Comments on: Computer exposed to internet without a firewall, now what do I do?

Question: Computer exposed to internet without a firewall, now what do I do?

miasma — Tue, 06 May 2008 19:28:48 -0800

My computer has recently been exposed to the wild internet without being behind a firewall. I'm running Windows 2000 without a software firewall. What should I do now to clean my machine and make sure it hasn't been subject to an exploit?

I made the mistake of putting a gaming device in the DMZ of my router for a short while. When I came back today, the dynamically assigned IP had switched, and it was my computer that was in the DMZ. As a result, my computer has been exposed to the wild internet without a firewall. I have all the latest service packs and hotfixes installed. What else should I do to make sure that my machine hasn't been exploited?

I have Spybot S&D for spyware and AVG for virus checking.

By: cyanide

cyanide — Tue, 06 May 2008 19:43:16 -0800

Check the startup entries for anything strange (Spybot S&D will help you with that). Get one of the free rootkit detectors (Rootkit Revealer (MS), IceSword (recommended!)) and make sure it doesn't flag anything. If there's nothing in the startup entries and rootkit detectors, you're pretty safe.

Good luck!

By: vikesfan83

vikesfan83 — Tue, 06 May 2008 20:03:37 -0800

I had similar issues with my computer at home. I ended up with a ton of junk including a few trojan viruses in a matter of hours. I ending up paying for the latest version of spyware doctor software at PC Tools. I ran a complete scan twice and had no problems after that. It worked on a friends computer too! It worked so well I bought Spyware Doctor anti virus and removed Mcafee :)

By: tylermoody

tylermoody — Tue, 06 May 2008 20:48:52 -0800

The safe thing to do is backup your data and nuke the entire site from orbit*. If you won't wipe & reinstall, make sure to run rootkit detectors on all the other computers in your network if you've connect the exposed PC back into the protected zone. Remember that no badthings detector is 100%. Recent scariness (the storm worm and its ilk) change their behavior faster than your scariness sensor can follow.

*it's the only way to be sure

By: toomuchpete

toomuchpete — Tue, 06 May 2008 20:52:40 -0800

"I ended up with a ton of junk including a few trojan viruses in a matter of hours."

This sounds highly unlikely. If your OS and any server software you were running was fully patched and hotfixed, the odds that something would worm its way into your machine in a short period of time is very, very small. You're basically saying that every zero-day virus on the internet found you during the brief period you were exposed.

More likely is that those things had been on your computer for some time and you only thought to look for them after noticing you had a hole.

Run a Spybot scan (windows defender, too, if it works on win 2k) and a full system AVG scan. If they find nothing, rest easy -- you're more likely to pick up nasties browsing the internet in IE for a few hours than for them to just arbitrarily find your computer during a brief firewall slip-up.

By: davejay

davejay — Tue, 06 May 2008 21:38:54 -0800

Honestly, be it Windows or MacOS or Linux, I'd personally reinstall just to be safe.

(FreeBSD I'd give a pass to.)

By: bargainhunter

bargainhunter — Tue, 06 May 2008 21:59:20 -0800

I have had a similar problem lately and spent a couple evenings cleaning the mess. I then spent another night summarizing what i learned in a blog post. Hope it helps someone!

By: semi

semi — Wed, 07 May 2008 01:56:11 -0800

> As a result, my computer has been exposed to the wild internet without a firewall.

I don't think it would be that much of a problem, especially since you said you have all latest hotfixes installed. The odds are already very unlikely that a computer connected to the Internet alone could be infected with worms without any user interaction, even when it's assigned a public IP.

By: Jakey

Jakey — Wed, 07 May 2008 04:07:57 -0800

According to the internet storm centre, the survival time between malware probes for a non-firewalled machine is typically <1> This is not necessarily a disaster if your machine is fully patched up, but it is food for thought.

By: Jakey

Jakey — Wed, 07 May 2008 04:09:34 -0800

Oops. Borked link. Should read typically <10mins

By: toomuchpete

toomuchpete — Wed, 07 May 2008 05:38:15 -0800

The internet storm centre link is really too vague to be useful for anything but FUD. There's a huge number of worms that exploit already-patched vulnerabilities. Add to that worms that attack certain hardware/software setups (Slammer, for example). If you had some hard numbers you could run some statistics and realize that it would typically take a long, long time to get infected. Once every 10 minutes is slooooow, all things considered.

By: lyam

lyam — Fri, 09 May 2008 07:53:48 -0800

Also check out some of these freeware security apps. You may find them helpful in diagnosing any potential issues and preventing them in the future:

Techsupportalert.com's best 46 free utilities