Bots and worms spread automatically. Are you telling me an author is going to log on to each box to disable the firewall so it can spread? I don't think so. Even automated they would have to determine which product they are running and many Personal Firewall are automatically restarted(i.e. Sygate) There are too many machines out there completely unpatch for somebody to waste there time disabling firewalls, and thats makin a big assumption that the malware is running at the system level and not the user's level.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/307/30983#30983