SW firewall or/and router?

A firewall is a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy all computer traffic between different security domains based upon a set of rules and other criteria.
A firewall is a dedicated appliance, or software
running on another computer, which inspects network traffic passing
through it, and denies or permits passage based on a set of rules.
A firewall's basic task is to regulate some of the flow of traffic between computer networks of different trust levels.
Typical examples are the Internet which is a zone with no trust and an internal network
which is a zone of higher trust.
A zone with an intermediate trust
level, situated between the Internet and a trusted internal network, is
often referred to as a "perimeter network" or Demilitarized zone (DMZ).
Without proper configuration, a firewall can often become worthless.

Standard security practices dictate a "default-deny" firewall ruleset,
in which the only network connections which are allowed are the ones
that have been explicitly allowed. Unfortunately, such a configuration
requires detailed understanding of the network applications and
endpoints required for the organization's day-to-day operation.
Many
businesses lack such understanding, and therefore implement a
"default-allow" ruleset, in which all traffic is allowed unless it has
been specifically blocked. This configuration makes inadvertent network
connections and system compromise much more likely.
Firewalls permit a Stateful Packet Inspection (SPI) and give DoS attack protection
===============================
A router is a computer whose software and hardware are usually tailored to the tasks of routing and forwarding information.
Routers generally contain a specialized operating system (e.g. Cisco's IOS or Juniper Networks JUNOS and JUNOSe or Extreme Networks XOS), RAM, NVRAM, flash memory, and one or more processors, as well as two or more network interfaces.
High-end routers contain many processors and specialized Application-specific integrated circuits (ASIC) and do a great deal of parallel processing.
Chassis based systems like the Nortel MERS-8600 or ERS-8600 routing switch have multiple ASICs on every module and allow for a wide variety of LAN, MAN, METRO, and WAN port technologies or other connections that are customizable.
Much simpler routers are used where cost is important and the demand is low, for example in providing a home internet service.
With appropriate software (such as Untangle, SmoothWall, XORP or Quagga), a standard PC can act as a router.
Routers connect two or more logical subnets, which do not necessarily map one-to-one to the physical interfaces of the router.
The term layer 3 switch often is used interchangeably with router, but switch is really a general term without a rigorous technical definition. In marketing usage, it is generally optimized for Ethernet LAN interfaces and may not have other physical interface types.
Routers operate in two different planes:

• Control Plane, in which the router learns the outgoing interface that is most appropriate for forwarding specific packets to specific destinations,
• Forwarding Plane, which is responsible for the actual process of sending a packet received on a logical interface to an outbound logical interface.

===============================

If you want outbound protection then install a software firewall.
If you have not set any rules with the router the default allow all outbound will apply (default inbound is block all).
You don't necessary need a software firewall behind a router and many don't use one it may depend on experience.
Firewalls in routers can be configured with rules for inbound and outbound or another tool may be used. If you feel it will help with and take care of the outbound then why not - something light and unobtrusive.
The issue of having an outbound FW depend on the risk profile you have on the www. If you just do email and light surfing for receipts and weather then everything you are doing is fine. Security trumps speed.
If on the other hand you keep financial and private information on your PC and purchase items on credit and do on line banking then your risk of identity theft is higher.
In the latter case leave the firewall ON.
Outbound protection is a must when bank transactions are involved.
Problems in PC security terms are of different kind and the worst of them are never spotted. 
Keep the SW firewall (e.g.ComodoPF) and don't let anything except browser, downloader and other safe apps out.

All the malware writers put the best of their skill to make trojans, keyloggers, etc. undetectable.
Hundreds of thousands of PCs are part of zombie networks and the owners think everything is OK.

TrueSpace7

trueSpace7.6 is a fully-featured 3D authoring package that
will let you model, texture, light, animate and render 3D content.
As well as traditional images and movies, you can also make
3D content for online shared spaces, and for Virtual Earth.

Anotarse y bajar el software gratuito!

Knowledge: Firewalls (2)

Stem 

Firewall Moderator
January 1st, 2007

Firewall Questions for beginners

This is just a follow up post to explain some of the connections that a firewall will try to make (for the services/ internet connections mentioned, and rules that can be put in place.)
Quote:

Originally Posted by Paranoid2000 If you are running Windows XP, the following applies: C:\WINDOWS\System32\Svchost.exe Allow access for DNS and DHCP protocols in order to connect to the Internet (required). Allow access for NTP (to time.windows.com, time.nist.gov) for clock synchronisation (optional); Allow access for HTTP, HTTPS (to *.microsoft.com) to access online Windows Help (optional).

________________________________________

Dhcp client
Service Name: Dhcp
Process Name: svchost.exe -k netsvcs
Microsoft Service Description: Manages network configuration by registering and updating IP addresses and DNS names
(This is how your computer gets a Dynamic IP address so you can connect to the internet. If Internet Connection Sharing is enabled, you need DHCP Client. Also required for most DSL/Cable connections.)
UDP Ports 67:68
Allow UDP Local port 68 Remote port 67
________________________________________

DNS Client
Service Name: DNS
Process Name: svchost.exe -k NetworkService
Microsoft Service Description: Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start.
(With this service enabled, svchost will perform all the DNS lookups, if disabled, then any program that requires this service will perform this itself.)
UDP Port 53
Allow UDP Remote port 53
________________________________________

Windows Time Service
Service Name: W32Time
Process Name: svchost.exe -k Netsvcs
Microsoft Service Description: Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
(If you like to synchronize your PC clock to a time server, this is one way to go)

UDP Port 123
Allow UDP Remote port 123 (time.windows.com)
________________________________________

Help and Support Service
Service Name: helpsvc
Process Name: svchost.exe
Microsoft Service Description: Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
(some like this service, and its ability to connect out to microsoft for help, but please note, this does not need to connect to the internet to work correctly, and is optional)
TCP outbound, Ports 80:443
Allow TCP (outbound connection): Local ports 1024-4999: Remote Ports 80:443
________________________________________
Quote:

Originally Posted by Paranoid2000 Block access if any is requested for the RPC protocol to any address (a good indication of a compromised system) and for SSDP/UPnP (Universal Plug and Play) unless you are sure that you need it. Block access for any other incoming traffic (known as Server access in ZoneAlarm or Sygate) - this is to prevent Windows Messenger spam which targets svchost.

________________________________________

Remote Procedure Call (RPC) Locator Service
Service Name: RpcLocator
Process Name: locator.exe
Microsoft Service Description: Manages the RPC name service database.
(When searching for RPC Services on the network a Windows RPC client will connect to the domain controller over TCP port 139/445 (the SMB ports) and search for services/servers through the "locator" named pipe. The need for this on an home PC I have yet to find, as mentioned, best to block this.)
________________________________________

SSDP Discovery Service (UPnP)
Service Name: SSDPSRV
Process Name: svchost.exe -k LocalService
Microsoft Service Description: Enables discovery of UPnP devices on your home network.
(This is NOT the Plug`n`play as you may at first think, this is used for finding external devices. Example is a Router which can be UPnP, applications can, by using UPnP open inbound ports (port forward), this was possibly a good idea for ease of use, but can also be used by Trojans etc)

[Signs of SSDP/UPnP activity: svchost will attempt to send UDP out to remote IP 239.255.255.250 remote port 1900 and will attempt to listen on local port 1900 (as well as listen on localhost(127.0.0.1:1900))]
________________________________________
Quote:

Originally Posted by Paranoid2000 C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Firefox\firefox.exe C:\Program Files\Opera\opera.exe Allow access for FTP, HTTP, HTTPS protocols to be able to view webpages and download files (apply to whichever browsers you use) Allow access for POP3, IMAP, SMTP protocols to be able to read and send emails for Opera if using its M2 email client;

________________________________________

HTTP (HyperText Transfer Protocol)
This is the basic connection made by your browser (http(remote port 80)) when connecting to the internet. There is some confusion at times due to the way the PC uses Local posts, as the PC will use local ports somewhere between 1024-5000 when connecting out, so a typical firewall rule for HTTP could be:
Allow outbound TCP local ports 1024-5000 remote port 80
________________________________________

HTTPS
This is basically the same as HTTP but uses encryption on connection, and connects to remote port 443.
Once again the local ports used can be between 1024-5000, so a typical firewall rule for HTTPS could be:
Allow outbound TCP local ports 1024-5000 remote port 443
________________________________________

FTP (File Transfer Protocol)
This is a commonly used protocol for exchanging files over any network, to connect out this protocol will connect to remote port 21.
Allow outbound TCP local ports 1024-5000 remote port 21.
FTP uses 2 ways of connection, one known as "Active FTP" and one as "Passive FTP", I will not go into a full explanation of this at this time, I just feel that "a need to know" that when connecting via FTP other remote ports can be asked for, with the dreaded popup from the firewall, or if the firewall as a "block all rule" at the end of the ruleset, a "The connection was reset" page.
So at this time I will just say, that, when an FTP connection is made, some firewalls will allow these other ports to be used, but some will require an extra rule for the "Passive" connection.
Possible extra rule:
Allow outbound TCP local ports 1024-65535 remote ports 1024-65535
________________________________________

POP3 (Post Office Protocol 3)
This is the most recent version of a standard protocol for receiving e-mail. POP3 is a client/server protocol in which e-mail is received and held for you by your Internet server. Periodically, you (or your client e-mail receiver) check your mail-box on the server and download any mail, probably using POP3. This standard protocol is built into most popular e-mail products, such as Eudora and Outlook Express.
Allow outbound TCP local ports 1024-5000 remote port 110.
________________________________________

IMAP (Interactive Mail Access Protocol)
This is another way that e-mails are collected, but as more advanced options for access/retrieval.
(a more detailed explanation will be given later).
Allow outbound TCP local ports 1024-5000 remote port 143.
________________________________________

SMTP (Simple Mail Transfer Protocol)
This is a protocol for sending e-mail messages between servers. Most e-mail systems that send mail over the Internet use SMTP to send messages from one server to another; the messages can then be retrieved with an e-mail client using either POP or IMAP. In addition, SMTP is generally used to send messages from a mail client to a mail server. This is why you need to specify both the POP or IMAP server and the SMTP server when you configure your e-mail application.
Allow outbound TCP local ports 1024-5000 remote port 25.

Knowledge: Firewalls

Paranoid2000

Security Expert in North West, United Kingdom
Firewall Questions for beginners
Thanks for the good information, Paranoid2000!

Information useful to people unfamiliar with firewalls or networking.
What is a firewall?
A firewall controls network traffic, allowing or blocking it according to rules you specify (rather like a doorman at a nightclub, with rules on who to allow entry to). This can either be a special program running on your computer ("software firewall") or a separate box connected between your computer and the Internet ("hardware or firmware firewall").
What benefits does it offer?
Connecting to the Internet is like opening the door to your house - anyone can come in, anyone can go out. Sadly, it is also now like entering a war zone due to the number of unscrupulous individuals seeking to hijack others' computers for a variety of reasons. An unprotected Windows system is therefore likely to be broken into within 10-15 minutes when connected.
Both software and hardware firewalls can block such attempts - often with the option of alerting you or taking other action like blocking any further traffic from the attacker.
Firewalls can also control what programs on your computer can access the Internet (though hardware firewalls are fairly limited here).
This is useful for two reasons - first it allows you to protect your privacy by blocking programs that try to "phone home" unnecessarily and secondly it can provide warning if your system has been compromised by malware undetected by your anti-virus scanner (since virtually allmalware needs to connect to the Internet to function properly).
Many software firewalls also include features like ad-filtering (removing adverts from web pages), web-filtering (removing any content from a web page that may pose a security or privacy risk) or parental controls (blocking access to known adult websites). These features can all be provided by other software so should not be regarded as essential, but they may be useful to have.
Which one should I use? (Is there a 'best'?)
There is no best product overall since factors like simplicity, flexibility, speed and features can conflict (a "simple" firewall has to compromise on "flexibility" for example). In addition, your own technical experience and desire for control need to be considered - you may prefer a firewall that alerts you to anything remotely suspicious or instead want one that stays in the background. Furthermore, it is possible for a particular firewall to conflict with other security or network software on your computer.
However, almost every product has a free trial so the best advice is to visit the websites, review the documentation and then create a shortlist of products to try out. Then download and install the trial versions - only committing to a purchase once you are certain that the firewall works on your system and that you are happy configuring and using it.
How good is Windows' firewall?
Microsoft provided a very simple firewall with Windows 2000 which was then significantly improved with Windows XP Service Pack 2. This version can provide good protection from incoming attacks but cannot be relied upon to control outgoing traffic. Older versions of Windows (95, 98, ME, NT) have no firewall.
How can I test my firewall?
To test your firewall's ability to protect against incoming attacks and scans, visit one or more of the following sites. Note that if you are using a router, the test will target the router, not any software firewall your PC is running.
Shields UP!
PCFlank
Sygate Online Scan
HackerWhacker
Please note that while your firewall may report these scans as an "attack", you should notOnline Scans - What to do with Open and Closed Ports has more information about what the results mean and what action to take.
To test your firewall's ability to detect outgoing connections, special programs called "leaktests" have been developed which you can download and run on your system. FirewallLeaktester
is the best source of information here, containing copies of the current leaktests plus reviews of firewall performance against them.
Can I use multiple firewalls?
For software firewalls (programs running on your PC), only one should ever be installed. Multiple software firewalls may cause system crashes (blue screen errors) or interfere with each other, leaving your system unprotected.
Multiple hardware firewalls can be used (for example, having 2 or more routers connected in series) but this offers little extra security benefit while increasing the amount of work you have to do to set everything up.
A software and hardware firewall can be used together and this provides the best of both worlds - the hardware firewall will block intruders leaving the software firewall free to control program network access.
I have several computers - does each one need a firewall?
If the computers are sharing an Internet connection using Windows' Internet Connection Sharing (where one computer, the "gateway", is connected directly to the Internet), then you can protect them by either installing a firewall on each one or by using a firewall on the gateway machine. Internet Connection Sharing is quite complex however so the gateway firewall may need some adjustment to work properly.
If you have a router with its own (hardware) firewall, then that will protect every connected computer from outside attack.
How do I decide what to allow and what to block?
Most firewalls will ask you the first time a program tries to connect to the Internet whether or not to allow it. If the program is one you have installed and has legitimate need for Internet access (a web browser needs to connect to websites, email software needs to connect to your ISPs email server), then you should allow it. If you are unsure, block it and look up the details on the program using a search engine like Google.
The following list covers programs that, for most people, should be allowed access (the first letter may vary, depending on your system setup): report this to any ISP. The Outpost forum thread

• Windows SystemIf you are running Windows XP, the following applies:
  C:\WINDOWS\System32\Svchost.exe
  Allow access for DNS and DHCP protocols in order to connect to the Internet (required).
  Allow access for NTP (to time.windows.com, time.nist.gov) for clock synchronisation (optional);
  Allow access for HTTP, HTTPS (to *.microsoft.com) to access online Windows Help (optional).
  Block access if any is requested for the RPC protocol to any address (a good indication of a compromised system) and for SSDP/UPnP (Universal Plug and Play) unless you are sure that you need it.
  Block access for any other incoming traffic (known as Server access in ZoneAlarm or Sygate) - this is to prevent Windows Messenger spam which targets svchost.
  Do not allow any network access to files named svchost.exe in other folders - they are likely to be malware
  If you are running Windows 2000, the following applies:
  C:\WINNT\System32\Services.exe
  Allow access for DNS and DHCP protocols in order to connect to the Internet (required).;
• Web Browsers
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Firefox\firefox.exe
  C:\Program Files\Opera\opera.exe
  Allow access for FTP, HTTP, HTTPS protocols to be able to view webpages and download files (apply to whichever browsers you use)
  Allow access for POP3, IMAP, SMTP protocols to be able to read and send emails for Opera if using its M2 email client;
• Email Programs
  C:\Program Files\Outlook Express\msimn.exe
  C:\Program Files\Thunderbird\thunderbird.exe
  Allow access for POP3, IMAP, SMTP protocols to be able to read and send emails (apply to whichever email programs you use)
  Block access for HTTP, HTTPS protocols since these are more likely to be used by email "tracking" systems that allow the sender to tell if you have read an email, plus your address

How can a firewall tell me if my system has been compromised?
Almost all malware (a general term covering viruses, spyware and trojans) needs Internet access - to inform their creator of their existence, to receive orders on how to exploit your system or to send back private information. If your firewall alerts you to a new program trying to connect out that you have not installed or the connection looks suspicious in other ways (connecting to a dynamic domain rather than a website, to a domain in a country you don't normally access or using a protocol commonly abused like Internet Relay Chat), then this should be blocked and you should run a full scan of your system with an up-to-date anti-virus utility.
Often malware will attempt to bypass firewalls by hijacking trusted programs - many firewalls can detect such techniques and will alert on them. While some software uses such methods legitimately (mouse/keyboard/touchpad software most notably), it is safer to block if in doubt and do an online search for details of the program concerned.
What limits are there to a firewall's security?
Firewalls cannot provide protection for programs allowed network access. To fully secure your system, you need to look at each program allowed access and consider how it could be used to compromise your system. For example, email software could download attachments containing malware - to prevent this either use anti-virus software or disable attachments completely. A web browser could be affected by a malicious website - anti-virus web scanners or web-filters would prevent this. A downloaded file could contain malware - an anti-virus/anti-malware scanner would be the best protection.
Special care needs to be taken with programs allowed to accept incoming traffic from the Internet (known as "server access" in ZoneAlarm or Sygate) since these would be open to attackers - examples include many file-sharing programs and any "server" software (webserver, mailserver, game server). Such programs need to be kept updated with any patches to fix security problems and it may be worth considering other security software (like a "system firewall") to restrict their access - or running them under a Limited User account.
What are Internet Addresses and Domain Names?
Every system on the Internet has a unique numeric address which needs to be known before connecting to it (rather like a telephone number).
This consist of 4 numbers, each in the range 0-255 - for example 192.168.0.1. However most people find names easier and more meaningful so almost every system has a name also (like wilderssecurity.com) which is known as a Domain Name.
Before connecting to a Domain Name, your computer must look up this numeric address (known as an Internet Protocol or IP address - wilderssecurity.com had the IP address 65.175.38.194 at the time of writing) and it uses a system called the Domain Name System (DNS) to find this. DNS can be thought of as a giant phone directory split into thousands of sections, spread around the Internet. This is why it is necessary to allow DNS traffic for so many programs.
Almost all firewalls allow you to set access restrictions by IP address and many allow domain name restrictions also (for example, you could limit your email software to access your ISP email servers only, allowing it to read and send emails while preventing it from contacting any websites linked to in HTML emails, an increasingly popular technique by marketeers for tracking users).
Note: Due to a shortage of IP numbers, a new addressing system called IPv6 has been created which uses 32 numbers for an address rather than just 4. This is not in widespread use currently (and not many firewalls support it), but this is likely to change in the future.
Hardware Firewalls
With hardware firewalls, the type of Internet connection you use may affect the choice available. While it is possible to have a "2-box" setup with a modem (xDSL, Cable or Satellite) being connected to a router (which has multiple network connections and a firewall), most users would find a single box (providing the connection to their ISP, a firewall plus one or more connections for their PCs) easier to manage.
However while such systems are readily available for DSL users (known as DSL routers - ensure you use the correct type like ADSL or SDSL for your connection), cable or satellite users may be limited to routers offered and supported by their ISP. If you use cable or satellite, you should first contact your ISP for advice on supported units.
Aside from that, most units will provide adequate security from incoming attack - the key features to look out for are:
* the ability to share an Internet connection (using a technique called NAT - Network Address Translation). Even without a firewall, NAT will block most incoming attacks due to the way it works;
* a firewall able to provide details of any attacks blocked (and ideally with some visible indicator when this occurs);
* enough network connections (known as ports) to cover all your computers plus one or two spare for future use;
* a straightforward and simple way of setting up the router (most can be done using your browser but some have strange interfaces);
* for wireless networking, comprehensive support for the strongest encryption available (128-bit WEP as a minimum with WPA strongly recommended).
Some routers offer extra features like virus filters, content blocking (mainly to prevent access to adult websites) or traffic prioritization (also known as Quality of Service). Filtering can be quite easily bypassed so should not be considered a key feature while prioritization can be done via software also. Faster wireless technologies may be worth paying extra for, but every computer will need a wireless network card that supports the same protocol (e.g. 802.11g, 802.11a or
80.2.11n).
Where else can I find more information?
The Other Firewalls Sticky Posts contains links to sites covering configuration and support for several firewalls.

EICAR test

En un BLOC DE NOTAS copian esto:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
Guardarlo como “testXXX.com” (da lo mismo el nombre, lo que importa es la extensión com)
O mejor bajar el archivo de eicar.org
El antivirus activo o instalado debe detectar este patrón típico del más simple EICAR Test en menos de un minuto (o segundos al tratar de abrir el archivo)
Si lo encuentra, se puede considerar al antivirus o antiparásitos como aceptable.
Si el antivirus no lo detecta... Llámenme!
Puede que el antivirus reconoce el EICAR test como una prueba de tontos ;-)

The Anti-Virus or Anti-Malware test file

(read the complete text, it contains important information)
Version of 7 September 2006
If you are active in the anti-virus research field, then you will regularly receive requests for virus samples. Some requests are easy to deal with: they come from fellow-researchers whom you know well, and whom you trust. Using strong encryption, you can send them what they have asked for by almost any medium (including across the Internet) without any real risk.
Other requests come from people you have never heard from before. There are relatively few laws (though some countries do have them) preventing the secure exchange of viruses between consenting individuals, though it is clearly irresponsible for you simply to make viruses available to anyone who asks. Your best response to a request from an unknown person is simply to decline politely.
A third set of requests come from exactly the people you might think would be least likely to want viruses "users of anti-virus software".
They want some way of checking that they have deployed their software correctly, or of deliberately generating a "virus incident in order to test their corporate procedures, or of showing others in the organisation what they would see if they were hit by a virus".
Obviously, there is considerable intellectual justification for testing anti-virus software against real viruses. If you are an anti-virus vendor, then you do this (or should do it!) before every release of your product, in order to ensure that it really works. However, you do not (or should not!) perform your tests in a "real" environment. You use (or should use!) a secure, controlled and independent laboratory environment within which your virus collection is maintained.
Using real viruses for testing in the real world is rather like setting fire to the dustbin in your office to see whether the smoke detector is working. Such a test will give meaningful results, but with unappealing, unacceptable risks.
Since it is unacceptable for you to send out real viruses for test or demonstration purposes, you need a file that can safely be passed around and which is obviously non-viral, but which your anti-virus software will react to as if it were a virus.
If your test file is a program, then it should also produce sensible results if it is executed. Also, because you probably want to avoid shipping a pseudo-viral file along with your anti-virus product, your test file should be short and simple, so that your customers can easily create copies of it for themselves.
The good news is that such a test file already exists. A number of anti-virus researchers have already worked together to produce a file that their (and many other) products "detect" as if it were a virus.
Agreeing on one file for such purposes simplifies matters for users: in the past, most vendors had their own pseudo-viral test files which their product would react to, but which other products would ignore.
This test file has been provided to EICAR for distribution as the "EICAR Standard Anti-Virus Test File", and it satisfies all the criteria listed above. It is safe to pass around, because it is not a virus, and does not include any fragments of viral code. Most products react to it as if it were a virus (though they typically report it with an obvious name, such as "EICAR-AV-Test").
The file is a legitimate DOS program, and produces sensible results when run (it prints the message "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!").
It is also short and simple - in fact, it consists entirely of printable ASCII characters, so that it can easily be created with a regular text editor. Any anti-virus product that supports the EICAR test file should detect it in any file providing that the file starts with the following 68 characters, and is exactly 68 bytes long:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

The first 68 characters is the known string. It may be optionally appended by any combination of whitespace characters with the total file length not exceeding 128 characters. The only whitespace characters allowed are the space character, tab, LF, CR, CTRL-Z. To keep things simple the file uses only upper case letters, digits and punctuation marks, and does not include spaces. The only thing to watch out for when typing in the test file is that the third character is the capital letter "O", not the digit zero.
You are encouraged to make use of the EICAR test file. If you are aware of people who are looking for real viruses "for test purposes", bring the test file to their attention. If you are aware of people who are discussing the possibility of an industry-standard test file, tell them about www.eicar.org, and point them at this article.
In order to facilitate various scenarios, we provide 4 files for download. The first, eicar.com, contains the ASCII string as described above. The second file, eicar.com.txt, is a copy of this file with a different filename. Some readers reported problems when downloading the first file, which can be circumvented when using the second version. Just download and rename the file to "eicar.com". That will do the trick. The third version contains the test file inside a zip ARCHIVEe. A good anti-virus scanner will spot a 'virus' inside an ARCHIVEe. The last version is a zip ARCHIVEes containing the third file. This file can be used to see whether the virus scanner checks ARCHIVEes more than only one level deep.
Once downloaded run your AV scanner. It should detect at least the file "eicar.com". Good scanners will detect the 'virus' in the single zip ARCHIVEe and may be even in the double zip ARCHIVEe. Once detected the scanner might not allow you any access to the file(s) anymore. You might not even be allowed by the scanner to delete these files. This is caused by the scanner which puts the file into quarantaine. The test file will be treated just like any other real virus infected file. Read the user's manual of your AV scanner what to do or contact the vendor/manufacturer of your AV scanner.
Important note: EICAR cannot be held responsible when these files or your AV scanner in combination with these files cause any damage to your computer. YOU DOWNLOAD THESE FILES AT YOUR OWN RISK. Download these files only if you are sufficiently secure in the usage of your AV scanner. EICAR cannot and will not provide any help to remove these files from your computer. Please contact the manufacturer/vendor of your AV scanner to seek such help.

Download area using the standard protocol http
eicar.com 68 Bytes eicar.com.txt 68 Byteeicar_com.zip 184 Bytes eicarcom2.zip 308 Bytes
Download area using the secure, SSL enabled protocol https

How to delete the test file from your PC

We understand (from the many emails we receive) that it might be difficult for you to delete the test file from your PC. After all, your scanner believes it is a virus infected file and does not allow you to access it anymore. At this point we must refer to our standard answer concerning support for the test file. We are sorry to tell you that EICAR cannot and will not provide AV scanner specific support. The best source to get such information from is the vendor of the tool which you purchased.
Please contact the support people of your vendor. They have the required expertise to help you in the usage of the tool. Needless to say that you should have read the user's manual first before contacting them.

Experimento con Ubuntu

Fuente Mayo 23, 2008 by Deidad

Hoy se cumplen 10 meses del experimento y desde mi punto de vista, ha resultado todo un exito, ya que sin lugar a dudas llegara al año sin ningun problema.
Les contare rapidamente de que se trata y despues unos pocos detalles de como se fue desarrollando la historia.
Hace 10 meses convenci a una persona a que aceptara que le instalara en su laptop la (en aquel entonces) ultima version de Ubuntu, despues de que esta persona me solicitara ayuda para que le instalara algunos programas que necesitaba. Leer el resto...

Windows XP Service Pack 3 en Español

Desde el dia 29 de abril se puede descargar la actualización para Windows XP (32bit)
Descargar de aquí