Re: suspicious firewall rules in WinXP firewall

[Bob Madore <bob () dexis net>]

Pardon me for butting in, but this appears to be getting out of control.

First, I noticed and experienced the exact same problem with a Norton 
firewall and network security package.

There really is nothing you can do, except uninstall the firewall 
completely, restart the computers and see if they can connect using dns.

If not, then download and install a NEW browser like Avant, or DeepNet, 
or Netscape, or Opera and then try to connect to the internet.

I have found that some times this is the only way to correct this problem.

The first problem of course is the firewall or internet security suite 
--- remove that and all should be OK again.

I have run into these problems with customer machines and there is no 
easy fix and yet there is no root kit either.

A spyware and virus have the ability to perform this same problem.

Perhaps Hijackthis may be of some help to remove some of the bad 
applications that have hooked themselves in so deep, that sometime the 
only way out is a full CLEAN install of everything.

I hope this helps, as this has happened to me many times.

Bob





kent crispin wrote:
> It appears that perhaps the resolver software/configuration has been altered
> so that dns queries will go to alternate root servers.  I would be very
> curious to know what addresses dns queries are actually trying to hit... 
>
> On Fri, Jun 30, 2006 at 08:32:09PM -0000, belka () att net wrote:
>   
> > While setting a port for Symantec to query XP Pro workstations for virus
> >     
> updates, I noticed two machines that had firewall rules (exceptions in WinXP
> firewall parlance) that were in unreadable charcaters, such as an asian font
> set that couldn't be displayed.  The rule name was in blocks or in other
> unreadable characters.  The user of these two workstations is notorious for
> downloading asian TV shows over bit torrent, and visiting anime and other
> asian sites. 
>   
> > I deleted the two firewall rules (DOH! I should have just disabled them)
> >     
> and now IE and Mozilla browsers do not work at all.  I can ping out of these
> two machines, and as long as I use an IP address, these machines can ping
> anywhere in the Internet.  However, if any call to DNS is requires, either
> with a browser or ICMP, it fails. 
>   
> > Has anyone had a similar experience or seen this kind of behavior.  My fear
> >     
> is that one of the "special Korean download programs" that this user admits
> installing has altered the browser or -- even worse - the XP TCP/IP stack
> with hooks into a trojan or spyware product.  I tried disabling the firewall
> to allow all traffic in and out, but to no effect.  No DNS functionality.  My
> packet traces are inconclusive and my IDS is not alerting on anything in or
> out of these two work stations. 
>   
> > Any ideas? At this point I know I am going to have to reload, but from a
> >     
> forensic stand point, I am curious if any one else has seen this kind of
> beavior before. 
>   
> > Thanks.
> >     
>
>   


------------------------------------------------------------------------------
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas. 
World renowned security experts reveal tomorrow's threats today. Free of 
vendor pitches, the Briefings are designed to be pragmatic regardless of your 
security environment. Featuring 36 hands-on training courses and 10 conference 
tracks, networking opportunities with over 2,500 delegates from 40+ nations. 

http://www.blackhat.com
------------------------------------------------------------------------------