Is the Gaobot virus blocked with a firewall?

[Brian C]

Is the Gaobot virus blocked with a firewall?

I was curious if anyone got the virus using a firewall? Since it is
not detected by some virus programs.

Brian C.

 

[Ghostrider]

Is the Gaobot virus blocked with a firewall?

I was curious if anyone got the virus using a firewall? Since it is
not detected by some virus programs.

Brian C.

A firewall is just one of the lines of defence for a computer
system. Unless one keeps the computer completely off a network
or does not accept any input from any untrusted, external source,
including floppies, cdroms, websites, etc., then it is penetrable.
But this is an improbable situation since users must e-mails, send
files as attachments, do downloads, etc.

Gaobot, according to SARC, infects computers through an IRC
channel. To have an IRC channel, there is an open port through
the firewall, or it might exploit ports 135 and 445. Does this
answer the question about it?

 

[Steve Nielsen]

A firewall is just one of the lines of defence for a computer
system. Unless one keeps the computer completely off a network
or does not accept any input from any untrusted, external source,
including floppies, cdroms, websites, etc., then it is penetrable.
But this is an improbable situation since users must e-mails, send
files as attachments, do downloads, etc.

Gaobot, according to SARC, infects computers through an IRC
channel. To have an IRC channel, there is an open port through
the firewall, or it might exploit ports 135 and 445. Does this
answer the question about it?

You're confusing how it infects with how attackers can use an IRC
channel to control an infected machine.

It infects through the DCOM RPC vulnerability using TCP port 135 and the
RPC locator vulnerability using TCP port 445. This is different than
allowing an attacker to access an infected computer through an IRC channel.

Steve

 

[Alan]

And eventually, someone might actually answer the OP's question as to
whether the Gaobot virus is blocked by using a firewall.

Alan

 

[Crusty \(-: Old B@stard :-\)]

It would depend, I think, upon the type of firewall used and how it is
configured. Lock down the open ports and nothing is getting in. Of course,
you may not get out either.

--
Regards:

Richard Urban

aka Crusty (-: Old B@stard

 

[Steve Nielsen]

If you knew how a firewall works you'd have seen the answer in what I wrote.

Yes, block TCP ports 135 and 445.

Steve

 

[Steve Nielsen]

It would depend, I think, upon the type of firewall used and how it is
configured. Lock down the open ports and nothing is getting in. Of course,
you may not get out either.

Heheh

Steve

 

[Alan]

So the answer is, "yes, a firewall will block the Gaobot virus."

Alan

 

[kurttrail]

So the answer is, "yes, a firewall will block the Gaobot virus."

Alan

". . . . if you set it up correctly."

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"

 

[Steve N.]

No, the answer is NOT "yes, a firewall will block the Gaobot virus." It
depends how the firewall is configured. A firewall blocking TCP on both
ports 135 and 445 will prevent that particular exploit. A firewall NOT
blocking TCP on both ports 135 and 445 will not.

Steve

 

[Alan]

Do not ALL firewalls -- under standard configuration and without any special
tweaking from a user -- block ports 135 and 445?

Alan

 

[Steve Nielsen]

I couldn't tell you because I haven't used all firewalls. The few I have
used require action on the part of the user to allow or deny access to
ports and choose to make a rule or not concerning that access.

Steve