'real' firewall >will only allow connections that have been designated as 'ok', all other inward/ >outbound connections are halted at the firewall. With Linksys/Netgear/whatever, >there are certain programs on the operating system which could be given a buffer >overflow and thus give access to the target computer. Not *quite* so likely on >something such as Checkpoint, but combined with a good IDS it would be much >more difficult. > >I know Black Ice on previous versions did not stop outbound connections, but I >heard they were going to fix that. I've not tried it recently to see... > >Cheers!

Well, the problem with virus checkers are that they are "stupid" - they only check for known situations and conditions. I have yet to see an intelligent one that can look at something and say "hey! this doesn't look right!" if it fits the conditions, it gets marked. but the problem is that most new viruses haven't been "defined" yet so the stupid virus checker lets the files go on through. It's not the virus checker's reponsibility to check outbound ports on your PC, either. A file may be perfectly "harmless" until it's run and then you have your troubles. As mentioned in another usenet message - hacker software alot of times has a few extra suprises in it... On Sat, 05 May 2001 17:32:46 GMT, "womt" <[email hidden]> wrote:

Quoted text (20 lines)

> >"Martin" wrote:. >clipped >> The ONLY way to be safe is to prevent trojans (and other nasties) from >> getting onto your system, i.e. don't install software of questionable >> origin, use an email client without all the fancy automation stuff, >> browse with the highest possible security settings, etc. Also check for >> secutity updates for your programs/OS. The best way is of course to store >> sensible data on an extra machine that connects to the net only when >> absolutly neccessary. > >I've been following this thread with interest and appreciate the info. >Since many viruscheckers don't detect trojans (if I understand this >correctly) then what's the best way to check for them on your system? I've >recently installed a firewall and other protective measures but want to be >sure that there's nothing already on my system > >tia for any advice > >

When the hacker booby-trapped my system, my NOD32 virus checker caught it. Unfortunately, I didn't have it up and running after updating my system. Even if the virus checker had been active, I don't think I could have prevented it once the hacker got into my system. I have some very unkind words for that individual if we ever meet. Nod32 found the virus and said it couldn't fix it...but saved it so I could email it to the Nod32 programmers. What the virus did was re-assign a windows function to itself so that when I removed the file all my windows programs quit working. i.e. I couldn't open Windows Explorer because such & such a file was missing. I couldn't email because the file was missing. I couldn't even shut down or reboot because the file was missing. "George Lewis" <[email hidden]> wrote in message news:[email hidden]... > Well, the problem with virus checkers are that they are "stupid" - > they only check for known situations and conditions. I have yet to > see an intelligent one that can look at something and say "hey! this > doesn't look right!" if it fits the conditions, it gets marked. but

"Dave Henrie" <[email hidden]> wrote in message news:fzdJ6.119457$[email hidden]...

Quoted text (11 lines)

> When the hacker booby-trapped my system, my NOD32 virus checker caught it. > Unfortunately, I didn't have it up and running after updating my system. > Even if the virus checker had been active, I don't think I could have > prevented it once the hacker got into my system. I have some very unkind > words for that individual if we ever meet. Nod32 found the virus and said > it couldn't fix it...but saved it so I could email it to the Nod32 > programmers. What the virus did was re-assign a windows function to itself > so that when I removed the file all my windows programs quit working. i.e. > I couldn't open Windows Explorer because such & such a file was missing. I > couldn't email because the file was missing. I couldn't even shut down or > reboot because the file was missing.

LOL! Eeerrrmmm...hate to tell you this, Dave... ;] Remember when I said search the registry for the trojan? What they had done was map shell extensions to executables to the trojan, then everytime you ran a program, it attempted to restart the trojan. Very common practice with trojans, it insures that other methods of restarting the trojan don't fail. Cheers! -- �� Jan Kohl �� SECURITY CONSULTANT The Pits - http://www.theuspits.com Castle Graphics - http://www.castlegraphics.com

"Martin" <[email hidden]> wrote in message news:[email hidden]... > "Jan Kohl" <[email hidden]> wrote: >SNIP

Quoted text (14 lines)

> A firewall will not stopping trojans from infecting your system at all. > It might have difficulties reporting your data to someone but that does't > stop a trojan from doing anything to your system. Since trojans -once > installed- have the same rights as any other program they can do pretty > much the same things you can do - e.g. disable your (software) firewall, > send emails, read/format your disk, etc. > > The ONLY way to be safe is to prevent trojans (and other nasties) from > getting onto your system, i.e. don't install software of questionable > origin, use an email client without all the fancy automation stuff, > browse with the highest possible security settings, etc. Also check for > secutity updates for your programs/OS. The best way is of course to store > sensible data on an extra machine that connects to the net only when > absolutly neccessary.

Ummm, you mean "software of a questionable origin" such as warez?!? Hee hee hee, serves them right for dl'ing it in the first place!

"Robin" <[email hidden]> wrote: >Ummm, you mean "software of a questionable origin" such as warez?!? Hee >hee hee, serves them right for dl'ing it in the first place! That's not restricted to warez/gamez... depending on the site I'd assume that those are usually "safer" than some other areas of downloadable software. After all if you put a trojan in a 100MB+ download that is mainly d/l'ed by people with at least some computer knowledge you won't find many victims. However if you put a trojan into a small utility that is supposed to help you with applications that a lot of unexperienced people use (e.g. AOL, ICQ, etc.) you'll probably have more "success". So basically "software of a questionable origin" means any software that hasn't been a) bought as commercial software in a store b) downloaded from a site of a known (and trusted) company (updates/patches) c) written by yourself or someone you trust - on a safe system. Note that a) & b) are not perfectly safe (shit happens) but it's likely that problems will be discovered soon and quickly solved. In short: if you don't know who to sue if a program contained a trojan then the origin is questionable ;-) Martin

On Sun, 06 May 2001 12:45:25 GMT, George Lewis <[email hidden]> wrote: >Well, the problem with virus checkers are that they are "stupid" - >they only check for known situations and conditions. I have yet to >see an intelligent one that can look at something and say "hey! this >doesn't look right!" if it fits the conditions, it gets marked. but >the problem is that most new viruses haven't been "defined" yet so the >stupid virus checker lets the files go on through. Most so called new viruses are not new, just different variations of an old virus so a good virus checker should pick up on them. -- eFalcon keyboard chart in PDF format http://storm.prohosting.com/~nos146/ef4_keys.zip

I went to a questionable site today and Norton detected that this site was trying to perform a registry write and asked if i wanted to stop or continue. Naturally, i selected stop and it shut down netscape. So norton does look for some funny things with VBscripts Martin wrote:

Quoted text (27 lines)

> "Robin" <[email hidden]> wrote: > > >Ummm, you mean "software of a questionable origin" such as warez?!? Hee > >hee hee, serves them right for dl'ing it in the first place! > > That's not restricted to warez/gamez... depending on the site I'd assume > that those are usually "safer" than some other areas of downloadable > software. After all if you put a trojan in a 100MB+ download that is > mainly d/l'ed by people with at least some computer knowledge you won't > find many victims. However if you put a trojan into a small utility that > is supposed to help you with applications that a lot of unexperienced > people use (e.g. AOL, ICQ, etc.) you'll probably have more "success". > > So basically "software of a questionable origin" means any software that > hasn't been > > a) bought as commercial software in a store > b) downloaded from a site of a known (and trusted) company > (updates/patches) > c) written by yourself or someone you trust - on a safe system. > > Note that a) & b) are not perfectly safe (shit happens) but it's likely > that problems will be discovered soon and quickly solved. > In short: if you don't know who to sue if a program contained a trojan > then the origin is questionable ;-) > > Martin

Can you point me to that site? I'd like to take a look at it... ;] Cheers! -- �� Jan Kohl �� SECURITY CONSULTANT The Pits - http://www.theuspits.com Castle Graphics - http://www.castlegraphics.com "nascarob" <[email hidden]> wrote in message news:[email hidden]... > I went to a questionable site today and Norton detected that this site was > trying to perform a registry write and asked if i wanted to stop or > continue. Naturally, i selected stop and it shut down netscape. So norton > does look for some funny things with VBscripts > > > > Martin wrote: > > > "Robin" <[email hidden]> wrote: > > > > >Ummm, you mean "software of a questionable origin" such as warez?!? Hee > > >hee hee, serves them right for dl'ing it in the first place! > > > > That's not restricted to warez/gamez... depending on the site I'd assume > > that those are usually "safer" than some other areas of downloadable > > software. After all if you put a trojan in a 100MB+ download that is > > mainly d/l'ed by people with at least some computer knowledge you won't > > find many victims. However if you put a trojan into a small utility that > > is supposed to help you with applications that a lot of unexperienced > > people use (e.g. AOL, ICQ, etc.) you'll probably have more "success". > > > > So basically "software of a questionable origin" means any software that > > hasn't been > > > > a) bought as commercial software in a store > > b) downloaded from a site of a known (and trusted) company > > (updates/patches) > > c) written by yourself or someone you trust - on a safe system. > > > > Note that a) & b) are not perfectly safe (shit happens) but it's likely > > that problems will be discovered soon and quickly solved. > > In short: if you don't know who to sue if a program contained a trojan > > then the origin is questionable ;-) > > > > Martin >

After reading this thread, I downloaded and installed the free version of Zone Alarm. I have had it installed for about an hour, and already have received 4 alerts of different ip addresses that were blocked trying to access my computer through the internet. Is this normal? Would this be hackers trying to get into my system? I'm just wondering what's been happening up until I installed Zone Alarm/ -- Don Burnette D Burnette in N4 Some people do nothing wrong. The problem is, they do nothing. And THAT is wrong.

"Don Burnette" <[email hidden]> wrote in message news:5olJ6.67893$[email hidden]...

Quoted text (7 lines)

> After reading this thread, I downloaded and installed the free version of > Zone Alarm. > I have had it installed for about an hour, and already have received 4 > alerts of different ip addresses that were blocked trying to access my > computer through the internet. > Is this normal? Would this be hackers trying to get into my system? I'm > just wondering what's been happening up until I installed Zone Alarm/

I'm assuming you have a cable modem based on your email address. I do too, and periodically the ISP itself sends out a ping, in my case easily identified by having an almost identical IP number but with a '1' at the end. I've been told that no harm is done by blocking this and so far nothing has happened despite my blocking it. This is probably the source of some of your pings, but I bet there's more than that at play here. I know that I get pinged by all kinds of IPs even when I'm not doing anything that might cause it (some programs try to connect by themselves as I'm sure you know).

Quoted text (8 lines)

>"Don Burnette" <[email hidden]> wrote > After reading this thread, I downloaded and installed the free version of > Zone Alarm. > I have had it installed for about an hour, and already have received 4 > alerts of different ip addresses that were blocked trying to access my > computer through the internet. > Is this normal? Would this be hackers trying to get into my system? I'm > just wondering what's been happening up until I installed Zone Alarm/

Yes it's normal Don, but it's not really "hacking". You see, most of the script kiddies (because they aren't really hackers, just kids thinking they are hackers) do that. It's like going to somebody's house and testing the door knob. If it's locked, they move to the next house. If not, then they have a potential case of a non-safe computer. They are just sending you packets, it is not illegal. Zone Alarm protects you against that because it/you decide what port (door knob) you want to leave open and which one you want locked up. They do it all the time, I receive in average 10-12 alerts per day. Sometimes more, sometimes less. Unless you are not safe (check out grc.com which itself just had a Dos lol), you shouldn't pay attention to them. -- -- Fran�ois M�nard <ymenard> -- May the Downforce be with you... -- http://www.ymenard.com/ -- This announcement is brought to you by the Shimato Dominguez Corporation - helping America into the New World...

"ymenard" <[email hidden]> wrote in message news:ZdnJ6.21528$[email hidden]... > Yes it's normal Don, but it's not really "hacking". You see, most of the > script kiddies (because they aren't really hackers, just kids thinkingthey > are hackers) do that. It's like going to somebody's house and testing the > door knob. If it's locked, they move to the next house. If not, thenthey

Quoted text (9 lines)

> have a potential case of a non-safe computer. They are just sending you > packets, it is not illegal. > > Zone Alarm protects you against that because it/you decide what port (door > knob) you want to leave open and which one you want locked up. They do it > all the time, I receive in average 10-12 alerts per day. Sometimes more, > sometimes less. Unless you are not safe (check out grc.com which itself > just had a Dos lol), you shouldn't pay attention to them. >

I have now received a total of 9 alerts since installing it about 3.5 hours ago. A couple of those alerts were where the specific ip had tried pinging me multiple times. Very interesting. Makes me wonder what all has gone on before I had a firewall. I hope having the firewall doesn't degrade my online racing quality. Don Burnette

Don have you used the process viewer to see if any rogue programs running in the background? dave henrie "Don Burnette" <[email hidden]> wrote in message news:LnnJ6.68706$[email hidden]... > > > "ymenard" <[email hidden]> wrote in message > news:ZdnJ6.21528$[email hidden]... > > > Yes it's normal Don, but it's not really "hacking". You see, most ofthe > > script kiddies (because they aren't really hackers, just kids thinking > they > > are hackers) do that. It's like going to somebody's house and testingthe > > door knob. If it's locked, they move to the next house. If not, then > they > > have a potential case of a non-safe computer. They are just sending you > > packets, it is not illegal. > > > > Zone Alarm protects you against that because it/you decide what port(door > > knob) you want to leave open and which one you want locked up. They doit > > all the time, I receive in average 10-12 alerts per day. Sometimesmore, > > sometimes less. Unless you are not safe (check out grc.com which itself > > just had a Dos lol), you shouldn't pay attention to them. > > > > I have now received a total of 9 alerts since installing it about 3.5hours

Quoted text (9 lines)

> ago. A couple of those alerts were where the specific ip had tried pinging > me multiple times. Very interesting. Makes me wonder what all has gone on > before I had a firewall. > I hope having the firewall doesn't degrade my online racing quality. > > > Don Burnette > >

This is what I show running using system information. Anything look odd here? Kernel32.dll 4.10.1998 Microsoft Corporation Win32 Kernel core component C:\WINDOWS\SYSTEM\Kernel32.dll 4.3 Microsoft(R) Windows(R) Operating System MSGSRV32.EXE 4.10.1998 Microsoft Corporation Windows 32-bit VxD Message Server C:\WINDOWS\SYSTEM\MSGSRV32.EXE 4.0 Microsoft(R) Windows(R) Operating System Mprexe.exe 4.10.1998 Microsoft Corporation WIN32 Network Interface Service Process C:\WINDOWS\SYSTEM\Mprexe.exe 4.0 Microsoft(R) Windows(R) Operating System Vsmon.exe 2.6.88 Zone Labs Inc. TrueVector Service C:\WINDOWS\SYSTEM\ZONELABS\Vsmon.exe 4.0 TrueVector Service Minilog.exe 2.6.88 Zone Labs Inc. TrueVector Basic Alert Logger C:\WINDOWS\SYSTEM\ZONELABS\Minilog.exe 4.0 ZoneAlarm MMTASK.TSK 4.03.1998 Microsoft Corporation Multimedia background task support module C:\WINDOWS\SYSTEM\MMTASK.TSK 4.0 Microsoft Windows Explorer.exe 4.72.3110.1 Microsoft Corporation Windows Explorer C:\WINDOWS\Explorer.exe 4.0 Microsoft(R) Windows NT(R) Operating System Rpcss.exe 4.71.2900 Microsoft Corporation Distributed COM Services C:\WINDOWS\SYSTEM\Rpcss.exe 4.0 Microsoft(R) Windows NT(TM) Operating System Systray.exe 4.10.1998 Microsoft Corporation System Tray Applet C:\WINDOWS\SYSTEM\Systray.exe 4.0 Microsoft(R) Windows(R) Operating System Zonealarm.exe 2.6.88 Zone Labs Inc. ZoneAlarm C:\PROGRAM FILES\ZONE LABS\ZONEALARM\Zonealarm.exe 4.0 ZoneAlarm Pstores.exe 5.00.1877.3 Microsoft Corporation Protected storage server C:\WINDOWS\SYSTEM\Pstores.exe 4.0 Microsoft(R) Windows NT(R) Operating System Ddhelp.exe 4.08.00.0400 Microsoft Corporation Microsoft DirectX Helper C:\WINDOWS\SYSTEM\Ddhelp.exe 4.0 Microsoft� DirectX for Windows� 95 and 98 Msinfo32.exe 4.10.2222 Microsoft Corporation MSInfo32 C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\Msinfo32.exe 4.0 Microsoft System Information -- Don Burnette D Burnette in N4 Some people do nothing wrong. The problem is, they do nothing. And THAT is wrong. "Dave Henrie" <[email hidden]> wrote in message news:PkoJ6.122701$[email hidden]... > Don have you used the process viewer to see if any rogue programs running > in the background? > dave henrie > "Don Burnette" <[email hidden]> wrote in message > news:LnnJ6.68706$[email hidden]... > > > > > > "ymenard" <[email hidden]> wrote in message > > news:ZdnJ6.21528$[email hidden]... > > > > > Yes it's normal Don, but it's not really "hacking". You see, most of > the > > > script kiddies (because they aren't really hackers, just kids thinking > > they > > > are hackers) do that. It's like going to somebody's house and testing > the > > > door knob. If it's locked, they move to the next house. If not, then > > they > > > have a potential case of a non-safe computer. They are just sending you > > > packets, it is not illegal. > > > > > > Zone Alarm protects you against that because it/you decide what port > (door > > > knob) you want to leave open and which one you want locked up. They do > it > > > all the time, I receive in average 10-12 alerts per day. Sometimes > more, > > > sometimes less. Unless you are not safe (check out grc.com which itself > > > just had a Dos lol), you shouldn't pay attention to them. > > > > > > > I have now received a total of 9 alerts since installing it about 3.5 > hours > > ago. A couple of those alerts were where the specific ip had tried pinging > > me multiple times. Very interesting. Makes me wonder what all has gone on > > before I had a firewall. > > I hope having the firewall doesn't degrade my online racing quality. > > > > > > Don Burnette > > > > > >

I am back to ZA Pro too & I forgot just how many alerts I got before! I'm really glad this thread started.. Thanx who'ever did it??.....Cheers Thom_j. "Don Burnette" <[email hidden]> wrote in message news:LnnJ6.68706$[email hidden]... <snipped> | I have now received a total of 9 alerts since installing it about 3.5hours

Quoted text (9 lines)

| ago. A couple of those alerts were where the specific ip had tried pinging | me multiple times. Very interesting. Makes me wonder what all has gone on | before I had a firewall. | I hope having the firewall doesn't degrade my online racing quality. | | | Don Burnette | |

"Don Burnette" <[email hidden]> wrote:

Quoted text (7 lines)

>After reading this thread, I downloaded and installed the free version >of Zone Alarm. >I have had it installed for about an hour, and already have received 4 >alerts of different ip addresses that were blocked trying to access my >computer through the internet. >Is this normal? Would this be hackers trying to get into my system? I'm >just wondering what's been happening up until I installed Zone Alarm/

Most of this is probably just "background radiation". Pings and other connection attempts are the normal way internet communication works. A client asks the server whether it is offering a service by sending a connection request on a specific port (e.g. http=port 80). Pings are used to check whether a machine is still alive. If your machine doesn't have software listening on that port to provide service (e.g. a web server) it replies that this port is closed: "this service is not available here". No harm done with or without firewall. If you have a dynamic ip, you might be getting old returns from the previous owner of that ip. If you're getting requests on ports that usually don't belong to a standard service but a known trojan - then it's probably someone scanning the net for computers with that trojan. However if you don't have this trojan "installed" on your system there's still no danger - your system simply ignores those requests. Don't be too quick to report those "offenders" more often than not they're victims themselves or the ip is spoofed. If you're getting A LOT requests for a specific port/trojan it's probably a good idea to check your HD for this trojan - again with a dynamic ip you might have someones ip who had that trojan. In short: don't worry too much about those alerts - if you have no trojan on your system you'd be safe even without a firewall. Martin

What OS are you running? I think WinME will restore it (if it works properly - not sure). W2K Pro should be able to be fixed as well with recovery console. My guess at that point is to extract the file(s) from the cab files and copy them into place via DOS (if using FAT or FAT32 file systems). then when everything is patched up, backup stuff and reinstall the OS On Sun, 06 May 2001 14:52:59 GMT, "Dave Henrie" <[email hidden]> wrote:

Quoted text (18 lines)

> When the hacker booby-trapped my system, my NOD32 virus checker caught it. >Unfortunately, I didn't have it up and running after updating my system. >Even if the virus checker had been active, I don't think I could have >prevented it once the hacker got into my system. I have some very unkind >words for that individual if we ever meet. Nod32 found the virus and said >it couldn't fix it...but saved it so I could email it to the Nod32 >programmers. What the virus did was re-assign a windows function to itself >so that when I removed the file all my windows programs quit working. i.e. >I couldn't open Windows Explorer because such & such a file was missing. I >couldn't email because the file was missing. I couldn't even shut down or >reboot because the file was missing. >"George Lewis" <[email hidden]> wrote in message >news:[email hidden]... >> Well, the problem with virus checkers are that they are "stupid" - >> they only check for known situations and conditions. I have yet to >> see an intelligent one that can look at something and say "hey! this >> doesn't look right!" if it fits the conditions, it gets marked. but >

Yeah, I forgot to mention that as well - Windows is really just a big database called the registry. make sure you clean that up. another reason why reinstall the OS (after an FDISK or reformatting of the drive) is the best way to go. On Sun, 06 May 2001 15:55:39 GMT, "Jan Kohl" <[email hidden]> wrote:

Quoted text (21 lines)

>"Dave Henrie" <[email hidden]> wrote in message news:fzdJ6.119457$[email hidden]... >> When the hacker booby-trapped my system, my NOD32 virus checker caught it. >> Unfortunately, I didn't have it up and running after updating my system. >> Even if the virus checker had been active, I don't think I could have >> prevented it once the hacker got into my system. I have some very unkind >> words for that individual if we ever meet. Nod32 found the virus and said >> it couldn't fix it...but saved it so I could email it to the Nod32 >> programmers. What the virus did was re-assign a windows function to itself >> so that when I removed the file all my windows programs quit working. i.e. >> I couldn't open Windows Explorer because such & such a file was missing. I >> couldn't email because the file was missing. I couldn't even shut down or >> reboot because the file was missing. > >LOL! Eeerrrmmm...hate to tell you this, Dave... ;] > >Remember when I said search the registry for the trojan? What they had done >was map shell extensions to executables to the trojan, then everytime you ran a program, >it attempted to restart the trojan. Very common practice with trojans, it insures >that other methods of restarting the trojan don't fail. > >Cheers!

should and do are 2 different things. the main point I'm trying to get across is not that virus checkers are a waste of time - you have to be diligent - make sure you have the latest updates for them. don't rely totally on the virus checker to bail you out. On Sun, 06 May 2001 18:59:58 GMT, Nos v7.0000001 <[email hidden]> wrote:

Quoted text (12 lines)

>On Sun, 06 May 2001 12:45:25 GMT, George Lewis ><[email hidden]> wrote: > >>Well, the problem with virus checkers are that they are "stupid" - >>they only check for known situations and conditions. I have yet to >>see an intelligent one that can look at something and say "hey! this >>doesn't look right!" if it fits the conditions, it gets marked. but >>the problem is that most new viruses haven't been "defined" yet so the >>stupid virus checker lets the files go on through. > >Most so called new viruses are not new, just different variations of >an old virus so a good virus checker should pick up on them.

Happy99 for example, came in email. It messes up your winsock.dll - have fun getting that fixed! On Sun, 06 May 2001 16:41:52 GMT, "Robin" <[email hidden]> wrote:

Quoted text (25 lines)

> >"Martin" <[email hidden]> wrote in message >news:[email hidden]... >> "Jan Kohl" <[email hidden]> wrote: >> >SNIP >> A firewall will not stopping trojans from infecting your system at all. >> It might have difficulties reporting your data to someone but that does't >> stop a trojan from doing anything to your system. Since trojans -once >> installed- have the same rights as any other program they can do pretty >> much the same things you can do - e.g. disable your (software) firewall, >> send emails, read/format your disk, etc. >> >> The ONLY way to be safe is to prevent trojans (and other nasties) from >> getting onto your system, i.e. don't install software of questionable >> origin, use an email client without all the fancy automation stuff, >> browse with the highest possible security settings, etc. Also check for >> secutity updates for your programs/OS. The best way is of course to store >> sensible data on an extra machine that connects to the net only when >> absolutly neccessary. > >Ummm, you mean "software of a questionable origin" such as warez?!? Hee hee >hee, serves them right for dl'ing it in the first place! > >

The firewall will only degrade your online racing in 1 way really - either you'll be able to race or you won't - in which case you have blocked the port! :) yeah - there's all sorts of stuff going on out there. scary isn't it? remember, they're just checking to see if anyone is home. normally your PC will respond to certain ports, but the firewall silences them. You see, hackers don't know what's at that ip address - it could be a router, a computer, a gateway, many different things - or nothing at all. It's when they get replies that make them curious. On Mon, 07 May 2001 02:03:23 GMT, "Don Burnette" <[email hidden]> wrote:

Quoted text (30 lines)

> > >"ymenard" <[email hidden]> wrote in message >news:ZdnJ6.21528$[email hidden]... > >> Yes it's normal Don, but it's not really "hacking". You see, most of the >> script kiddies (because they aren't really hackers, just kids thinking >they >> are hackers) do that. It's like going to somebody's house and testing the >> door knob. If it's locked, they move to the next house. If not, then >they >> have a potential case of a non-safe computer. They are just sending you >> packets, it is not illegal. >> >> Zone Alarm protects you against that because it/you decide what port (door >> knob) you want to leave open and which one you want locked up. They do it >> all the time, I receive in average 10-12 alerts per day. Sometimes more, >> sometimes less. Unless you are not safe (check out grc.com which itself >> just had a Dos lol), you shouldn't pay attention to them. >> > >I have now received a total of 9 alerts since installing it about 3.5 hours >ago. A couple of those alerts were where the specific ip had tried pinging >me multiple times. Very interesting. Makes me wonder what all has gone on >before I had a firewall. >I hope having the firewall doesn't degrade my online racing quality. > > >Don Burnette >

But, Linksys allows you to log all out/in going trafic. It would be easy to locate a program accessing the internet. I look at logs daily to see if there is any odd activity. I used to use ZoneAlarm, but I found that it had some bugs and its inability to work with VROC on my computer made it a pain. Anyone know why some games try to talk to the internet, when you run them? SLG "Jan Kohl" <[email hidden]> wrote:

Quoted text (23 lines)

>"Andy Carabino" <[email hidden]> wrote in message news:[email hidden]... > >> Jan, would you recommend firewall software on top of a hardware >> firewall built into a broadband router, such as the products from >> Linksys, SMC, and Netgear? > >Definitely. They (hardware) only protect (and marginally at that) inbound connections, they >do nothing against a program which has installed itself and is attempting outbound. >See our writeup in the hardware section for details... > >All the mini-firewall/routers are really just a convenience...they do not provide a really >solid firewall (as compared to things like Checkpoint, Cisco PIX, ect). That's not to >say that they don't work well, but if someone REALLY wanted to attempt to break >into your system, a Linksys/Netgear/whatever would not stop them... > >Cheers! >-- >�� Jan Kohl �� >SECURITY CONSULTANT >The Pits - http://www.theuspits.com >Castle Graphics - http://www.castlegraphics.com > >

(All spelling errors are intentional and are there to show new and improved ways of spelling old words. Grammatical errors are due to too many English classes/teachers)