Important!!! I need security advice quick!

[Larry_OHF]

I recieved an e-mail from the IT dept of UNCG, supposedly, and the e-mail is stated below. What I want to know is...how can I tell if the link and all is for real? I mean, I have two firewalls and the ping protection enabled. How can the e-mail posisbly be true?

This is an Information Technology emergency security announcement. IT is aware of a serious vulnerability in MS-Windows Operating Systems that is being actively exploited at UNCG today. Internet security organizations are calling this the "W32.Blaster.Worm", also known as the "RPC DCOM" worm. This worm spreads directly to the operating system via the Internet and your desktop workstation is more than likely already infected. You did not receive this via email, or through any other normal computer use. If you are already infected: - "Windows update" WILL NOT fix the problem. - Anti-virus software WILL NOT fix the problem. IT has created a local network resource to fix infected machines. Even if you machine is not infected, please visit this site immediately to obtain the fix: http://web.uncg.edu/syn/patches/ If you do not fix your machine, malicious users outside of UNCG will be able to remotely access your machine, your files and the UNCG network.

[ 08-12-2003, 07:57 PM: Message edited by: Larry_OHF ]

[Cloudbringer]

Larry go here http://microsoft.com/security/incident/blast.asp

And check this IW thread: http://www.ironworksforum.com/ubb/no...;f=10;t=017096

[ 08-12-2003, 08:06 PM: Message edited by: Cloudbringer ]

[johnny]

You can also remove the worm with www.bitdefender.com

[Larry_OHF]

I checked everything and I am clean. I had the security update before this happened. I have checked the registry keys and sys32, and all is clear.

Now...a question about the XP firewall. I do not have it enabled from what I can tell, but I do have a firewall in my router, as well as Zone Alarm. Am I safe enough without enabling the XP firewall? BTW...I went to Windows security, and watched the little movie where they show you how to turn on the XP firewall. I went there to the settings that they showed, but I do not ahve the ability to enable anything there. Something is wierd with it, and I am expecting it to be due to the router config. Anyway, any info is appreciated.

[Bungleau]

I don't have anything specific on the firewall issue, Larry, but whenever you're in doubt about the origination of an email, send an email back to ask if it's legit. Most IT folks will appreciate a verification email like that; it beats the heck out of those people who say "but I expected Snickle to say he loves me..." [img]smile.gif[/img]

[WillowIX]

Originally posted by Larry_OHF: Now...a question about the XP firewall. I do not have it enabled from what I can tell, but I do have a firewall in my router, as well as Zone Alarm. Am I safe enough without enabling the XP firewall? BTW...I went to Windows security, and watched the little movie where they show you how to turn on the XP firewall. I went there to the settings that they showed, but I do not ahve the ability to enable anything there. Something is wierd with it, and I am expecting it to be due to the router config. Anyway, any info is appreciated.

You can as easily get the patch from Microsoft so there is no need to trust the link in the email. If you want information about viruses subscribe to the symantec news letter. [img]smile.gif[/img]

If you have Zonealarm there's no need to enable the XP firewall, it isn't as good (doesn't keep track of outgoing traffic at all). So keep Zonealarm and let the XP firewall stay buried. Your hardware firewall will make things difficult for hackers and the software will make things more difficult for trojans.

[Cloudbringer]

Larry, Willow's right. In fact, Nacht disabled the XP firewall on my computer since I have Black Ice AND the router firewall plus encryption. He said that the XP firewall is not that good and hackers have lots of ways to get by it.

[Nachtrafe]

Originally posted by Cloudbringer: Larry, Willow's right. In fact, Nacht disabled the XP firewall on my computer since I have Black Ice AND the router firewall plus encryption. He said that the XP firewall is not that good and hackers have lots of ways to get by it.

LOLOL...She's just being polite. What I said is 'It SUCKS!'

As Willow said, it does *nothing* to monitor outbound traffic, so, if you depend on it, and manage to get a trojan...well, to put it bluntly, you're screwed! Basically, just about *any* 3rd party firewall is better than the XP one.

Larry...with ZA and the router's firewall, you should have little to worry about. Just keep your anti-virus program updated, and exercise the normal amount of caution when getting emails with attachments/running downloaded programs, and you should be fine. [img]smile.gif[/img]

PS: Bungleau's right, if you're not sure of the origin of the 'warning', just send a confirmation email. I've talked to the IT guys at work, and they all, without exception, LOVE getting questions when they send out virus alerts. It lets them know that people are paying attention to what's going on, and are, hopefully, not virusing the hell out of the network. [img]smile.gif[/img]

[Dagorion]

I think I had the virus but it didn't do what it said it did. It did some pretty funky stuff with my folders when I was connected to the net though...