Zone Labs jumps on new Windows security API, but do we need more?

TalkBack 39 of 79:

Next »

« Previous

• Thread View
• Flat View

It saved me

When I was infected by the Russian org crime trojan in the end of June (IIS/IE JS exploit). My first sign of a break in was when Notepad, and then Wmplayer wanted to send data to an IP in St Petersburg owned by "sovintel.ru". I didn't see any good that could happen from notepad surfing the web, so I didn't allow it and started investigating what was going on. It was a good thing too, because over a week later Trend Micro still didn't recognize it.

Still, I'm guessing you know much more about the technical side of this than I do:

"Once hostile code has gained root access to your system, you've already lost. Any firewall can be easily disabled or cicumvented with only a few lines of code."

Is this the case even if you aren't logged in as an admin? If this is true, this is what MS should be working on; providing hooks to ensure SW firewalls and AV can't be disabled by software without user confirmation. They should be helping the AV and firewall vendors, not running them out of business.

Posted by: enduser_z   Posted on: 08/09/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now