RE: IE Malware / Spyware Control Methods

• Previous message: Illuminatus Master: "IE Malware / Spyware Control Methods"
• Maybe in reply to: Illuminatus Master: "IE Malware / Spyware Control Methods"
• Next in thread: Jose Nazario: "RE: IE Malware / Spyware Control Methods"
• Reply: Jose Nazario: "RE: IE Malware / Spyware Control Methods"
• Reply: Dave Dennis: "RE: IE Malware / Spyware Control Methods"
• Reply: sunzi: "RE: IE Malware / Spyware Control Methods"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Fri, 7 Jan 2005 12:58:59 -0500
To: "Illuminatus Master" <illuminatus.master@gmail.com>, <incidents@securityfocus.com>

Use Mozilla.

If IE is a must, get the yahoo toolbar with anti-spy.
&
Spybot, have it immunize the system and block all bad pages & use the
TeaTimer component.

~~~~~
Paris E. Stone, "Linux Zealot"
CISSP, CCNP, CNE, MCSE
~~~~~
The only thing necessary for the triumph of evil,
is for good men to do nothing.
- Edmund Burke
 

-----Original Message-----
From: Illuminatus Master [mailto:illuminatus.master@gmail.com]
Sent: Friday, January 07, 2005 12:37 PM
To: incidents@securityfocus.com
Subject: IE Malware / Spyware Control Methods

Hello List,
 I'm sure you all realize the growing threat of malware and spyware to
Internet Explorer. It has been my experience that the initial
infection and/or removel of an infection by anti-spyware products can
permanently damage a windows workstation. This damage occurs in many
forms and often leads too the workstation being reformatted and
rebuilt before going back into service.

A recent example is earlier this week, in spite of content filtering,
a workstation was infected with "wintools", "mysearchtoolbar" etc. The
tough part of this is that such malware has multiple instances/threads
and renames system files like msconfig to resist removal. Often
IE/Windows is so damaged it's more time effiecient to just replace the
box and rebuild the infected one.

My question is this, I'm batting around the idea of using Group Policy
in our Active Directory to try and choke IE down to the point where
such Malware has trouble installing itself. Has anyone here ever tried
such as this with any degree of success?

Other than Group Policy I'm also considering deploying an alternate
web browser that isnt subject to malware infection but doing so
complicates my patching/reporting routine for our security audits.

I look forward to your comments and idea's.

Thanks,
massa

• Previous message: Illuminatus Master: "IE Malware / Spyware Control Methods"
• Maybe in reply to: Illuminatus Master: "IE Malware / Spyware Control Methods"
• Next in thread: Jose Nazario: "RE: IE Malware / Spyware Control Methods"
• Reply: Jose Nazario: "RE: IE Malware / Spyware Control Methods"
• Reply: Dave Dennis: "RE: IE Malware / Spyware Control Methods"
• Reply: sunzi: "RE: IE Malware / Spyware Control Methods"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]