ZoneAlarm and Blaster

[Nomad]

Will using the latest, free ver of ZA as my firewall, will that stop the
intrusion of Blaster, and yes, I DO understand that ZA isn't an antivirus
product. I understand (in very layman terms) that this Blaster thing has
something do to with ports etc...


---
Outgoing mail is certified Virus Free by the latest AVG data file. New
viruses not yet
in the database may have slipped through, so always perform your own local
scan.

Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.510 / Virus Database: 307 - Release Date: 14/08/2003

 

[S.Heenan]

Will using the latest, free ver of ZA as my firewall, will that stop
the intrusion of Blaster, and yes, I DO understand that ZA isn't an
antivirus product. I understand (in very layman terms) that this
Blaster thing has something do to with ports etc...


---
Outgoing mail is certified Virus Free by the latest AVG data file.
New viruses not yet
in the database may have slipped through, so always perform your own
local scan.

Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.510 / Virus Database: 307 - Release Date: 14/08/2003

Yes, the freeware version of Zone Alarm, combined with the KB823980 patch
from Microsoft and an updated anti-virus scanner will keep W32Blaster.worm
at bay.

 

[FromTheRafters]

Will using the latest, free ver of ZA as my firewall, will that stop the
intrusion of Blaster, and yes, I DO understand that ZA isn't an antivirus
product. I understand (in very layman terms) that this Blaster thing has
something do to with ports etc...

At the risk of sounding like a wise-ass ~ if you have to ask
that question, then the answer is no. If the firewall program
uses stateful packet inspection, then it should, at the least,
be able to ignore the unsolicited packets. The firewall would
have to be properly configured, and this requires that you
know what you are doing, unless it properly configures itself
automatically.

It would be best to patch the vulnerability that the worm uses.

 

[Jason]

At the risk of sounding like a wise-ass ~ if you have to ask
that question, then the answer is no. If the firewall program
uses stateful packet inspection, then it should, at the least,
be able to ignore the unsolicited packets. The firewall would
have to be properly configured, and this requires that you
know what you are doing, unless it properly configures itself
automatically.

It would be best to patch the vulnerability that the worm uses.

Um, but if you block port 135 then it will, it doesnt have to use any
statefull inspection. I personaly don't favor Zone Alarm.

 

[bengalsfan]

Um, but if you block port 135 then it will, it doesnt have to use any
statefull inspection. I personaly don't favor Zone Alarm.

Which do you favor instead? I've used ZA for a month now but I am not sure
I like it yet!

 

[Jason]

....

Which do you favor instead? I've used ZA for a month now but I am not sure
I like it yet!

Well I don't actualy use a firewall myself since I am dial-up ( not that
makes you immune ). In the past I've used Norton's personal firewall, which
was free from the ISP we subscribed to. Used it on a dedicated gateway
machine for a network of 3 people on 512k DSL. It works, but had some
problems getting it to correct filter UDP transport.

I have no expert advice, but I think zone alarm can be a bit troublesome
when it asks so many questions, to which there isn't always an easy answer
for users to give.

A more "traditional" firewall however, can be useful once configured
properly with the help of people on the net perhaps. I must admit however,
that I haven't tried more recent editions of zone alarm.

The problem is, as always, having the time to mess about getting them
working, and testing them too. It's something that most people don't want
to, or shouldn't really have to do.