Windows XP and Viruses

Thanks But the problem I am having is that I not only have to prevent my application but also the whole computer ( as we are shipping the computer for our application. We can disable unnecessay application like IE etc but we can not prevent the users from plugging in a network wire. So I was looking for something that would protect my computer is there is a virus floating in the user's network and he/she hooked our PC to the network.

Our PC is supposed to be running our app and montoring a device to which we connect over ethernet.

I know this isn't a quick solution but it sunds like a great application for a boot cd os or an embedded os appliance.

In using a PFW on the machine, the ports will be closed by default and will only be opened due to a solicitation for inbound traffic due to a programming making that solicitation to a remote IP. Otherwise, all unsolicited inbound traffic is blocked. Some self populating malware that has infected a machine will seek out other machines, but the FW will prevent this type of an attack since it's not solicited inbound traffic. I am not a writer of malware programs, but I would think that a malware program would have to know the interfaces of your server/listening program with its port open to exploit it.

You should use an AV on the machine period as malware will come from other sources such as email, the browser, file downloads, etc etc. You cannot prevent a user from doing something as a developer and it's not your programs being used. The only thing you can do is to make sure your program is secure if it's an Internet facing application by following and implementing secure programming techniques.

Duane :)

Well they do have AV's that are suppose to have heuristic analysis that can catch some day zero in the wild exploits. Your best bet is to go to alt.comp.anti-virus about AV possibilities.

If this is an NT based O/S, then you can shut down services such as File and Print Sharing and things of that nature to shut down vulnerable ports along other things to lock down the O/S

You can search Google or

Duane :)

Oh one other thing, since I am starting to use C# Windows based .NET program technology; there is a part of the .NetFramework that can be used to prevent the unauthorized use of a machine. The situation was similar to your situation where the .Net program was running on the shop floor machine and the machine was dedicated to only use that application and users where not doing that like brining in cd(s) and other misusage and how ..NetFramework could shut it down by setting .Net security policies at the machine level.

HTH

Duane :)

snipped-for-privacy@yahoo.com wrote in news:1112028844.258234.60650 @o13g2000cwo.googlegroups.com:

Oh one other thing, since I am starting to use C# Windows based .NET program technology; there is a part of the .NetFramework that can be used to prevent the unauthorized use of a machine. The situation was similar to your situation where the .Net program was running on the shop floor machine and the machine was dedicated to only use that application and users where not doing that like brining in cd(s) and other misusage and how ..NetFramework could shut it down by setting .Net security policies at the machine level.

HTH

Duane :)

Simple answer. If you don't load them, they don't get installed. These things don't magically appear on the hard disk by themselves.

Wow, think about that for a minute - you have to listen on a particular port number. Is it a "common" port, like 80 (if so, why), or some random number like 5759 (grabbed from your Message-ID header)? Do you need _ANY_ other network functions - like the windoze 'drop your pants, here I come' ports (135-139, or 445, or whatever)?

Isn't a simpler concept to not install the malware in the first place?

Figure out what ports you MUST have running, and why. From another system on the same network, run a port scanner like nmap and see what else is open on your system. Do you really need "that" (whatever "that" may be) for your system to operate? If yes, look to see how you can restrict it to specific peers. If no, shut the port down. Here's a major clue for you - if nothing is running on a port, it's closed, and you can't be infected through a closed port.

Yes - DON'T INSTALL MALWARE. Also, make sure your application is running as a non-privileged user NOT ADMINISTRATOR. Further, do not install those parts of windoze that are not needed, and then make sure the administrative password is a good one, and is not handed out to every 1d10t who walks within twenty thousand yards/meters of the d4mn computer.

Old guy

So you are running a server on those boxes. Well, that seems neccessary in that scenario, and only you know what protocol is used to communicate with the server and how safe the particular protocol is.

Any software, that is trying to control malware, has that problem.

That is never wrong.

Virus installation normally requires user interaction. Some spread via network shares but usually have to be executed to become active. Disable all logins, choose a good password, don't give out Adminsitrator passwords, disable all other network services and network shares and you don't need a anti-virus scanner.

Virusses and other malware usually doens't fall from the sky, but are installed by a user. Disable the logins, lock down the box, done.

Wolfgang