Virus Scanners and Process Authentication for Windows?

cavedwler asks: "Like alot of people, for one reason or another, I still have Windows running on one of my PC's and have the standard virus scanner and wondered if that is enough. I ran across this site and found a program that seems to work well in conjunction with any virus scanner. It blocks any executable or script from running on your PC without your approval. It is not a virus scanner as it does not search for viruses but just does not allow them to run. It also has the ability to monitor files and restore them in real time if they have been modified. I have been running it for a while now and am thinking of recommend it to my boss for use at work. I was wondering if anyone else out there had tried this, or other programs similar to it, in a real world environment and had any problems or successes."

Comments

SecureEXE

[itwerx]

Sounds a lot like SecureEXE.

theoretically

[thexaspect]

while this sounds great in theory, if your virus software is as up to date as it should be on an important box, then how would these scripts be a problem? i've had outlood running on my desktop for YEARS and have received at least one email that contained all of the "famous" virus/scripts, and i've never had a problem. if you have your software set to NOT OPEN ANYTHING you dont tell it to, you dont have a problem. save your IT department some moeny and implement policies or some other such feature. just my 2 cents. . .

I use AVG + ZoneAlarm + Ad-aware

[rhild]

The combination of:

• AVG AntiVirus
• ZoneAlarm and
• Ad-aware

will keep your Windows box free of all sorts of nasty things for FREE.

Re:I use AVG + ZoneAlarm + Ad-aware

[alyandon]

s/ZoneAlarm/Kerio Personal Firewall/g

http://www.kerio.com/

Much more powerful than ZoneAlarm.

Re:I use AVG + ZoneAlarm + Ad-aware

[Permission Denied]

Funny thing about Kerio is that it works by hooking calls into wsock32.dll. You can write a simple program that does not use winsock and it bypasses Kerio.

Download winpcap. Unlike Unix libpcap, it includes both functions to create packets as well as capture them. It does not use winsock but rather installs an NDIS driver that sits lower in the TCP stack. You can then write a simple program that listens for packets and then manually constructs packets with UDP/TCP headers and sends them out. Completely bypasses Kerio.

If you'd like, I can post the code. I tested this about a month ago and it worked against the latest version of Kerio Personal Firewall. Took about an hour of work for a proof-of-concept program. You could get really crazy and implement a TCP stack in userspace and then write all kinds of trojans that would bypass TPF. Only works with privileged accounts since you need permissions to install an NDIS driver, but outside of controlled corporate environments, all Windows users use the Administrator account anyway.

Sygate and ZoneAlarm both install low-level NDIS drivers and are not susceptible to this attack. (At least I couldn't figure out how to bypass them - it may be possible to install a TDI hook which sits below NDIS, but this looks like months of work.)

Other than that, TPF really is much nicer than Sygate or ZoneAlarm, but this is a pretty gaping hole. I'd recommend Sygate over ZoneAlarm.

Re:I use AVG + ZoneAlarm + Ad-aware

[bedessen]

Actually I think the preferred method for busting through software firewalls these days is just to co-opt a trusted program to do your communications for you. For example, consider a virus/trojan like BUGBEAR or SOBIG, which deploy in stages and often communicate to various hard-coded web URLs for further instructions. All you need to do is create an IE ActiveX control (or script the actual iexplore.exe) and hide its window off-screen or something, and use it to do your http connections... the firewall will allow it through since it's under the context of the browser.

It all basically boils down to the fact that 99% of people run windows as an administrator, barring corporate environments. If you have administrative privileges you can do just about everything (including adding/removing/starting/stopping services & NDIS adaptors, killing processes, etc.) so the virus might as well just disable the firewall rather than trying to work around it. And if you don't have admin rights, as long as the virus scanner has any kind of user interface that runs from a privileged account (remember that all services run as LOCALSYSTEM by default), you can use one of the Shatter vulnerabilities and gain instant admin access. A lot of people 'poopoo-ed' that vulnerability by saying "this requires local access to the box, and even then it just gives you local admin access" but that's exactly the scenario we're talking about here, and it's the perfect way for a virus/trojan to gain the privileges it needs to hide itself.

I trust software firewalls about as far as I can throw them... that is to say, I don't.

These programs work...

[alyandon]

but do you really need them? Stuff like that tends to confuse the non-technical user types.

I find it far more effective to make sure that people aren't running as privileged users under NT. If they aren't running as a privileged user and you have a decent virus scanner that has up to date definitions you'll take care of 99.9% of the threats out there. Worst case scenario... some virus/worm wipes out the user's documents folder.

It really isn't that hard to properly secure NT/2000/XP... I just rarely see the IT staff of most companies bothering to do it.

Re:These programs work...

[ColaMan]

Worst case scenario... some virus/worm wipes out the user's documents folder.
or, some virus/worm wipes out the 30GB of corporate data that's on a mapped drive that the user has read/write access to....

Small problem..

[ewhenn]

... it always prompts me it i REALLY want to run SexDialer.exe Of course I do! This bug needs to be fixed!

The idea is neat IF...

[floydman]

and only if the ppl at your work know what they are doing. I used to work in a company where some employess saw the "Download the magical executable and see her ride" ,and they would (the employees i am talking about are programmers actually, or so called, i am sad to say). So it might be good for you, or your boss, who know what your are doing, but dont assume every one is as smart my pal. God created stupidty to haunt us.... FOREVER..:)

Trojan Defense System is better

[leonbrooks]

Australian made and amazingly comprehensive, especially under the hood.