Is complete home security possible?

Tiny is pretty good. I have been using that on my network for years (though I dont think they make a freeware version anymore). It is pretty good at stopping outside attacks. It is also quite flexible, much more so than hardware appliance.

I will agree there. Ghost came with one computer years ago, and I regularly ghost my machines to get rid of anything that I might now know about. I ghost my machines once a month as part of a regular maintenance schedule. You will need a second hard disk, and a floppy to boot from, to do this. I open up the machine, attach the second hard disk, boot from the floppy, and then ghost the machine.

I'm curious to see an answer that helps me out with advice that I don't already know. Recommendations for virus programs etc are not going to help, since I already mentioned in my ad that I had what may be the best virus program on the market installed, still got a trojan. Same with firewalls, had one installed, spent a lot of time with the Kerio ruleset, blocking off dangerous ports like 135, until ALL open ports were stealthed, and still got a trojan. I'm not running as Administrator, just as a user with admin rights, still got a trojan. I don't need a network setup, so don't have a router. Even so, if you say I should steer clear of any sites where I might download a virus, then the hardware router is obviously not going to protect me either. I can't know which site might send me a trojan.

Bottom line, I don't have a problem knowing when I'm infected. I don't need programs like HijackThis, because I already know what should and shouldn't be present in the task manager. My problem is avoiding getting infected in the first place, since SP2, a good virus program and firewall, as well as a resident program that alerts me to other programs trying to install themselves in my startup have proven to be insufficient in protecting me. Especially if the trojan can disable these programs (I'm assuming hackers have already figured out how to disable SP2's systray warning from the security center). And I've been using FireFox and Opera for a long time, avoiding IE like the plague. But my browser choice had nothing to do with the trojan's ability to load programs on my system and use TFTP to send data out.

The nice thing about the Corp Edition is that it doesn't expire every year like Norton AV does. I still have clients running 7.6 that get updates that I can't convenience to upgrade.

That's a very different situation from what I described.

Indeed, and that's a very different situation from what I described.

I think we've had this discussion before. Say you run a web server on the

Client port 1430 -> server port 80 OK Server port 80 -> client port 1430 OK Client port 1431 -> server port 80 OK Server port 80 -> client port 1431 OK Client port 1432 -> server port 80 OK Server port 80 -> client port 1432 OK Client port 1433 -> server port 80 OK Server port 80 -> client port 1433 BZZT - DROPPED Client port 1434 -> server port 80 OK Server port 80 -> client port 1434 BZZT - DROPPED

You're thinking of the port as a *listening* port, but it can just as well be used as a high port for outgoing traffic, in which case it's used for

It blocks outbound *return* traffic. Since Windows uses incremental high range ports to connect to remote services, ports 1433 and 1434 usually

Regards,

No yer not. Any news client that is worth anything will let you change ports. newsbin pro does, newsleecher does and so do most of the others.

Yes, the Corporate Edition also doesn't install more than a dozen different services, registry Run section triggers and scheduled tasks, like the consumer version does. One or two services is all.

You can also check the version of the corporate edition from the outside, which is quite useful for firewalls that support this -- if a client doesn't have the latest virus definitions installed, you can block it from accessing the outside. But how (I hear you cry) can you download the latest virus definitions if your firewall blocks you? Simple -- with the corporate edition, you normally don't download the updates directly from Symantec to the client, but from a local liveupdate server on the only computer that needs to fetch them from the outside. Less bandwidth wasted, and greater security -- clients can still get the latest downloaded update from the local server even if the internet connection is down, and there's an audit trail of which computers have updated and which haven't.

Regards,

Simple answer. Buy a router, nuff said.

That's not the problem. The problem is that the text is *always* going through a rendering engine that parses the text. You *can't* display the text verbatim and unparsed in Thunderbird -- it's not possible.

Regards,

It is insanely stupid not to have a router. they are much better then software firewalls. basically they won't let anything in. not unless you specifically ask for it really. i have not once had a virus that my routers have let through. not once. i do not use firewall software cus a router that has spi and is descent enough and you don't need a software firewall. i never have one on one pc in my home and not once has it ever been attacked or virus or anything. a normal linksys 1 port router i used to use and never had attacks, then i upgraded to a belkin and zywall and now sonicwall. never had issues. the only thing a pc should have is a virus app. i can't imagine how you got infected. other then your software firewall let it through or something on your end messed up like the user, or the software wasn't configged right, then it goes back to the user etc. just get a router and plug it in, don't need a firewall software unless the user downloads stupid apps with spyware and all that junk.

your message really kinda pisses me off cus you seem ignorant and not willing to listen to anyone. we have all given you good info and you are like none of it is good enough or i already know. well if you already knew you wouldn't be in this position now would you?

just buy a router and then yer safe in my opinion. i say safe cus i never had problems, no one i knows has had any issues at all with attakcs, viruses nothing. and they all run routers. even the most simple ones are good enough cus i know no one who has a problem with the net who is behind one.

No, outside client tries to connect from port XYZ to your port 1433 and if you forward it inbound then it works just fine.

Inside client tries to connect to outside service listening on their (remote) port 1433 and is blocked - this means that your local computers can not connect to the MS SQL port listener service at the REMOTE COMPUTERS site.

If the remote computer is using 1433/1434 for something listening other than SQL Server (which should not be directly exposed to the internet anyway) then you need to get a better service.

The only thing that should be listening on 1433 is SQL Server, unless your running some non-standard application. Check the Port lists, 1433 is for MS SQL server.

Nope, it does not block outbound normal traffic, except to REPORT DESTINATION PORTS that are already defined as used by services that should not be exposed to the internet.

Corporate Edition 9 includes scanning of POP/SMTP, MS Exchange and Notes connections, has a smaller footprint, seems to be more efficient, and I can setup a server to manage all the clients from one location - in other words I can set the properties and the users can't override them.

Thunderbird can use other ports besides 119.

John

Smarter firewalls can identify p2p traffic and block it dynamically.

Well a reasonable fee to keep development going and virus definitions current is a good thing.

John

That would be very silly for those of us who reboot every few months. Better to have it check late on Tuesdays, since Microsoft now always release their security fixes on Tuesdays.

Huh? Thunderbird does Usenet too, and so do a whole lot of other clients.

Ever heard of "Run As", or even better, setting specific privileges through the Security MMC snap-in?

Why should I do that instead of a weekly complete backup with daily increments? That way, I don't have to reboot, which Ghost requires.

It doesn't ensure that at all. You can easily ghost malware before you know you've been infected.

Charles Newman

Bullshit. Most news clients let you specify the port. I can't remember ever encountering a news client that *won't* let you specify the port.

No, you're stuck because you *think* you're stuck.

Most likely the mofo who circumvented your security was... you. ;) Chances are you got the bug in something you downloaded, or someone else has access to your system and they downloaded it.

You have to be careful what you download and run on your system. Without that, there really is no protection that will help. It's pretty much the same as your home. You can have a cast iron front door and it won't do you a bit of good if you open it and invite the axe murderer in for tea.

A good NAT device with SPI, at minimum, is a must. Nothing is perfect, but it will provide a good level of protection from *outside* attacks.

A software firewall is good to have as well since it can alert you to a program trying to connect out of your machine. But as you've seen, it's just software and a trojan can possibly deactivate it.

A virus scanner is a must since they can often detect a trojan before you run it. But again, it's just software. An AVS can be defeated, or may not recognize a new variant of a trojan.

Avoid honey-pots unless you are prepared to deal with the possible consequences. Viruses/worms/trojans survive by propagating in one way or another. The best way to do that is to put them in things that people are likely to run but may feel guilty for admitting. In other words, pirated software, warez sites, crack sites, etc. If you ever trudge into cesspools, wear boots.

My best recommendation: Ghost, or another system imaging program. Image your system partition on a regular basis and you can always restore it and have a clean slate. Imaging the system partition to another partition, or another hard drive, is a very quick way of ensuring peace of mind. So if you run into something goofy and think "It was behaving this way yesterday...", you can just restore yesterdays image and be done with it.

"Charles Newman" wrote in news:s5GdnQ_aYva snipped-for-privacy@comcast.com:

I am sorry Newman. I don't believe in App Control anymore. A personal FW solution such as Tiny will never be able to match the protection of a FW appliance -- ever -- not even a low end one. Tiny may be able to supplement a NAT router, which many consider to be hardware FW (I don't) and that's about it. I appreciate your support of Tiny. You'll have to convince someone else that Tiny is better than a standalone FW appliance, which I know it's not. I'll assume you know the difference between a NAT router that's being called a FW/hardware appliance with some FW like features as opposed to a FW appliance that is running a FW that meets the specs in the link.

snipped-for-privacy@address.com (Joe Samangitak) wrote in news: snipped-for-privacy@posting.google.com:

You're not going to get that advice. There is nothing running on the computer that's going to stop another program from doing something once that program has reached the machine and has been executed by the user. If you have caused the execution of the malware program by clicking on something that has caused the execution of the malware program whether or not the click event caused the malware program to drop its payload of other backdoor programs and they are executed, then it's over as you have seen.

If you're looking for that magic bullet, it's not there. A malware program that drops a payload must be executed by the end user in some kind of shape, form or fashion. It just doesn't happen without the assistance of the end user.

The buck stops with you and it doesn't stop anywhere else.

Duane :)