Comments on: Fixes for files infected with Win32/virut.Virtob and Variants http://42.kaizeku.com/windows/fixed-for-files-infected-with-virutnat-mefir/ web development, software, windows tips and trick Wed, 07 Jan 2009 22:27:00 +0000 http://wordpress.org/?v=2.6 By: zyro http://42.kaizeku.com/windows/fixed-for-files-infected-with-virutnat-mefir/#comment-6477 zyro Tue, 06 May 2008 23:19:26 +0000 http://blog.kakkoi.net/ranting/fixed-for-files-infected-with-virutnat-mefir/#comment-6477 hi there can u please email me these files I just wanna use them for learning purpose THANKS BUDDY hi there
can u please email me these files I just wanna use them for learning purpose

THANKS BUDDY

]]> By: Bernd P http://42.kaizeku.com/windows/fixed-for-files-infected-with-virutnat-mefir/#comment-876 Bernd P Tue, 05 Feb 2008 11:43:30 +0000 http://blog.kakkoi.net/ranting/fixed-for-files-infected-with-virutnat-mefir/#comment-876 The problem in prevention of viruses like the <strong>Virut</strong> types is that they change the "bothosts" as well as the as the encryption with every new variant coming out. A possible good solution to prevent your machine from making unauthorized unwanted connects by any unknown process or program is to have e.g. a <a class="exturl icn-r" href="http://en.wikipedia.org/wiki/ZoneAlarm" rel="nofollow">ZoneAlarm</a> firewall installed (which allows precisely blocking of e.g. STMP for specified programs - the default is 'blocked' - , specified port blocking (e.g. <abbr title="Internet Relay Chat">IRC</abbr>), preventing and denying any unsolicited inbound traffic, as well as the adaptive <abbr title="The Ident Protocol is an Internet protocol that helps identify the user of a particular TCP connection">IDENT</abbr> port hiding,(means this is a true stealth firewall).and specified security behavior concerning internet, intranet, local, safe zones, as well as a 5-step safety profile to set for specified programs). <p>Additionally the user is informed about every network action and access attempts - ingoing as well outgoing - with source, target, port and the program or process name which initiates the connection. Preventing spam-bot behavior means : only allow 'your' known Mail programs to send mails. NEVER store ANY PASSWORDS on the machine or in the mail program! Set '<abbr title="Simple Mail Transfer Protocol">SMTP</abbr> action' to 'password required' even if your SMTP provider doesn't need (if so this means anonymous SMTP is allowed, then you have a BAD ISP which is really inviting spambots to spread their notorious garbage all around the world!). </p> <p>Essential Safety-rules are still ignored by the <abbr title="Internet service provider">ISP</abbr> in such cases. By the same way, the customers of such ISP are the victims of these. Go looking for another ISP if possible. All other programs should be blocked for SMTP (and IRC) protocols as well. That is essential in those days to keep an infected machine quiet towards the internet even if it is eventually infected by some weird worm, or botclient software. (Then your PC is called 'stoned' or how it is also said by the security people, a so-called 'Zombie'). Never allow HTTP or any other outgoing requests for other programs aside of your known browser, media-players or file transfer, mail and chat programs. Be aware that especially 'Adware','Nag-Ware' and 'Spy-ware'-charged programs are always trying to 'phone home'!</p> <p>Same does <a class="exturl icn-r" href="http://en.wikipedia.org/wiki/Malware" rel="nofollow">Malware</a> which attempts to reach or at least listens to their 'master hosts', (of course allow such for the safety facilities on your system to update themselves by their known code hosts). Using a host list which <a href="/windows/how-to-block-website-without-using-firewall/" rel="nofollow">redirects therein contained servers to nowhere</a> (means the localhost) is also a good hint. This file is also protected from being tampered with (unauthorized deletions or additions by any software or website scripts) by third party software (ie ZoneAlarm, McAffee, Nod32).</p> The problem in prevention of viruses like the Virut types is that they change the “bothosts” as well as the as the encryption with every new variant coming out. A possible good solution to prevent your machine from making unauthorized unwanted connects by any unknown process or program is to have e.g. a ZoneAlarm firewall installed (which allows precisely blocking of e.g. STMP for specified programs - the default is ‘blocked’ - , specified port blocking (e.g. IRC), preventing and denying any unsolicited inbound traffic, as well as the adaptive IDENT port hiding,(means this is a true stealth firewall).and specified security behavior concerning internet, intranet, local, safe zones, as well as a 5-step safety profile to set for specified programs).

Additionally the user is informed about every network action and access attempts - ingoing as well outgoing - with source,
target, port and the program or process name which initiates the connection. Preventing spam-bot behavior means : only allow ‘your’ known Mail programs to send mails. NEVER store ANY PASSWORDS on the machine or in the mail program! Set ‘SMTP action’ to ‘password required’ even if your SMTP provider doesn’t need (if so this means anonymous SMTP is allowed, then you
have a BAD ISP which is really inviting spambots to spread their notorious garbage all around the world!).

Essential Safety-rules are still ignored by the ISP in such cases. By the same way, the customers of such ISP are the victims of these. Go looking for another ISP if possible. All other programs should be blocked for SMTP (and IRC) protocols as well. That is essential in those days to keep an infected machine quiet towards the internet even if it is eventually infected by some weird worm, or botclient software. (Then your PC is called ’stoned’ or how it is also said by the security people, a so-called ‘Zombie’). Never allow HTTP or any other outgoing requests for other programs aside of your known browser, media-players or
file transfer, mail and chat programs. Be aware that especially ‘Adware’,'Nag-Ware’ and ‘Spy-ware’-charged programs are always trying to ‘phone home’!

Same does Malware which attempts to reach or at least listens to their ‘master hosts’, (of course allow such for the safety facilities on your system to update themselves by their known code hosts). Using a host list which redirects therein contained servers to nowhere (means the localhost) is also a good hint. This file is also protected from being tampered with (unauthorized deletions or additions by any software or website scripts) by third party software (ie ZoneAlarm, McAffee, Nod32).

]]>