Virus protection question...

Soldato
Joined
9 Dec 2006
Posts
9,246
Location
@ManCave
If a server is fully patched and presents shares to an infected client, will the shared drive get infected?

Thanks
thats not really a question?

which infection?
which OS?
which share?
if a server is patched with what?
OS/Virus protection?

the answer to your question maybe.

if the client is infected with a worm, then he saves a file on the share & the server does not have active protection enabled scanning every connection then yes
if a worm bypasses protection then yes
if the virus is already in a list somewhere - then possibly no.

to many questions to broad a question :p
 
Soldato
Joined
2 Dec 2005
Posts
5,515
Location
Herts
Possibly. ;)

The most likely (and topical) danger in that case, assuming the share is writeable, is ransomware. If the client invokes any ransomware it will usually instruct the server to encrypt whatever it can get its hands on.

Anything more sophisticated and smogsy's point applies. The network share itself doesn't really make much difference, you have to consider the entire attack surface (of which the network share is just one factor).

Tldr: there's no such thing as 'infected' - the way viruses, worms, etc. operate is much more complicated!
 
Associate
OP
Joined
18 Dec 2010
Posts
597
thats not really a question?

which infection? the Ransomware going around
which OS? Windows Server 2008 R2
which share? file servers users have access to.
if a server is patched with what? with the latest Microsoft patch
OS/Virus protection? Macafee Enterprise

:p
 
Associate
OP
Joined
18 Dec 2010
Posts
597
Possibly. ;)

The most likely (and topical) danger in that case, assuming the share is writeable, is ransomware. If the client invokes any ransomware it will usually instruct the server to encrypt whatever it can get its hands on.

Anything more sophisticated and smogsy's point applies. The network share itself doesn't really make much difference, you have to consider the entire attack surface (of which the network share is just one factor).

Tldr: there's no such thing as 'infected' - the way viruses, worms, etc. operate is much more complicated!

If the client invokes any ransomware on the file server which is patched for that specific ransomware, will it fail and just infect the client machine only and machines that are not patched?

Thanks
 
Soldato
Joined
9 Dec 2006
Posts
9,246
Location
@ManCave
which infection? the Ransomware going around
which OS? Windows Server 2008 R2
which share? file servers users have access to.
if a server is patched with what? with the latest Microsoft patch
OS/Virus protection? Macafee Enterprise

wanncry is patched so is petra, so No, but all users accessing the share could.

on side note mcaffe enterprise is pretty pants :p

ESET/Bitdefender AVAST all give monthly updates via email telling you if your Protected & what steps to take.

maybe try it out or add yourself to the mailing list :)
 
Last edited:
Man of Honour
Joined
13 Oct 2006
Posts
91,159
Complex one - just by having write access to a shared folder on another machine doesn't mean that any malicious files written to that folder will have any effect on the host machine. However someone could accidentally subsequently execute them on the host and/or there have been flaws in things like Windows defender in the past where it might result in the host becoming infected if it scans those files.

Always possible that some malware will find a way to infect systems it is networked with via other means as well.
 
Back
Top Bottom