Re: AV and malware protection?

On 7 Oct 2011 at 9:34, John Hornbuckle wrote: > I just use Microsoft Security Essentials. Seems to work well enough for me. Or > am I naïve? I don't trust MSE, as it requires Automatic Updates to update itself and I don't let AU run on my systems. Microsoft has slipped to many things like "Wi

Re: AV and malware protection?

On 7 Oct 2011 at 11:49, Micheal Espinola Jr wrote: > > No specific sites... well, actually I /can/ get the IP of one of the > sites. The drive-by added bogus google and bing entries to the hosts > file in an effort to have another vector on system [re]infection. > Malwarebytes promptly blocks

Re: Firewall/Router recommendations

On 5 Oct 2011 at 21:08, Kurt Buff wrote: > Well, true, but IMHO it's much more important to find the root cause > ATM, since the unit has until now performed to expectations. +1 on that suggestion. Check out the ClearOS logs. Perhaps the OP has an infected box applying a DDOS to someone off t

Re: Server gets sloooower the longer it stays up

On 5 Oct 2011 at 11:44, Mike Hoffman wrote: > I´ve just had a similar thing with an SBS 2008 box, and discovered the > Raid drives had issues. After replacing one drive the rebuild stuck at > 99.83% and after that every 6-8 hours the network cards stopped and the > system just fro

RE: New SAN - How to remove old from SQL Cluster?

So scratch my question on this – did some digging and found that the resource db is in fact in the C:\Program Files\... directory of each node. Sean Rector, MCSE From: Virginia Opera - Sean Rector [mailto:sean.rec...@vaopera.org] Sent: Friday, October 07, 2011 7:11 PM To: NT System Admin

Re: AV and malware protection?

+1 I moved from AVAST a couple of years ago when my wife got hit twice with viruses within 30 days while running AVAST. So far so good. Jon On Fri, Oct 7, 2011 at 9:34 AM, John Hornbuckle < john.hornbuc...@taylor.k12.fl.us> wrote: > I just use Microsoft Security Essentials. Seems to work well

RE: New SAN - How to remove old from SQL Cluster?

So I’ve moved the tempdb, model, & msdb databases. I was getting ready to move the master db, when I came across this note: Although it was possible to move the Resource database in SQL Server 2005, things changed in SQL Server 2008 where the location of the Resource database can no longer

Re: WiseGate

Interesting concept. Oops, there's that little matter of the $1,000 / year fee. Nevermind. On Fri, Oct 7, 2011 at 3:06 PM, Kevin Lundy wrote: > Anyone here a member of the new WiseGate peer community? > > Kevin > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~

Re: [OT] Flying killer robot persistent malware compromise

Thought it was Joshua5? On Oct 7, 2011 4:01 PM, "Ben Scott" wrote: > The computers used by the US Air Force to fly some of the Predator > and Reaper drones -- which are platforms capable of carrying weapons > -- have apparently been compromised for by keystroke-logging malware. > The best part?

Re: AV and malware protection?

The router is my firewall. For all my 'family support' I mandate Windows 7 and MS Security Essentials. I have had no virus issues in 2 years on any of the 'family systems'. On Fri, Oct 7, 2011 at 6:31 AM, Eric Brouwer wrote: > If you had to secure your own personal computer at home (Windows

RE: AV and malware protection?

Doesn't your Vipre come with firewall? Originally, I used Kerio's f/w because it was good and free and Avast for a\v. Then, Sunbelt bought it, renamed it Vipre but I still kept it as it worked and the cost was low. Earlier, this year, though GFI (or Sunbelt, can't remember when they took ove

Re: [OT] Flying killer robot persistent malware compromise

Now that's not comforting. At all. On Fri, Oct 7, 2011 at 1:01 PM, Ben Scott wrote: > The computers used by the US Air Force to fly some of the Predator > and Reaper drones -- which are platforms capable of carrying weapons > -- have apparently been compromised for by keystroke-logging malwa

RE: Script Help Please? Runs for a few weeks, then stops

I think that is the route I might go. Was actually just looking at this as well: http://www.watchdirectory.net/wdhelp/help/wdcc_email.html Thanks for your input. -Sam From: Joseph L. Casale [mailto:jcas...@activenetwerx.com] Sent: Friday, October 07, 2011 2:56 PM To: NT System Admin Issu

Re: [OT] Flying killer robot persistent malware compromise

LOL -- Espi On Fri, Oct 7, 2011 at 1:05 PM, G.Waleed Kavalec wrote: > Let me be the first to welcome our new software overlords. > > > On Fri, Oct 7, 2011 at 3:01 PM, Ben Scott wrote: > >> The computers used by the US Air Force to fly some of the Predator >> and Reaper drones -- which are

Re: [OT] Flying killer robot persistent malware compromise

Let me be the first to welcome our new software overlords. On Fri, Oct 7, 2011 at 3:01 PM, Ben Scott wrote: > The computers used by the US Air Force to fly some of the Predator > and Reaper drones -- which are platforms capable of carrying weapons > -- have apparently been compromised for by k

[OT] Flying killer robot persistent malware compromise

The computers used by the US Air Force to fly some of the Predator and Reaper drones -- which are platforms capable of carrying weapons -- have apparently been compromised for by keystroke-logging malware. The best part? They detected it a few weeks ago and they're still flying them. http://www

RE: Script Help Please? Runs for a few weeks, then stops

You may also have a glance for the future at http://fwutilities.sourceforge.net/. I used this a few times, and its stable, never missed a beat and very configurable... Given it uses Windows services, you can let built in facilities to recover it, but it wont

Re: AV and malware protection?

95.64.61.141-142 -- Espi On Fri, Oct 7, 2011 at 11:53 AM, Crawford, Scott wrote: > I’d be interested in checking it out if you’ve got the ip handy. > > ** ** > > *From:* Micheal Espinola Jr [mailto:michealespin...@gmail.com] > *Sent:* Friday, October 07, 2011 1:49 PM > > *To:* NT System

RE: AV and malware protection?

"Using a limited account probably helps loads too" This also. I run a user account (no admin rights). Same thing for the office. Nobody uses admin accounts. All user accounts. If we have to do admin stuff, then we will run as or log on as an administrator. Eliminates 95% of our problems! F

Re: AV and malware protection?

I agree completely. However, Malwarebytes (running in real-time) IP bocking mechanisms would likely have prevented the additional installation of virus payload beyond the drive-by exploit. -- Espi On Fri, Oct 7, 2011 at 11:50 AM, Mike Gill wrote: > I have seen exploits on systems with just

RE: AV and malware protection?

What I use... Nod32 Juniper Netscreen 5 Malwarebytes -Original Message- From: Eric Brouwer [mailto:ithelp.e...@gmail.com] Sent: Friday, October 07, 2011 6:31 AM To: NT System Admin Issues Subject: AV and malware protection? If you had to secure your own personal computer at home (Window

WiseGate

Anyone here a member of the new WiseGate peer community? Kevin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an

RE: AV and malware protection?

I'd be interested in checking it out if you've got the ip handy. From: Micheal Espinola Jr [mailto:michealespin...@gmail.com] Sent: Friday, October 07, 2011 1:49 PM To: NT System Admin Issues Subject: Re: AV and malware protection? No specific sites... well, actually I /can/ get the IP of one of

RE: AV and malware protection?

I have seen exploits on systems with just about every (fully updated) AV product heard of. There is no product that will win every time playing this cat and mouse game. I run MSE on my personal systems. Vipre and Nod32 on client computers. I encourage users not to use IE. -- Mike From: Mic

Re: AV and malware protection?

No specific sites... well, actually I /can/ get the IP of one of the sites. The drive-by added bogus google and bing entries to the hosts file in an effort to have another vector on system [re]infection. Malwarebytes promptly blocks access to the Romainian IP in question. Not admin, not aware o

RE: Script Help Please? Runs for a few weeks, then stops

http://support.microsoft.com/kb/981314 There is also a patch for this in Windows 2003, but I didn't look it up. This should get you pointed in the right direction. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: Sam Cayze [mailto:sca...@gmail.com] Se

RE: AV and malware protection?

That surprises me, because honestly I've heard that MSE is a pretty solid product. From: Micheal Espinola Jr [mailto:michealespin...@gmail.com] Sent: Friday, October 07, 2011 2:26 PM To: NT System Admin Issues Subject: Re: AV and malware protection? Yep, the current version. From what I have

RE: AV and malware protection?

Do you have any examples of sites that exploit this? Are other factors at play? Browsing with admin credentials or unpatched vulnerabilities? From: Micheal Espinola Jr [mailto:michealespin...@gmail.com] Sent: Friday, October 07, 2011 1:26 PM To: NT System Admin Issues Subject: Re: AV and malware

Re: AV and malware protection?

Yep, the current version. From what I have seen done to it by web-based exploit infections, I would classify the product as "a joke". I thought it was decent before, but I currently have no faith in it. This being part of the scenario of users, using IE, getting hit with drive-by's, those drive-

RE: AV and malware protection?

The current version of MSE? I think it's on v2.0 now. Of course, there's no substitute for careful behavior, as others have mentioned. I'm extremely cautious, and honestly can't recall a single time that my antimalware (MSE or the stuff I used before that) software has protected from a threat o

Re: AV and malware protection?

I would trust Malwarebytes over a traditional a product. I wouldnt trust MSE what-so-ever. I've seen web-based drive by exploits absolutely destroy it. If I was going to couple with an AV product, I'd use Kaspersky primarily, with ESET as a secondary choice. -- Espi On Fri, Oct 7, 2011 at

RE: GFI Backup - Network Ed.

That looks expensive unless I'm misinterpreting the numbers. Have you looked at HP Data Protector? I've not used it but it always looks like remarkably good value for doing basic backups. From: Bob Hartung [bhart...@wiscoind.com] Sent: 07 October 2011 5:48 PM To:

RE: AV and malware protection?

http://www.virusbtn.com/vb100/rap-index.xml Best free software in that chart - Avira Free. For paid, I'd go with Kaspersky Pure or Avira Pro. Based on the chart position of MSSE, I don't think I'd rely on it. At least ForeFront does better, which is odd b/c doesn't it use the same detection-engi

RE: Torpig/Anserin/Mebroot infection

I'd suggest it's something you should look into. Ignoring that it's something interesting to look into/learn about, in this day and age my personal opinion is that in a business environment (or any environment where you have this type of issue), you need a really good reason not to be doing som

RE: GFI Backup - Network Ed.

Potentially backing up 10 servers and 120 PCs. I'd be backing up to a Drobo Elite shared out through Windows 2003 server. -- Bob Hartung Dir of I.T. Wisco Industries, Inc. 736 Janesville St. Oregon, WI 53575 Tel: (608) 835-3106 x215 Fax: (608) 835-7399 e-mail: bhartung(at)wis

RE: New SAN - How to remove old from SQL Cluster?

If the old disks have the SQL service master, model, temp db’s Gah! That’s the problem. I’m looking at several docs now for how to move the system/master databases. Gonna be a busy weekend. Sean Rector, MCSE From: Ziots, Edward [mailto:ezi...@lifespan.org] Sent: Friday, Octobe

RE: GFI Backup - Network Ed.

How many machines and what are you backing up from/to? From: Bob Hartung [bhart...@wiscoind.com] Sent: 07 October 2011 5:01 PM To: NT System Admin Issues Subject: GFI Backup - Network Ed. Our annual renewal for backup software is coming up (Arcserve for servers and

RE: Torpig/Anserin/Mebroot infection

Not really. I don't do much with the firewall as I don't know much about Cisco. I rely on an outside consultant/vendor to handle any changes necessary for us. John-AldrichThread-Count From: Paul Hutchings [mailto:paul.hutchi...@mira.co.uk] Sent: Friday, October 07, 2011 12:34 PM To: NT Sys

RE: Torpig/Anserin/Mebroot infection

John, do you do any sort of DNS or URL filtering at your firewall to control/restrict outbound traffic? From: John Aldrich [jaldr...@blueridgecarpet.com] Sent: 07 October 2011 4:02 PM To: NT System Admin Issues Subject: RE: Torpig/Anserin/Mebroot infection Well, I

GFI Backup - Network Ed.

Our annual renewal for backup software is coming up (Arcserve for servers and Acronis for PCs) so I decided to look around a bit at what else is out there. I stumbled on GFI Backup and it appears to do everything I need at a relatively low price for both initial purchase and ongoing maintenance.

Re: Torpig/Anserin/Mebroot infection

Did it update the definition files completely? On Fri, Oct 7, 2011 at 11:55 AM, John Aldrich wrote: > Installed a copy of MBAM on one of the PCs which would not work with the > “live” CD and it’s now scanning. > > ** ** > > [image: John-Aldrich][image: Thread-Count] > > ** ** > > *From:*

RE: Torpig/Anserin/Mebroot infection

Installed a copy of MBAM on one of the PCs which would not work with the "live" CD and it's now scanning. John-AldrichThread-Count From: Cynicalgeek [mailto:cynicalg...@gmail.com] Sent: Friday, October 07, 2011 11:23 AM To: NT System Admin Issues Subject: Re: Torpig/Anserin/Mebroot infecti

RE: DHCP Not Scavenging PTR Records

Thank you, Guido! From: HELP_PC [mailto:g...@enter.it] Sent: Friday, October 07, 2011 7:57 AM To: NT System Admin Issues Subject: R: DHCP Not Scavenging PTR Records Also have a look to this: http://blogs.technet.com/b/networking/archive/2008/03/19/don-t-be-afraid-of-dns-scavenging-just

RE: Torpig/Anserin/Mebroot infection

Working on *installing* it on one of those computers. John-AldrichThread-Count From: Cynicalgeek [mailto:cynicalg...@gmail.com] Sent: Friday, October 07, 2011 11:23 AM To: NT System Admin Issues Subject: Re: Torpig/Anserin/Mebroot infection Yes. On Fri, Oct 7, 2011 at 11:21 AM, John A

RE: Torpig/Anserin/Mebroot infection

Yeah. these are older computers. thought maybe it was the speed of the computer. *shrug* As I said, I'm not seeing any hits on the firewall for that IP range, so maybe I got it already. John-AldrichThread-Count From: Erik Goldoff [mailto:egold...@gmail.com] Sent: Friday, October 07, 2011 9

Re: Torpig/Anserin/Mebroot infection

Yes. On Fri, Oct 7, 2011 at 11:21 AM, John Aldrich wrote: > I’m assuming you mean one of the computers that was unable to use the CD?* > *** > > ** ** > > [image: John-Aldrich][image: Thread-Count] > > ** ** > > *From:* Cynicalgeek [mailto:cynicalg...@gmail.com] > *Sent:* Friday, October 07,

RE: Torpig/Anserin/Mebroot infection

I'm assuming you mean one of the computers that was unable to use the CD? John-AldrichThread-Count From: Cynicalgeek [mailto:cynicalg...@gmail.com] Sent: Friday, October 07, 2011 11:12 AM To: NT System Admin Issues Subject: Re: Torpig/Anserin/Mebroot infection Try to boot normally and

Resource

This may be of interest: http://www.dhs.gov/files/programs/editorial_0542.shtm There is an IT section with breaking news. Depending on your industry, you may find other sections w/ merit. Shauna Hensala ~ Finally, powerful endpoint security that

Re: Torpig/Anserin/Mebroot infection

Try to boot normally and update Malwarebytes now. On Fri, Oct 7, 2011 at 11:02 AM, John Aldrich wrote: > Well, I was using the bootable CD, so any infection on the computer should > not affect the machine in question. I’m guessing it’s just old hardware that > isn’t up to the job. I might take a

RE: Torpig/Anserin/Mebroot infection

Well, I was using the bootable CD, so any infection on the computer should not affect the machine in question. I'm guessing it's just old hardware that isn't up to the job. I might take a USB cd up to a couple of 'em, but honestly I'm not really worried about it on those machines. We have that IP r

R: DHCP Not Scavenging PTR Records

Also have a look to this: http://blogs.technet.com/b/networking/archive/2008/03/19/don-t-be-afraid-of-dns-scavenging-just-be-patient.aspx Guido Elia HELPPC Da: Phil Hershey [mailto:phers...@agia.com] Inviato: venerdì 7 ottobre 2011 16.45 A: NT System Admin Issues

R: DHCP Not Scavenging PTR Records

Shouldn't be done by DNS servers? Guido Elia HELPPC Da: Phil Hershey [mailto:phers...@agia.com] Inviato: venerdì 7 ottobre 2011 16.45 A: NT System Admin Issues Oggetto: DHCP Not Scavenging PTR Records Seemingly odd problem here. Just discovered that our DHCP serv

RE: AV and malware protection?

Microsoft Security Essentials, ZoneAlarm, MalwareBytes. UpdateChecker runs at startup and I check Secunia probably once a week. Shauna Hensala > Date: Fri, 7 Oct 2011 09:31:28 -0400 > Subject: AV and malware protection? > From: ithelp.e...@gmail.com > To: ntsysadmin@lyris.sunbelt-software

Re: RE: Something hilarious to start your weeks off.

Well, considering Uranus is a god of myth and legend... I hope someone runs with that. On Fri, Oct 7, 2011 at 9:35 AM, G.Waleed Kavalec wrote: > They working on it Rene. > > They've already declared Pluto a non-planet, but that was just a ruse - > Uranus is their real target. > > > On Wed, Oct

Re: AV and malware protection?

Microsoft Security Essentials. On Fri, Oct 7, 2011 at 9:31 AM, Eric Brouwer wrote: > If you had to secure your own personal computer at home (Windows 7), > what AV, firewall, malware protection would you install? > > Thanks! > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~

Re: AV and malware protection?

Vipre, home network version. $50, covers all the computers in the house. Windows Firewall, behind a DD-WRT firewall. DNS is OpenDNS. On Fri, Oct 7, 2011 at 9:31 AM, Eric Brouwer wrote: > If you had to secure your own personal computer at home (Windows 7), > what AV, firewall, malware protec

Re: Torpig/Anserin/Mebroot infection

Did it successfully install the software and NOT allow you to update the definition files? This is a good sign of an infected computer. On Thu, Oct 6, 2011 at 6:31 PM, John Aldrich wrote: > What do you do if the machine won’t run it? I have two machines that both > think the CD I just made is l

Re: AV and malware protection?

On Fri, Oct 7, 2011 at 9:31 AM, Eric Brouwer wrote: > If you had to secure your own personal computer at home (Windows 7), > what AV, firewall, malware protection would you install? I run Linux at home. ;-) But I do have a Wintendo box running XP. I use the built-in firewall on the PC itse

Re: AV and malware protection?

I used Avast in the past, but seems to have gotten bloated and resource-y. Now I use MS security essentials and have been fine with it. Bill Eric Brouwer wrote: If you had to secure your own personal computer at home (Windows 7), what AV, firewall, malware protection would you install? Thank

Re: Torpig/Anserin/Mebroot infection

bad disc clamp in CD ROM drive, preventing proper rotational speed to read the disk ??? (guessing the machines that won't read are NOT brand new) On Fri, Oct 7, 2011 at 9:13 AM, Roger Wright wrote: > Hmmm... Not sure what would cause this. I've only booted from it one time > and didn't have a p

Re: RE: Something hilarious to start your weeks off.

They working on it Rene. They've already declared Pluto a non-planet, but that was just a ruse - Uranus is their real target. On Wed, Oct 5, 2011 at 11:46 PM, Rene de Haas wrote: > And somehow nobody thought it strange/funny to name a planet Uranus and > they left it that way.. > Op 3 okt. 20

Re: AV and malware protection?

For my Windows 7 Pro machines at home I use VIPRE Premium behind a Netgear N600 router. I'm very satisfied with VIPRE's level of protection. Roger Wright ___ My short term goal is to make it through the day. My long term goal is to string a bunch of short term goals together. On Fri, Oct 7

Re: AV and malware protection?

I use Avast at home backed up with MalwareBytes, and browse the Internet using Firefox with WOT and NoScript, finally there's Secunia PSI to keep all my software up-to-date Using a limited account probably helps loads too On 7 October 2011 14:31, Eric Brouwer wrote: > If you had to secure your

RE: AV and malware protection?

I just use Microsoft Security Essentials. Seems to work well enough for me. Or am I naïve? John Hornbuckle, MSMIS, PMP MIS Department Taylor County School District www.taylor.k12.fl.us -Original Message- From: Eric Brouwer [mailto:ithelp.e...@gmail.com] Sent: Friday, October 07, 201

AV and malware protection?

If you had to secure your own personal computer at home (Windows 7), what AV, firewall, malware protection would you install? Thanks! ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ ~ --- To manage subscriptions cl

Re: Torpig/Anserin/Mebroot infection

Another option: http://support.kaspersky.com/viruses/rescuedisk?level=2 Roger Wright ___ My short term goal is to make it through the day. My long term goal is to string a bunch of short term goals together. On Thu, Oct 6, 2011 at 6:31 PM, John Aldrich wrote: > What do you do if the machin

Re: Torpig/Anserin/Mebroot infection

Hmmm... Not sure what would cause this. I've only booted from it one time and didn't have a problem. Roger Wright ___ My short term goal is to make it through the day. My long term goal is to string a bunch of short term goals together. On Thu, Oct 6, 2011 at 6:31 PM, John Aldrich wrote:

RE: strange hosted app issue

Yeah Ngrep and Wireshakr Pcap files, you can basically dig a lot out of network traffic and be on your way to figuring out what this POS app is doing to you. Z Edward E. Ziots CISSP, Network +, Security + Security Engineer Lifespan Organization Email:ezi...@lifespan.org Cell:401-639-3505

RE: New SAN - How to remove old from SQL Cluster?

I am thinking from the Windows 2003 Cluster side of it ( I haven’t done anything with Windows 2008 clustered) that you must add the new disks as as dependent resources of the SQL Service, before you remove the old ones) (Along with both nodes needing to know its cluster aware) and then you need

RE: New SAN - How to remove old from SQL Cluster?

Sorry – I’ll clarify. Server 2008 R2 Cluster New SAN – Disk Resources are online with Cluster – Data has been migrated. (New Disk Resources have different Drive Letters) SQL Server has been updated for creation of new DBs on new SAN (Data & Log file storage) In Cluster Manager, Dependencie

R: Slightly OT: Weird loss of "Run as admin" functionality

In any case you may press the shift key and run as other user Inizio: kz2...@googlemail.com [kz2...@googlemail.com] Inviato: venerdì 7 ottobre 2011 9.36 Fine: NT System Admin Issues Oggetto: Re: Slightly OT: Weird loss of "Run as admin" functionality The OU ha

Re: Slightly OT: Weird loss of "Run as admin" functionality

The OU had inheritance blocked, so I figured another GPO was out of the equation. Definitely strange, I will troubleshoot further if I can get the time. Sent from my POS BlackBerry wireless device, which may wipe itself at any moment -Original Message- From: Jon Harris Date: Thu, 6 Oc