Internetworkers: http://www.ibiblio.org/internetworkers/

[David Matusiak <dave AT matusiak.org>]

Tripwire has both free and pay versions.  I have not used the free
version in some time, so I do not know about how up-to-date it is.
Sophos HIPS is an "endpoint protection" product and will also cost
money.  These are very good products and designed for (relative) ease
of use.

OSSEC is advanced, yet requires a bit of effort to install &
configure.  I have installed it on Mac OS X and Unix systems, but not
Windows.  It is available for Windows, however.  First check to make
sure your system is supported:
http://www.ossec.net/main/supported-systems/

Then following the install docs should be relatively easy.
http://www.ossec.net/main/manual/manual-installation/  I believe there
are some free chapters available from the OSSEC book, in addition to
the provided documentation.

It is designed to send you alerts via email, but that would require
your system being set up to send email.  You can skip this step and
instead choose to check OSSEC integrity on a manual basis.  The
software is designed to alert when critical files are changed.

AIDE is similar to Tripwire, but is open source.  It doesn't appear to
have a port to Windows. http://www.cs.tut.fi/~rammer/aide.html

Using several of these products may be overkill, but setting up and
using OSSEC would probably be a good idea for anyone interested in
greater overall system security and integrity.  I hope this info was
helpful!

David M.


On Fri, Sep 3, 2010 at 4:25 PM, Thomas Beckett <thomas AT tbeckett.com> wrote:
> Would you please elaborate on implementing that approach, David. Especially
> the low cost methods. Thanks!
>
> TaB
>
> Sent from my iPhone
>
> On Sep 3, 2010, at 16:05, David Matusiak <dave AT matusiak.org> wrote:
>
>> Judy,
>>
>> While you still have a relatively clean system, you might want to
>> think about installing either file integrity monitoring (Tripwire,
>> AIDE) or host-based intrusion detection (OSSEC, Sophos HIDS) on your
>> machine.  (Or both!)
>>
>> Relying on antivirus to prevent a system infection is a very weak
>> approach.  Signature-based malware detection is becoming less
>> effective every hour.  You need something on there to monitor critical
>> files, prevent bad stuff from being installed, and potentially reverse
>> any damage that takes place quickly and seamlessly.
>>
>> There is cost involved (either time, money, or both), but it is
>> leagues better than having your system re-imaged every six months
>> and/or having your sensitive data exposed.  Just a thought.  Have a
>> great holiday!
>>
>> David M.
>>
>>
>> On Fri, Sep 3, 2010 at 3:54 PM, Judy Hallman <hallman AT email.unc.edu>
>> wrote:
>>>
>>>  Thank you for all your help! I took it in to the UNC IT Response Center
>>> and
>>> had it reimaged. They copied my data to a server, cleaned off the
>>> harddrive,
>>> installed basic UNC software, and put my data back. So now I'm checking
>>> things out, reinstalling other software and catching up.
>>>
>>> I guess I knew I had to do that. I just didn't want to. I thought it
>>> would
>>> take a week since classes just started, but it only took one day.
>>>
>>> Judy
>>> -----
>>> On 8/31/2010 1:40 PM, hallman wrote:
>>>>
>>>> I've been having problems with my computer and have run Symantec several
>>>> times. The last 4 complete scans all show the same result -- file
>>>> oaannf.sys, risk hacktool.rootkit, cleaned, the file was repaired
>>>> successfully -- the file is in WINDOWS\system32\drivers.
>>>>
>>>> If the file was repaired successfully, why does it show up again the
>>>> next
>>>> time I scan?
>>>>
>>>> I tried scanning with ThreatFire and it doesn't see any problems.
>>>>
>>>> What do you think? Is my machine still infected?
>>>>
>>>> My computer is a UNC Lenovo R61 running Symantec Endpoint Protection,
>>>> Version 11.0.6005.562, definitions Monday, August 30 r2.
>>>>
>>>> Judy