To those who do not speak/read French, the screenshot proves that:

- KAV 2011 was updated the 12th of May, 10:40PM

- 2 days after that, the 14th of May, 01h40AM, Kaspersky still claims it is up to date!

- udpates are automatic, the default and recommended setting

Note the interface says "the computer is safe. Databases are up to date"...

In a world where antivirus definitions updates are provided quicker than every hour, I don't think more than 24 hours without any update could mean "computer is safe".

In a nutshell, it is not because your KAV says it does protect your antivirus at maximum that it is true...

Here is the proof of it:

After 10 minutes, KAV did start its automatic definitions update. Now, it claims to be "up to date", with a database file generated the 14th of May (ie: today!), 01:22AM!!

Update:

Now, taking that into account, a few advises:

- at the right moment the computer get internet connection, and beforce starting any network application (IM, browser, RSS reader, email client...): force Antivirus definition update.

- if your computer was in a sleep mode, or even in hibernation, then just the same: force the update at the right moment it has Internet access

- after the update process, make sure there is no need to reboot to "apply the update"

- then, your computer is preing protected the best your AV solution can

To those who do not read French like easily ;), this screens comes from a Win 7 warning telling me that I should check the editor's identity of the file kav11.0.2.556FR-INT_213_VP.exe.

The certficate provided by KLabs to digitally sign the setup of KAV 2011 has expired on March 2011, the 8th...

But the software (and the file) is still being sold on the web...

How could we explain to users theyu should check carefully the digital signatures of the files they download/install after that?

NB: the version of the installer is 11.0.2.556.

Update 1:

After a few days without turning one PC, Kaspersky (and Windows) complains because it is "obsolete". Allright.

But when you launch the update, Win 7 displays a warning, to ask you for confirmation that you trust a Kaspersky file...!

Here are the (french version of the) warning, on the right, and the certificate details, showing it has expired since the 9th of March 2011...

Here is the mail that currently spreads:

The link provided does not work itlself.

But the real link does:

http://noticias. terra.woonet.co.kr/videos/paquistao/terrorismo/osama/05/05/2011/video-proibido-mostra-momento-da-execucao-de-obama-por-agentes-na-operacao.php?0.14094

PLease note the allusion to "Obama" et "execution", even if I'm not a linguist. There is probably a mistake, or a will to associate "Obama" and "execution" (that should be "Osama's execution"...).

IE9, working with SmartScren/Windows Defender does alert and blocks the download, that's good.

BTW, Clam In the Cloud and Panda Cloud do detect the sample as well.

Then, according to VT, 24 engines (reminder: command line versions) out of 41 do detect the malware:

http://www.virustotal.com/file-scan/report.html?id=e367ad6e9f26191e59dab7a9b681d05f40b23fee120ef1757def56c4a2b84f4b-1304723523

Murlo/Delf, well, nothing that new.

And to finish with, a sandbox:

http://www.threatexpert.com/report.aspx?md5=8bef97fcdd7a160b230749b824b9cb95

Just an oldfashion Rbot packed with Pklite32... and it mostly targets Brazilian websites/assets.

In a nutshell, do not open that email nor click on the link!

Let's talk a little bit about the A: availability... and maybe also about the I: integrity...

I do my best to put in application the advices I give at work: make sure you back up your systems and data... well, I decide to use the Rescue and Recovery software than ships with my Laptop.

Alright, I was then very happy to be able to use my NAS, as a destination backup for R&R (as they all call it).

A few weeks after that, I had... a crash. :(  there begin the problems...

I did a fresh install of W7, and I was then ready to restore my backup (I thought I would just have to re-install R&R on the new W7)... well, not really :(

I have first to say that the R&R software was not said to be fully compliant with Win7... Nonetheless, Lenovo did publish it with the System Update technology, so that my laptop had it installed right away.

And shortly after the day I did my backup, there was an update of R&R software. The only thing is that new version of Rescue & Recovery does not detect my backup! Neiter of the NAS, nor on a local partition (when I had copied the whole RRbackups content, that is on my NAS).

I can't believe what I read on the forums:

http://forums.lenovo.com/t5/ThinkVantage-Technologies/Rescue-and-recovery-doesn-t-see-my-backup/td-p/207165

A new/different version of R&R is not able to restore a backup build with another version of R&R! So why do they publish automatic updates for R&R with SystemUpdate, and don't tell the users about that quite important point regarding the backups they've already created?

So, the full advise is: make sure you have backups, but also TEST them on a regular basis!

I'm gonna deal here with a few tips to monitor, and even detect, real network intrusion cases.

Just for the records, Netbios is not a protocol, it is a network interface. NetBT (Netbios over TCP) is a protocol, for instance. Nowadays, MS networks use SMB shares and protocols.

Then, let me say that the Windows culture of a firewall tends to block almost every little packet that comes from the network, but not what goes from the computer to the network! Thus, even some kindda hardened Windows network configurations will just be verbose over the network, as soon as the RJ45 cable is plugged...

And that's just what we need to detect the intrusion!

First of all: protocols that are not related to pure MS Networks (ie: SMB):

- SSDP:  Enabled by default in Vista and Win 7. Multicast.

It is being sent as HTTP over UDP, port 1900. IP 239.255.255.250.

- Bonjour (Apple): Multicast DNS

It comes from Apple system, but also from Windows OS where users installed any of the Apple software: iTunes, QuickTime, Safari, MobileMe... (the service is called "Bonjour")

It is being sent over UDP, port 5353, IP 224.0.0.251.

- WPAD (Web Proxy Audto-Discovery): DNS resolution & NetBU/NetBT (resolution) broadcast 

It comes from computers where the option like "auto detect configuration" has been validated as a proxy configuration for the browser.

- DHCP (discover): It comes from computers set to automaticaly obtain network configuration through DHC.

It uses UDP, port 68.

- IGMP: It comes from many computers running different systems, and very often Apple software.

It is being sent over UDP, port 3702, to IP 239.255.255.250.

- WS Discovery: It comes from many computers running Vista/Win7.

It is being sent to IP  224.0.0.22,   and with requests like: "V3 Membership Report / Join group 224.0.0.252 for any sources"

Then, what to watch in a regular MS network environment:

- NBNS: computers that are connected to a network, with "MS networks" compliance, will broadcast their name over UDP, and port 138.  You'll see any computer's name within your network broadcast segment 

So, if you use Wireshark, I suggest you to set a filter like:

udp.port==138

- browser (NetBT): used when a computer wants to announces itself as a "Master browser" of a network. This is certainly not normal when there are WINS servers!

So the wireshark filter becomes:

udp.port==138 || browser

- LLMNR (RFC 4795): used when no local DNS was found on the network. It tries to convert names to IP (for example, regarding a Brother printer:  LLMNR  Standard query A BRN001BA927E1C9). Also works for WPAD requests. It is send to 224.0.0.252, port 5355 UDP. Multicast UDP

So the wireshark filter becomes:

udp.port==138 || udp.port==5355 || browser

- NCSI (Network Connectivity Status Indicator): comes vith Vista and Windows Seven systems. Used to detect/check network connectivity, meaning access to one txt file over HTTP, in Microsoft's point of view.
It is bieing sent first as a DNS request: DNS  Standard query AAAA dns.msftncsi.com.

Please note it is an IPV6 one, that could help to distinguish it from others.
Then, it attempts to download http://www.msftncsi.com/ncsi.txt, so that's: 131.107.255.255  over HTTP.

Obviously, on of the best places to monitor such requets is the firewall, not your own computer...
So, if there should be no Vista/W7 machines on your LAN, the wireshark filter could be: dns.qry.name==dns.msftncsi.com

Else, it is best IMHO to watch: ip.addr==131.107.255.255

- my own experience proves that there are a few transactions that use SMB. Therefore, the filter becomes:

udp.port==138 || udp.port==5355 || browser ||  smb

In a nutshell:

udp.port==138 || udp.port==5355 || browser || smb || udp.port==68 || udp.port==5353 || udp.port==1900 || udp.port==3702

- you should now exclude your own IP from the network capture (reminder of syntax: !(ip.addr== %your_IP%) )

You could say "hey, I don't mind, I use Linux"... well, pretty wrong, since as long as your linux system wants to be compliant with a Windows network, it will broadcast almost the same traffic than Windows boxes...I do detect intrusions concerning linux and Mac systems, with the same idea!

Now, here are a few requests that you could also watch, depending on what your standard master/configuration is:

- Google Desktop:

DNS    Standard query A desktop3.google.com

- Vista/Windows 7 money converter gadget (on the desktop)

  DNS    Standard query response CNAME money.service.co1.cb3.glbdns.microsoft.com

Response type A 65.55.17.39

To finish with, for this first run, I suggest to the network admin to keep an eye on:

- WINS servers' logs: Active directory unknown domains lookups, host announcements, master browser announcements

- DNS servers logs: (Active directory) unnkown domains lookups, unknown FQDN lookups

DNS watch was already mentioned in a MISC article, I dont remember the date nor the number (detect network intrusion with DNS).

Looking for some documentation?

http://support.microsoft.com/kb/188001

http://www.wireshark.org/docs/dfref/b/browser.html

http://isc.sans.edu/port.html?port=139

http://isc.sans.edu/port.html?port=138

http://isc.sans.edu/port.html?port=137

http://isc.sans.edu/port.html?port=445

http://www.hsc.fr/ressources/presentations/srv_res_win/srv_res_win.pdf

http://support.apple.com/kb/HT2463

http://www.tcpipguide.com/free/t_DHCPLeaseAllocationProcess-2.ht

http://msdn.microsoft.com/en-us/library/bb736562%28v=vs.85%29.aspx