Security Incidents mailing list archives
Re: suspicious firewall rules in WinXP firewall
From: Bob Madore <bob () dexis net>
Date: Mon, 03 Jul 2006 15:16:23 -0700
Pardon me for butting in, but this appears to be getting out of control.First, I noticed and experienced the exact same problem with a Norton firewall and network security package.
There really is nothing you can do, except uninstall the firewall completely, restart the computers and see if they can connect using dns.
If not, then download and install a NEW browser like Avant, or DeepNet, or Netscape, or Opera and then try to connect to the internet.
I have found that some times this is the only way to correct this problem.The first problem of course is the firewall or internet security suite --- remove that and all should be OK again.
I have run into these problems with customer machines and there is no easy fix and yet there is no root kit either.
A spyware and virus have the ability to perform this same problem.Perhaps Hijackthis may be of some help to remove some of the bad applications that have hooked themselves in so deep, that sometime the only way out is a full CLEAN install of everything.
I hope this helps, as this has happened to me many times. Bob kent crispin wrote:
It appears that perhaps the resolver software/configuration has been altered so that dns queries will go to alternate root servers. I would be verycurious to know what addresses dns queries are actually trying to hit...On Fri, Jun 30, 2006 at 08:32:09PM -0000, belka () att net wrote:While setting a port for Symantec to query XP Pro workstations for virusupdates, I noticed two machines that had firewall rules (exceptions in WinXP firewall parlance) that were in unreadable charcaters, such as an asian font set that couldn't be displayed. The rule name was in blocks or in other unreadable characters. The user of these two workstations is notorious for downloading asian TV shows over bit torrent, and visiting anime and otherasian sites.I deleted the two firewall rules (DOH! I should have just disabled them)and now IE and Mozilla browsers do not work at all. I can ping out of these two machines, and as long as I use an IP address, these machines can ping anywhere in the Internet. However, if any call to DNS is requires, eitherwith a browser or ICMP, it fails.Has anyone had a similar experience or seen this kind of behavior. My fearis that one of the "special Korean download programs" that this user admits installing has altered the browser or -- even worse - the XP TCP/IP stack with hooks into a trojan or spyware product. I tried disabling the firewall to allow all traffic in and out, but to no effect. No DNS functionality. My packet traces are inconclusive and my IDS is not alerting on anything in orout of these two work stations.Any ideas? At this point I know I am going to have to reload, but from aforensic stand point, I am curious if any one else has seen this kind ofbeavior before.Thanks.
------------------------------------------------------------------------------ This List Sponsored by: Black HatAttend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas. World renowned security experts reveal tomorrow's threats today. Free of vendor pitches, the Briefings are designed to be pragmatic regardless of your security environment. Featuring 36 hands-on training courses and 10 conference tracks, networking opportunities with over 2,500 delegates from 40+ nations.
http://www.blackhat.com ------------------------------------------------------------------------------
Current thread:
- suspicious firewall rules in WinXP firewall belka (Jul 03)
- Re: suspicious firewall rules in WinXP firewall killy (Jul 03)
- Re: suspicious firewall rules in WinXP firewall Harry Hoffman (Jul 03)
- RE: suspicious firewall rules in WinXP firewall David Gillett (Jul 03)
- Re: suspicious firewall rules in WinXP firewall kent crispin (Jul 03)
- Re: suspicious firewall rules in WinXP firewall Bob Madore (Jul 03)
- Re: suspicious firewall rules in WinXP firewall Valdis . Kletnieks (Jul 04)
- Re: suspicious firewall rules in WinXP firewall Thor (Hammer of God) (Jul 04)
- Re: suspicious firewall rules in WinXP firewall Bob Madore (Jul 03)
- Re: suspicious firewall rules in WinXP firewall Jamie Riden (Jul 03)
- <Possible follow-ups>
- RE: suspicious firewall rules in WinXP firewall Darren Clarke (Jul 03)
- Re: suspicious firewall rules in WinXP firewall jimm22222 (Jul 03)
- Re: Re: suspicious firewall rules in WinXP firewall shenba_rake (Jul 04)