427 Botnet fm qxd

www.syngress.com/solutions
and click on the 
“Ask the Author”
form. 
427_Botnet_05.qxd 1/9/07 9:59 AM Page 213

---

Q: 
What’s all this Layer 2/Layer 7 stuff?
A: 
We’re referring to the Open Systems Interconnection (OSI) reference
model, which is an abstract model for comms and network protocol
design.The model describes a network protocol in terms of seven layers.
These are as follows: 1, physical; 2, data link; 3, network; 4, transport; 5,
session; 6, presentation; 7, application.The Wikipedia entry for “OSI
Model” is a good jumping-off point for understanding this concept if it’s
new to you.
Q: 
Which is the best antivirus program?
A: 
How long is a piece of string? There isn’t a single best-of-breed solution;
you have to understand the technology well enough to understand your
needs and then compare solutions. Look for solutions that combine a
number of approaches and are flexible enough to accommodate changes
in the threatscape, and don’t waste too much time on anyone who says
“This is the only solution you’ll ever need” or “ … and it never needs to
be updated.” When you’re trying to check a suspected malware exe-
cutable, take advantage of the multivendor virus-scanning opportunities at
http://scanner.virus.org/, www.virustotal.com, and/or
http://virusscan.jotti.org/. Using more than one site is useful in that they
might use different products and configurations, which can increase the
likelihood of detecting something new.
Q: 
What are the advantages of on-demand and on-access scanning?
A: 
On-access or real-time scanning gives you ongoing protection: Every time
you access a file, it’s checked for infection. On-demand scanning is usually
a scheduled scan of a whole system.That’s worth considering 
if
you can
set it up for a deep scan using aggressive heuristics 
and
you can do that
without making the system unusable. It’s also useful if you have systems
that can’t conveniently be scanned on-access.The other time you need it
is if you’re running a forensic examination or simply cleaning up after a
known infection or infestation; again, you’ll need the most paranoid 
settings.