Virus protection question...

erazor51 said:
If a server is fully patched and presents shares to an infected client, will the shared drive get infected?

Thanks
Click to expand...
thats not really a question?

which infection?
which OS?
which share?
if a server is patched with what?
OS/Virus protection?

the answer to your question maybe.

if the client is infected with a worm, then he saves a file on the share & the server does not have active protection enabled scanning every connection then yes
if a worm bypasses protection then yes
if the virus is already in a list somewhere - then possibly no.

to many questions to broad a question :p
 
Possibly. ;)

The most likely (and topical) danger in that case, assuming the share is writeable, is ransomware. If the client invokes any ransomware it will usually instruct the server to encrypt whatever it can get its hands on.

Anything more sophisticated and smogsy's point applies. The network share itself doesn't really make much difference, you have to consider the entire attack surface (of which the network share is just one factor).

Tldr: there's no such thing as 'infected' - the way viruses, worms, etc. operate is much more complicated!
 
smogsy said:
thats not really a question?

which infection? the Ransomware going around
which OS? Windows Server 2008 R2
which share? file servers users have access to.
if a server is patched with what? with the latest Microsoft patch
OS/Virus protection? Macafee Enterprise

:p
Click to expand...
 
joeyjojo said:
Possibly. ;)

The most likely (and topical) danger in that case, assuming the share is writeable, is ransomware. If the client invokes any ransomware it will usually instruct the server to encrypt whatever it can get its hands on.

Anything more sophisticated and smogsy's point applies. The network share itself doesn't really make much difference, you have to consider the entire attack surface (of which the network share is just one factor).

Tldr: there's no such thing as 'infected' - the way viruses, worms, etc. operate is much more complicated!
Click to expand...

If the client invokes any ransomware on the file server which is patched for that specific ransomware, will it fail and just infect the client machine only and machines that are not patched?

Thanks
 
which infection? the Ransomware going around
which OS? Windows Server 2008 R2
which share? file servers users have access to.
if a server is patched with what? with the latest Microsoft patch
OS/Virus protection? Macafee Enterprise

wanncry is patched so is petra, so No, but all users accessing the share could.

on side note mcaffe enterprise is pretty pants :p

ESET/Bitdefender AVAST all give monthly updates via email telling you if your Protected & what steps to take.

maybe try it out or add yourself to the mailing list :)
 
Last edited:
Complex one - just by having write access to a shared folder on another machine doesn't mean that any malicious files written to that folder will have any effect on the host machine. However someone could accidentally subsequently execute them on the host and/or there have been flaws in things like Windows defender in the past where it might result in the host becoming infected if it scans those files.

Always possible that some malware will find a way to infect systems it is networked with via other means as well.
 
You must log in or register to reply here.
Back
Top Bottom