W32/IRCbot.worm!MS05-039 - Labelled High Risk

Lothandar · Post by **Lothandar** » Thu Aug 18, 2005 11:52 am

Takitothemacs wrote:... fairly symptomatic then that you dont regualrly patch your machine(s)

I was agreeing with you. Tool.

I think I'm too sarcastic that even when I'm not being like that, it seems like I am

Takitothemacs · Post by **Takitothemacs** » Thu Aug 18, 2005 12:33 pm

Lothandar wrote:I was agreeing with you. Tool.

I think I'm too sarcastic that even when I'm not being like that, it seems like I am

and calling me a "Tool" is going to help?

Ankh Morpork · Post by **Ankh Morpork** » Fri Aug 19, 2005 1:01 am

Tool wrote:and calling me a "Tool" is going to help?

Tbh, its a rather sexy name..

/Ankh

Takitothemacs · Post by **Takitothemacs** » Fri Aug 19, 2005 6:36 am

Ankh Morpork wrote:Tbh, its a rather sexy name..

/Ankh

hehe surprised you havent got it as a toon name then

Post by **Xest** » Fri Aug 19, 2005 12:03 pm

Takitothemacs wrote:why would he be doing that... McAffee is crap (IMHO) there are much better options out there for protecting your PC... also there is a great thing called being careful what programs, downloads you do install/use.

I used to think the same about McAfee until I recently had the mispleasure of witnessing the attempted deployment of Sophos to to 171 schools. McAfee is a dream compared to the utter joke that is Sophos. Never before have I come across a virus scanner that requires XP SP1 to even work (or IE5.5+ on pre WinXP machines), doesn't do anything with viruses by default other than warn you have - you have to set it in options if you want it to clean/remove infected files. The current version is slightly better, but the previous version forced you to install the auto-update section as a seperate program, meaning you have to run 2 installs which might sound like nothing but when you times that by the amount of computers then again by the amount of schools and it soon builds up. The autoupdater is also buggy working through a proxy, sometimes you have to load up IE and authenticate via IE before Sophos wakes up and starts to update even if you've correctly filled the proxy settings in Sophos. Overall, I'd never, ever touch Sophos again, not only the worst peice of AV software I've ever seen, but probably one of the worst programs I've ever seen.

McAfee certainly isn't the best but it's a damn load better than Sophos, and besides, McAfee's ePO is a very nice tool for deploying across a domain, managing updates and reporting back with nice fancy graphs with pretty colours that even simple minded managers can understand

One thing to bare in mind is that the corporate version of McAfee AV is somewhat different to the home version - none of those crappy web based installs and dialogs that the home version forces you to suffer.

Takitothemacs · Post by **Takitothemacs** » Fri Aug 19, 2005 1:40 pm

aye... there are plenty of utter crap ones... not had any experience with Sophos myself... but have worked with CA, Mcaffee and Norton with bad experiences... the only ones I have any positive exp with have been Trend on a corporate level and AVG from a home user basis... AVG is nice as the schedules work nicely and the autoupdates pretty much take care of themselves and it requires little to no intervention for my home stuff which is nice. Also for a home user... its free!

Trend kicks the arse of all others in my experience.. the central management is absolutely brilliant... there is no better feeling than having the ease of including a script in the login that updates on startup and if the machine wasnt online when a client upgrade took place then it installs the latest client whilst the server performs pattern and engine update checks every half hour, updating clients whenever a change is detected...

Even forcing updates to any machine that VPN connects to the server before they are fully connected... lurvly application and throughout the sasser/blaster outbreaks we were as good as oblivious to the mess that was unfolding around the world as Trend had done its job... but then thats why it is also one of the most expensive solutions out there these days...

Cromcruaich · Post by **Cromcruaich** » Fri Aug 19, 2005 3:01 pm

Ofcourse you should never log on to your PC with an account that has admin privs as well. Use runas if a proggy doesnt like being run as a non admin. This would certainly stop this worm and most others.

open up a dos box, i mean command prompt (!) and type runas /?

Cromcruaich · Post by **Cromcruaich** » Fri Aug 19, 2005 3:05 pm

Takitothemacs wrote:aye... there are plenty of utter crap ones... not had any experience with Sophos myself... but have worked with CA, Mcaffee and Norton with bad experiences... the only ones I have any positive exp with have been Trend on a corporate level and AVG from a home user basis... AVG is nice as the schedules work nicely and the autoupdates pretty much take care of themselves and it requires little to no intervention for my home stuff which is nice. Also for a home user... its free!

Trend kicks the arse of all others in my experience.. the central management is absolutely brilliant... there is no better feeling than having the ease of including a script in the login that updates on startup and if the machine wasnt online when a client upgrade took place then it installs the latest client whilst the server performs pattern and engine update checks every half hour, updating clients whenever a change is detected...

Even forcing updates to any machine that VPN connects to the server before they are fully connected... lurvly application and throughout the sasser/blaster outbreaks we were as good as oblivious to the mess that was unfolding around the world as Trend had done its job... but then thats why it is also one of the most expensive solutions out there these days...

Always used Symantec NAV Corp Addition which has the same feature set you mention above, never had a problem with it myself.

Ovi · Post by **Ovi** » Fri Aug 19, 2005 3:43 pm

Cromcruaich wrote:Ofcourse you should never log on to your PC with an account that has admin privs as well. Use runas if a proggy doesnt like being run as a non admin. This would certainly stop this worm and most others.

open up a dos box, i mean command prompt (!) and type runas /?

That works fine on work machines, it's a real pita on home machines still though since most games and other home orientated programs still don't work properly without admin rights, I know they can be fixed, but I spend all day at working fixing PCs when I get home I just want to play

As for AV programs, I used to dislike McAfee, but have had to use it due to it being the "corporate standard". The last 3 years or so it seems to have become much better, and really doesn't cause me any great concerns any more. For home I also use AVG which seems to do the job, although not as easy to use as McAfee VSE.

Pikey · Post by **Pikey** » Fri Aug 19, 2005 3:58 pm

Sophos really that bad never heard any bad reports at all about it...

And speaking of the new w32 Zobot worm thats going about it hurts...

Some of you may have heard of DSG retail ie Dixons Currys and PC World well it took 7 of the 8 servers that control the UK 5 of which had to be rebuilt...

And yeah running McAfee... EEEKEKK !

So its kinda hurtfull...