malware attacks puzzle

[D4\/!d]

Here's a situation that is puzzling me about malware scanning

From the training I've received here at WF I use more than one anti-malware program. On my desktop PC, after I run CCleaner, I run AVG AntiSpyware, a-squared Free2.1, and SUPERAntiSpyware Free Edition. As you know they each find things the others miss. Usually, on this PC they find nothing

Upstairs there is another desktop PC, running off the wireless router. Same PC setup - XP Pro - and same anti-malware programs. When I run the programs they might find an occasional nasty. So far so good :D

The puzzle is this. We also have a laptop, running off the wireless router. Setup again the same, expect it has XP Media Centre version. Same anti-malware programs. However, when I run the programs on the laptop they always find several nasties. Sometimes very nasty nasties (high risk) :0

The Internet surfing is mainly done from the desktops, not the laptop. Although the laptop is connected to the internet all day, same as the two desktops.

This has been going on for some weeks now. I dunno why the laptop is more susceptible to malware attacks :(

Any ideas folks...

(sorry I forgot to say NOD32 is running on all machines)

[nellie2]

What do you do on the laptop that you don't do on the desktops??

What do you use the laptop for... mainly?

[D4\/!d]

Hello nellie2, well that's the puzzle :)

The laptop is used to play my library of music - it's hooked up to my HiFi - and not used for much else. Internet surfing rarely happens, just for updates and stuff. I suppose I could turn off the wireless connection but it part of my home network. I cannot understand why the laptop gets so many hits, while the desktops - that do all the Internet work - stay clean.

[nellie2]

I take it that it is fully updated?

Do you use it to download music?

Why don't you just set it up to share the LAN and take it off the internet

[D4\/!d]

I take it that it is fully updated?

Do you use it to download music?

Why don't you just set it up to share the LAN and take it off the internet

Yep. All machines regularly updated.

Downloading music is done with the desktops, not the laptop. That's why I cannot understand why the laptop gets hit.

Um, dunno how to take off the Internet while retaining the LAN.

Thanks for trying to help, nellie2 :)

[Scarecrow Man]

http://www.mvps.org/winhelp2002/hosts.htm

Have a look here. I find this stops quite a bit of spyware programs. Even if they are already there, they can't 'phone home'.

[nellie2]

Um, dunno how to take off the Internet while retaining the LAN.

Thanks for trying to help, nellie2 :)

How is it connected to the internet?

[D4\/!d]

How is it connected to the internet?

A Netgear Router WGT624 is plugged in to the main desktop, from where the laptop (and the upstairs desktop) picks up it's wireless connection. :)

[nellie2]

If the laptop connects through the desktop then you should be able to just turn off internet connection sharing on the lap top... if it connects directly to the router... hummmm! I'm not brilliant at networking, I'll ask someone B)

[mark2]

Which version Wgt624?

I'm currently looking at the version 3 manual, content filtering chapter 4.2 you can block port 80 for the IP address that the laptop uses.

Which will effectively disconnect it from the internet I believe.

[Scarecrow Man]

Or you can specify Internet Explorer to use a 'fake' proxy server of 127.0.0.1. Make sure to specify to bypass proxy for LAN connections. This will not allow any webpage to load, but all LAN functions will work just peachy.

You can also use the Content Advisor, with a fake raitings site, and just disallow non-rated sites. Microsoft actually has a KB article on this here: http://support.microsoft.com/kb/267930. This will still allow internet trafic to go through, but website cannot be browsed. It's best to block the internet altogether by using my above fake proxy method.

[D4\/!d]

Which version Wgt624?

I'm currently looking at the version 3 manual, content filtering chapter 4.2 you can block port 80 for the IP address that the laptop uses.

Mark, yeah it is version 3.

I don't use the laptop for Internet surfing, so "disabling it " is an option to consider. Must be able to get me windows updates though. These ideas are aimed at dealing with the symptoms but I still do not understand the cause.

The question still remains: why does the laptop get hit while the two desktops behave themselves..?? :(