Industry Online Support
Technical Forum
Navigation
Rating 
Thanks 1
9 Entries
| 10/6/2010 10:09 PM | |
Joined: 1/28/2009 Last visit: 5/26/2023 Posts: 6802 Rating:
|
Dear experts The Stuxnet virus may change the user program.In offline project, it is possible to check any change in the source of program by block (code) checksum.Is it possible to monitor this value online? Splitted from What is the interaction that there could be between an Audit Trail tool or the Simatic Logon system to detect the Stuxnet virus?. |
Last edited by: O_Moderator at: 10/7/2010 11:26 AMnew subject after splitting |
|
| 10/14/2010 6:17 PM | |
Joined: 9/17/2008 Last visit: 2/20/2023 Posts: 49 Rating:
|
the error codes are in HEX. 8082h = 32898 in decimal. It means that your SSL-ID is wrong or is unknown to the CPU or SFC. Verify that you entered W#16#232 as the "SZL_ID" (it says SZL_ID on my block...but it is really SSL)Attachmentsfc109.pdf (52 Downloads) |
| 10/14/2010 7:31 PM | |
|
Posts: 947 Rating:
|
see : /tf/WW/en/Posts/49538#top |
| 10/14/2010 8:02 PM | |
|
Joined: 1/28/2009 Last visit: 5/26/2023 Posts: 6802 Rating:
|
hi gre_m do think checking checksum will be helpful? dear dmelliot please check the attachment.job is done successfully. best regard Attachment1.zip (54 Downloads) |
| 10/16/2010 8:37 PM | |
|
Posts: 947 Rating:
|
hello hdhosseini! checksum to compare with the etalon. Where can you find the etalon, if it is corrupted? Need a "clean", not an infected computer. You can test your program in the presence of certain DB, which should not be in your program (see https: / / www.automation.siemens.com/tf/WW/en/Posts/49538 # top ). If they are, in your proramm they do not, this is strange - possible virus. Check DB can be done with SFC. exuse my english |
| 10/17/2010 10:22 AM | |
|
Posts: 947 Rating:
|
hello hdhosseini! If you have been working with the CPU, then you have 99.9% to obtain the correct checksum. 0.1% on the uncertainty - Symantec claims that finds traces Stuxnet in 2009. If I understand correctly Siemens, then if your computer does not WinCC and PCS7, the virus is not activated. Moreover, even if there is a virus and it works, that is, functions and DB with a certain number who simply can not exist in a particular model of the controller - this controller, the virus also are not activated. The presence of these functions and DB, if you did not create them, says the presence of the virus. In this case, Siemens recommends to refer to them. I, too, as you are not satisfied with the possible introduction of the virus in the cyclic OB, and I would like to be able to block unused cyclicOB at HW_config, nice to have the system function test kits address of the interrupt handler program - a self-test. Some steps you can take yourself, based on the evidence of the early posts in the forum. Given the rather exotic way of spreading the virus - via USB - stick, the measures taken "obsessed" |
Follow us on