Re: Is the Gaobot virus blocked with a firewall?

From: Crusty \(-: Old B_at_stard :-\) (B_at_stard)
Date: 05/07/04 

Date: Fri, 7 May 2004 18:32:54 -0400

It would depend, I think, upon the type of firewall used and how it is
configured. Lock down the open ports and nothing is getting in. Of course,
you may not get out either. 

-- 
Regards:
Richard Urban
aka  Crusty (-: Old B@stard :-)
"Alan" <somewhere@nospam.pew> wrote in message 
news:109o1k77tr51881@corp.supernews.com...
> And eventually, someone might actually answer the OP's question as to
> whether the Gaobot virus is blocked by using a firewall.
>
>        Alan
>
> "Steve Nielsen" <steve_nielsen@nospam.nowhere.net> wrote in message
> news:uIfzblHNEHA.1272@tk2msftngp13.phx.gbl...
>> Ghostrider wrote:
>>
>> >
>> > Brian C wrote:
>> >
>> >> Is the Gaobot virus blocked with a firewall?
>> >>
>> >> I was curious if anyone got the virus using a firewall?  Since it is
>> >> not detected by some virus programs.
>> >>
>> >> Brian C.
>> >
>> >
>> >
>> > A firewall is just one of the lines of defence for a computer
>> > system. Unless one keeps the computer completely off a network
>> > or does not accept any input from any untrusted, external source,
>> > including floppies, cdroms, websites, etc., then it is penetrable.
>> > But this is an improbable situation since users must e-mails, send
>> > files as attachments, do downloads, etc.
>> >
>> > Gaobot, according to SARC, infects computers through an IRC
>> > channel. To have an IRC channel, there is an open port through
>> > the firewall, or it might exploit ports 135 and 445. Does this
>> > answer the question about it?
>> >
>>
>> You're confusing how it infects with how attackers can use an IRC
>> channel to control an infected machine.
>>
>> It infects through the DCOM RPC vulnerability using TCP port 135 and the
>> RPC locator vulnerability using TCP port 445. This is different than
>> allowing an attacker to access an infected computer through an IRC
> channel.
>>
>> Steve
>>
>
>

Relevant Pages

  • Re: Virtual Private Network - Beware its a Hackers Secret
    ... So checking for open ports no matter ... The reason for this is because a malicious hacker ... If _you_ did a tiny bit of work, you'd install a Firewall to keep people out, ...
    (alt.computer.security)
  • Re: Virtual Private Network - Beware its a Hackers Secret
    ... So checking for open ports no matter ... The reason for this is because a malicious hacker ... If _you_ did a tiny bit of work, you'd install a Firewall to keep people out, ...
    (microsoft.public.security)
  • Re: Virtual Private Network - Beware its a Hackers Secret
    ... So checking for open ports no matter ... The reason for this is because a malicious hacker ... If _you_ did a tiny bit of work, you'd install a Firewall to keep people out, ...
    (comp.security.firewalls)
  • Re: Any suggestions?
    ... trying to get the Kerio program to recognize the proxy browser, ... We have scanned your system for open ports and for ports visible to others ... > "Firewall" tab to "Ask Me First". ... > then see the five or six default rules supplied by Kerio. ...
    (comp.security.firewalls)
  • Re: Is the Gaobot virus blocked with a firewall?
    ... >> Is the Gaobot virus blocked with a firewall? ... You're confusing how it infects with how attackers can use an IRC ... allowing an attacker to access an infected computer through an IRC channel. ...
    (microsoft.public.windowsxp.general)