Unknown download activity in background - how to determine what it is?

Unknown download activity in background - how to determine what it is?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Unknown download activity in background - how to determine what it is? Doc 07-28-2007
Posted by Kerry Brown on July 28, 2007, 9:19 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> Kayman wrote:
>
>
>> and scroll down to:
>> Myth: Host-Based Firewalls Must Filter Outbound Traffic to be Safe.
>
> That article itself is baloney. It is true that any malware can
> circumvent a firewall's outbound protection but it is also true that a lot
> of malware is detected by firewall outbound monitoring. The outbound
> monitoring also alerts you when otherwise legitimate software is trying to
> call home. Perhaps you like it better when things like Media player call
> home without your knowledge, a pesky annoyance that you should be aware of
> things like that.
>
> The article states:
>
> "Speaking of host firewalls, why is there so much noise about outbound
> filtering? Think for a moment about how ordinary users would interact with
> a piece of software that bugged them every time a program on their
> computer wanted to communicate with the Internet..." What a pile of
> baloney!"
>
> Firewall have rules, it appears no one at Microsoft knows this, which
> isn't really surprising to tell you the truth. Microsoft's logic is that
> "you don't need seat belts if you have airbags". And you don't need to
> know what it is that things like Media Player doing. Baloney indeed!
>


There is no way a software firewall can guarantee it will stop outbound
traffic on the computer it is running on regardless of the OS. Software
firewalls can be useful for stopping programs communicating outbound through
normal channels. That's it, period. The fact that some firewalls notify you
about malware communicating out is a function of how poorly the malware is
programmed not the firewall. Intel motherboards can communicate though the
onboard NICs at the BIOS level with no OS present. Rootkits can easily
modify all traffic going through any NIC in the computer. Malware running in
Windows can easily corrupt traffic from legitimate programs. Malware can
even create it's own TCP/IP stack and bypass Windows (or other OS')
networking stack altogether. Virtual server software is capable of spoofing
a MAC and getting multiple IP addresses for one NIC from a DHCP server. What
makes you think malware can't do the same type of thing?

--
Kerry Brown
Microsoft MVP - Shell/User
http://www.vistahelp.ca



Posted by John John on July 28, 2007, 10:50 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Kerry Brown wrote:

>
>> Kayman wrote:
>>
>>
>>> and scroll down to:
>>> Myth: Host-Based Firewalls Must Filter Outbound Traffic to be Safe.
>>
>>
>> That article itself is baloney. It is true that any malware can
>> circumvent a firewall's outbound protection but it is also true that a
>> lot of malware is detected by firewall outbound monitoring. The
>> outbound monitoring also alerts you when otherwise legitimate software
>> is trying to call home. Perhaps you like it better when things like
>> Media player call home without your knowledge, a pesky annoyance that
>> you should be aware of things like that.
>>
>> The article states:
>>
>> "Speaking of host firewalls, why is there so much noise about outbound
>> filtering? Think for a moment about how ordinary users would interact
>> with a piece of software that bugged them every time a program on
>> their computer wanted to communicate with the Internet..." What a
>> pile of baloney!"
>>
>> Firewall have rules, it appears no one at Microsoft knows this, which
>> isn't really surprising to tell you the truth. Microsoft's logic is
>> that "you don't need seat belts if you have airbags". And you don't
>> need to know what it is that things like Media Player doing. Baloney
>> indeed!
>>
>
>
> There is no way a software firewall can guarantee it will stop outbound
> traffic on the computer it is running on regardless of the OS. Software
> firewalls can be useful for stopping programs communicating outbound
> through normal channels. That's it, period. The fact that some firewalls
> notify you about malware communicating out is a function of how poorly
> the malware is programmed not the firewall. Intel motherboards can
> communicate though the onboard NICs at the BIOS level with no OS
> present. Rootkits can easily modify all traffic going through any NIC in
> the computer. Malware running in Windows can easily corrupt traffic from
> legitimate programs. Malware can even create it's own TCP/IP stack and
> bypass Windows (or other OS') networking stack altogether. Virtual
> server software is capable of spoofing a MAC and getting multiple IP
> addresses for one NIC from a DHCP server. What makes you think malware
> can't do the same type of thing?

All that you say is true and I never said or argued otherwise. But
software firewalls that monitor outbound connections can be useful and
can help to keep some applications in check, just because the Microsoft
firewall can't do it doesn't mean that all others are not good.

John

Posted by Kayman on July 29, 2007, 12:22 am
If you were  Registered and logged in, you could reply and use other advanced thread options
>>> Firewall have rules, it appears no one at Microsoft knows this, which
>>> isn't really surprising to tell you the truth. Microsoft's logic is
>>> that "you don't need seat belts if you have airbags". And you don't
>>> need to know what it is that things like Media Player doing. Baloney
>>> indeed!
>>>
It's a pc, apply your own logic (utilise sensible apps.); So take
ownership, do some research, do not consult advertisement-driven
publications and be responsible - *you* are in charge! If you don't like pc
go for available alternatives.
>>>
>> There is no way a software firewall can guarantee it will stop outbound
>> traffic on the computer it is running on regardless of the OS. Software
>> firewalls can be useful for stopping programs communicating outbound
>> through normal channels. That's it, period. The fact that some firewalls
>> notify you about malware communicating out is a function of how poorly
>> the malware is programmed not the firewall. Intel motherboards can
>> communicate though the onboard NICs at the BIOS level with no OS present.
>> Rootkits can easily modify all traffic going through any NIC in the
>> computer. Malware running in Windows can easily corrupt traffic from
>> legitimate programs. Malware can even create it's own TCP/IP stack and
>> bypass Windows (or other OS') networking stack altogether. Virtual server
>> software is capable of spoofing a MAC and getting multiple IP addresses
>> for one NIC from a DHCP server. What makes you think malware can't do the
>> same type of thing?
>
> All that you say is true and I never said or argued otherwise. But
> software firewalls that monitor outbound connections can be useful and can
> help to keep some applications in check,
>
Outbound filtering is useless, the PFW pop-ups just give a warm feeling for
being in control but it's too late already - it's an illusion to belive
otherwise.
> just because the Microsoft firewall can't do it doesn't mean that all
> others are not good.
>
M/S firewall *can't* do (but they could) because it's recognised to be waste
of resources and time. And yes, PFW's are IMO of no value whatsoever; I
know because I operate without these apps.
John John, don't get blinded by all the marketing hype :)


Posted by John John on July 29, 2007, 8:11 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Kayman wrote:


> It's a pc, apply your own logic (utilise sensible apps.); So take
> ownership, do some research, do not consult advertisement-driven
> publications and be responsible - *you* are in charge! If you don't like
> pc go for available alternatives.

Regardless of what you might think I am no slouch at computers and I
don't use Adware! Did you know that some of the new Sysinternal
(Microsoft) utilities call home without your knowledge? Did you know
that these Sysinternal utilities do not tell you that they call home and
that they provide no inbuilt mechanism to stop this behaviour? Do you
agree that those applications, amongst others, should be calling home
without the user's knowledge? Do you agree that users should have no
easy method to detect and stop these unwanted connections? By the
contents of your posts I would say obviously not! There are many other
legitimate applications that call home for no valid reasons, when you
install these application they don't always tell you that they will be
calling home and they don't always make it easy to find that out or to
disable "call home" features. I am sure you didn't know of the
Sysinternal utilities calling home and I am sure that you are not in
charge of your computer as much as you thing that you are! But then you
don't think that users should have a way of being made aware or of
stopping those outbound connections so who cares about "being in charge"
of their computers?


> M/S firewall *can't* do (but they could) because it's recognised to be
> waste of resources and time. And yes, PFW's are IMO of no value
> whatsoever; I know because I operate without these apps.
> John John, don't get blinded by all the marketing hype :)

Marketing hype? It appears that you are the one blinded by marketing
hype! Microsoft marketing hype! The misinformation published in one of
the Microsoft articles provided by another poster makes it clear that
Microsoft and its shills are on a mission to discredit all firewalls
that monitor outbound connections and to insist that the Microsoft
firewall is somehow or other superior to all others. Quite amusing when
it's coming from an outfit that until a few years ago didn't even know
what a firewall was! As for your comments of "waste of resources" it is
laughable to say the least. It this day and age of fast processors and
large amounts of RAM this is a non issue. Also, the firewall will be
using resources just to do its basic job of keeping intruder out, the
little extra needed to monitor outbound connections is negligible.

Lets get one thing perfectly clear here, I am not claiming, nor have I
ever claimed that outbound connection monitoring was an effective method
of dealing with all sorts of malware. I am simply saying that outbound
monitoring is a useful tool that can alert you to some not so clever
malware trying to call home and that it can alert you that something
like your printer software, or Microsoft components might be trying to
access the internet for no good reason at all. But then it appears that
you think that users shouldn't know that these things are calling home.
Neither you, nor Microsoft, nor anyone else will ever convince me that
outbound connection monitoring is not a useful feature. Period!

John

Posted by Gary S. Terhune on July 29, 2007, 11:46 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Which Sysinternals apps call home?

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

> Kayman wrote:
>
>
>> It's a pc, apply your own logic (utilise sensible apps.); So take
>> ownership, do some research, do not consult advertisement-driven
>> publications and be responsible - *you* are in charge! If you don't like
>> pc go for available alternatives.
>
> Regardless of what you might think I am no slouch at computers and I don't
> use Adware! Did you know that some of the new Sysinternal (Microsoft)
> utilities call home without your knowledge? Did you know that these
> Sysinternal utilities do not tell you that they call home and that they
> provide no inbuilt mechanism to stop this behaviour? Do you agree that
> those applications, amongst others, should be calling home without the
> user's knowledge? Do you agree that users should have no easy method to
> detect and stop these unwanted connections? By the contents of your posts
> I would say obviously not! There are many other legitimate applications
> that call home for no valid reasons, when you install these application
> they don't always tell you that they will be calling home and they don't
> always make it easy to find that out or to disable "call home" features.
> I am sure you didn't know of the Sysinternal utilities calling home and I
> am sure that you are not in charge of your computer as much as you thing
> that you are! But then you don't think that users should have a way of
> being made aware or of stopping those outbound connections so who cares
> about "being in charge" of their computers?
>
>
>> M/S firewall *can't* do (but they could) because it's recognised to be
>> waste of resources and time. And yes, PFW's are IMO of no value
>> whatsoever; I know because I operate without these apps.
>> John John, don't get blinded by all the marketing hype :)
>
> Marketing hype? It appears that you are the one blinded by marketing
> hype! Microsoft marketing hype! The misinformation published in one of
> the Microsoft articles provided by another poster makes it clear that
> Microsoft and its shills are on a mission to discredit all firewalls that
> monitor outbound connections and to insist that the Microsoft firewall is
> somehow or other superior to all others. Quite amusing when it's coming
> from an outfit that until a few years ago didn't even know what a firewall
> was! As for your comments of "waste of resources" it is laughable to say
> the least. It this day and age of fast processors and large amounts of
> RAM this is a non issue. Also, the firewall will be using resources just
> to do its basic job of keeping intruder out, the little extra needed to
> monitor outbound connections is negligible.
>
> Lets get one thing perfectly clear here, I am not claiming, nor have I
> ever claimed that outbound connection monitoring was an effective method
> of dealing with all sorts of malware. I am simply saying that outbound
> monitoring is a useful tool that can alert you to some not so clever
> malware trying to call home and that it can alert you that something like
> your printer software, or Microsoft components might be trying to access
> the internet for no good reason at all. But then it appears that you
> think that users shouldn't know that these things are calling home.
> Neither you, nor Microsoft, nor anyone else will ever convince me that
> outbound connection monitoring is not a useful feature. Period!
>
> John



Similar ThreadsPosted
Re: Unknown svchost.exe DNS port 53 network activity December 20, 2006, 4:26 pm
Re: I can't download... November 14, 2008, 6:12 am
"IE Security Download" June 27, 2006, 12:21 am
Where can I get all XP patches in one download September 16, 2006, 11:57 pm
ms download sources - why so many? April 27, 2007, 12:56 am
HD activity 24/7 December 4, 2006, 7:40 pm
download.trojan problem April 15, 2006, 10:20 pm
Virus download for testing June 25, 2008, 5:37 am
aim update download last night put LNK after all my files November 11, 2005, 10:04 am
Strange Virus Activity October 18, 2007, 5:49 pm

The site map in XML format XML site map

Contact Us | Privacy Policy