Re: IE Malware / Spyware Control Methods

From: Chris Krough (ckrough_at_vet.upenn.edu)
Date: 01/07/05

  • Next message: Dave Dennis: "RE: IE Malware / Spyware Control Methods"
    Date: Fri, 07 Jan 2005 15:06:56 -0500
    
    

    Following the concept of least privilege is very effective at preventing
    spyware installation. We've reduced the access level of most of our
    users to 'Domain User'. For users who require frequent administrative
    access we provide them with a secondary, preferably local only,
    administrative account. For users with occasional administrative needs
    we either upgrade their account temporarily or just perform the
    installation/changes ourselves. This practice has almost completely
    eliminated spyware problems from our network.

    Depending on your users needs there is a good chance that lowering
    default account privileges will increase the load on your support staff.
    Installations and low-level configuration changes will require attention
    from someone with administrative privileges but the time saved over
    handling spyware/virus incidents is greater.

    Have you upgraded your clients to XP SP2?

    Illuminatus Master wrote:
    > Hello List,
    > I'm sure you all realize the growing threat of malware and spyware to
    > Internet Explorer. It has been my experience that the initial
    > infection and/or removel of an infection by anti-spyware products can
    > permanently damage a windows workstation. This damage occurs in many
    > forms and often leads too the workstation being reformatted and
    > rebuilt before going back into service.
    >
    > A recent example is earlier this week, in spite of content filtering,
    > a workstation was infected with "wintools", "mysearchtoolbar" etc. The
    > tough part of this is that such malware has multiple instances/threads
    > and renames system files like msconfig to resist removal. Often
    > IE/Windows is so damaged it's more time effiecient to just replace the
    > box and rebuild the infected one.
    >
    > My question is this, I'm batting around the idea of using Group Policy
    > in our Active Directory to try and choke IE down to the point where
    > such Malware has trouble installing itself. Has anyone here ever tried
    > such as this with any degree of success?
    >
    > Other than Group Policy I'm also considering deploying an alternate
    > web browser that isnt subject to malware infection but doing so
    > complicates my patching/reporting routine for our security audits.
    >
    > I look forward to your comments and idea's.
    >
    > Thanks,
    > massa


  • Next message: Dave Dennis: "RE: IE Malware / Spyware Control Methods"

    Relevant Pages

    • RE: Delete unwanted Microsoft banner/icon
      ... >> Do you have any antivirus or spyware protection or a firewall ... describing is nothing standard on any Microsoft installation. ... replacement and Windows installation yourself but instead took the ... Here are general malware removal steps. ...
      (microsoft.public.windowsxp.general)
    • Re: IE6 shuts down suddenly
      ... Sounds malware related to me, ... as does HijackThis (Only more so. ... This item below is designed to *prevent* installation of malware and the ... will perform the duty of removing the spyware. ...
      (microsoft.public.windows.inetexplorer.ie6.browser)
    • Re: Unable to run dbg_x86_6.8.4.0.msi
      ... installation". ... Make sure to log on as administrator or as user with administrative ... If the problems still occurs while you have *administrative* privileges ... malware in this case since it controls your entire system. ...
      (microsoft.public.windowsxp.general)
    • Re: IE redirects to some other page.
      ... Check for Spyware - How-to ... as does HijackThis (Only more so. ... This item below is designed to *prevent* installation of malware and the ... Virus Cleaner - free virus & worm removal tool ...
      (microsoft.public.windows.inetexplorer.ie6.browser)
    • Re: remove spyware
      ... Once you have the program installed, open SpyBot and select the ... Permanently running bad download blocker for Internet Explorer. ... By setting a "kill bit" for the CLSIDs of spyware ActiveX ... installation of Bazooka is completed, that you should update the File ...
      (microsoft.public.security)