McAfee SAV85E - Active VirusScan - PC Manual de usuario descargar pdf (Pagina 20)

White Paper Access Protection in McAfee VirusScan Enterprise and

Host Intrusion Prevention

The rules will trigger when a user logs on and the virus tries to run. This will also identify computers

where the virus is already installed and prevent the virus from running again.

Again, rules of this form will be effective against many new viruses when they have known ﬁlenames.

The VIL article also says that W32/Bagel.AB@MM will mail itself using SMTP, it listens on port 2535 for

instructions from its author and it downloads scripts from websites. All of this behavior can be blocked

using the following port-blocking rules:

Port: 25

Direction: Outgoing

Exclusion list: Any SMTP clients that are allowed to run

Port: 2535

Direction: Incoming

Exclusion list: None

Port: 80

Direction: Outgoing

Exclusion list: Any web browsers that are allowed to run

The ﬁrst and last of these are included by default in VSE. If they cannot be enabled all the time, enable

them for the duration of the outbreak if possible.

The last thing that the virus does is “Files are created in folders that contain the phrase ‘shar.’” There is

a long list of ﬁlenames that the virus uses so it is not practical to make a separate rule for each ﬁle. A

broader rule, which prevents any .EXE ﬁles being created in a directory that contains “shar” would

look like:

Process: *

Wildcard: **/*shar*/**/*.exe

Prevent: create

The W32/Bagel.ab@MM virus doesn’t contain a destructive payload. If we look instead at

W32/Shodi.c@MM http://vil.nai.com/vil/content/Print104469.htm, the VIL says “it delivers a destructive

payload, deleting … C:\NTDETECT.COM.”

Therefore, a rule such as:

Process: *

Wildcard: c:\ntdetect.com

Prevent: delete

will prevent this virus from rendering the computer unbootable. Since ntdetect.com is a Windows ﬁle,

preventing access to it may affect the application of Microsoft hot ﬁxes or service packs.

1 2 ... 15 16 17 18 19 20 21 22 23 24

Sin comentarios

McAfee SAV85E - Active VirusScan - PC Manual de usuario Pagina 20