Security

Ask something
Discussion Locked

Virus spread through win9x network share

0 helpful
6 replies

by psx 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Problem:
I have a network of 4 win98 PCs (the particular software I am running requires win98) connected to the same router, which provides a DSL connection. Three of these PCs (let's call them PX1, PX2, and PX3) are configured to be on a different network than the fourth PC (let's call it PC1).

PC1 is meant to be a general use PC (Outlook, IE, etc.) so it has a high chance of getting infected by a virus. Fortunately it is of low importance unlike the PX computers. To minimize the chance of a virus spreading through open network shares, infecting any of the PX computers, I configured the PX computers to be on a separate network (different subnet) than the PC1 computer. For connectivity between the two subnets, I "bridge" the networks using NETBEUI, hoping that the virus(es) would not be able to exploit NETBEUI (big risk but I do not know of any recent viruses that does this).

Question:
This setup was fine and dandy because I did not need any of the PX computers to have internet connection, but now I do so what is the best way to reconfigure this network? (Keep in mind that I cannot change the OS).

6 replies

by psx

*Note: My DSL connection at this location has 5 static WAN IPs.

Below are my 2 solutions to this problem. They are not tested and probably do have flaws. Please read and provide your comment.

Solution1:
Connect DSL modem to a switch. Connect two routers to the switch and configure each router according to its internal network needs. Assign a different IP to each router.

Router1 controls Network1 (which includes PC1 and any other non-critical computers): Typical NAT blocking all well-known ports.

Router2 controls Network2 (which contains only the three PX computers): Block all internet connectivity except ports which internal applications require.

Use NETBEUI to bridge the two networks

----------------------------------------------
Solution 2:
Keep current router. Configure router to accept connections from multiple subnets (xxx.xxx.0.0).
Put Network1 on subnet xxx.xxx.1.0 and Network2 on subnet xxx.xxx.2.0. Modify subnet mask on each computer to only accept connection from its own subnet (255.255.255.0). Use NETBEUI to bridge the connection.

by o_fausto

Well I came up with three solutions,

1 - Buy a router like Enterasys XSR or Cisco 83X series and put each network in a diferent Ethernet port and place access-lists protecting the networks in the inbound and outbound direction

2 - Buy a dedicated hardware firewall with 3 ethernet ports 1 to connect to the router, 1 to the PX network and the third to the PC network ( insecure) and configure strict rules classifing the traffic to allow only PC -> Internet/PX ->Internet and Established from PX to PC to ensure that traffic always flows from the trusted network never from the unsecure one
3 - Download and install the home version ( I'm assuming that we are speaking of a home network) of Clarkconnect firewall, configure a DMZ and place the PC on that segment only allow PC to reach the internet, deny any unwanted traffic between the interfaces. ClarkConnect also has a built in antivirus.

Have fun !

Foliveira

by wlbowers

I got news for you. Not only do the current virus look for shares on a network, they ping for addresses, scan through subnets, well you get the point.

In other words if you establish connectivity so can the virus. So the separate subnet is not gonna slow them down much. It causes you more hassle than it does them.

Common your network. Install a good antivirus/firewall program on each and every computer.

Microsoft has agreed to provide Win98 with the most critical updates for a while longer. Setup the update notifier and "DO THE UPDATES".

Computer Associates currently has a program where they are giving a copy of their my-etrust EZ Armor program to anyone who has a microsoft os on their computer.

Go Here: http://www.my-etrust.com/microsoft/

Remove spaces that pop up after copy and paste.

Install it on all machines.

Configure it to autodownload daily.

Outlook has a rules utility. Learn to use it. You can take most of the gunk straight to the trash.

Install Ad-aware and spybot and run them both on a weekly basis.

Threaten to break anyones fingers that go near game sites, that have any urge to do anything but delete email that they didn't request.

Good Luck Lee

This discussion is closed to new replies.