Worms & Firewalls

The best and cheapest thing that you can do
to prevent worms in your servers is to have a good antivirus software and update it automatically every week.

McAffe has a product Called Netshield, which is the antivirus version for NT Servers including Win 2000 Servers.
Netshield detects all known worms such as Red Code, Linux/Ramen and Backdoors as BackOrifice, SubSeven, Deepthroat, etc.
It will also detect virus in email messages.

It is not enough to have NAT enabled, you must also filter all incoming traffic that is not needed for your daily operations.

If want to make sure that worms don?t break anything in the PC?s you can install Zone Alarm, which is one of the best PC Firewall.
In case that you have a PC infected with a worm, Zone Alarm will say "Hey, you have port 31337 listening on your PC, that means that you are infected with BackOrifice.

If each client has more than 50 PC?s it will
be cheaper for you to buy a good Firewall solution that includes antivirus protection
such as the Computer Associates e-Trust Firewall.

I hope this helped.

Cheers,

Gaston.

A firewall does not keep out a worm because it comes in (typically) over email. A good virus scanner on the email server and on each computer will generally stop them.

Once a worm is on a computer in your network, it (sometimes) reaches out overyour LAN to touch other stations. Clearly, since the path between stations is not going through the firewall, the firewall is no help here.

NAT is completely useless for keeping out most worms, since they cross the router on email.

Password protecting a share is useless because eventually a user will connect to some other share, with the password. The worm notices that there is now another drive connected, and does its thing. Write-protecting would help, but only if there is no legitimateneed to write on the share (very unlikely).

Symantec has a tool on their site to remove the latest worm (w32.sircam).

Bottom line --
1. If you have a mail server, put a virus scanner on it.
2. Put a virus scanner on every computer.
3. Update the virus definitions on all of them at least weekly.
4. Educate your users to not open attachments unless they know the sender and are expecting the attachment. Even then, if the extension of the attachment is not what they expect, do not openthe attachment.

Good luck.

1. NAT will protect you from direct connections from outside. How it works - your PC wants to get to internet. but it has fake inttranet IP. So it sends IP-packet to gateway. gateway intercept this packet and change ip-address to real on - its own. Then it get answer from internet and resends it to your PC. So - your PC is invisible from outside, there is no way to connect to it. But when you request some information from server you can download some kind of scripts or activex components and they will do things. If one worm will get inside your intranet it will spread itself using mail, web, shares and so on.
2. sure. It will stop some kinds of worms - they won't be able to copy themselfs directly. but if user login to share - worm can reveal password or use open connection.
3. antivirus software. most important is eMail - so you should check does yous mailserver allow to use some kind of anitivirus software. other way - monitoring antivirus software - it checks every open/read/write operation on server and see if everything is ok. and last - patches, fixes, service packs. many worms use bugs in server, browser and e-mail client implementations.

At least one of these customers were running a virus scanner, and it was current. Several workstations got messages about the worm, but could not clean or delete it, and it infected their computers. Others got no warning at all.

It would seems virus scanners are not sufficient. Is there a good firewall solution for both server and workstations?

Firewalls won't stop "worms" thats the job of your email setup, or virus detector (when you get them from a web page) However for things as mentioned like Back Orifice, sub seven and the like one thing you SHOULD do with your firewall if make sure that you not only block incoming ports on the firewall but be sure to filter outbound traffic also. Anotherwords if all your outgoing ports are open then a Trojan can communicate via port 32000 or what ever and reroute communications through port 80.The other thing that is a must do (in my humble opinion) is that the key to not letting a worm in is to Filter (delete them)out extensions like .VBS or ,jsc .exe from your exchange or mail server. If someone wants to send you an exe file or java file, or whatever, have them change the extention and it will get through...but you knew it was coming.

oh yeah.... If you are running IIS 4-5 and other products, you need to patch them, with IIS 5 you can install an auto-update program that tells you when there is a new patch from Microsoft. Of course with a vunerable system a person could get in your system and put in a worm firewall or not.

This question was closed by the author