Re: IE Malware / Spyware Control Methods

From: Harlan Carvey (keydet89_at_yahoo.com)
Date: 01/07/05

  • Next message: sunzi: "RE: IE Malware / Spyware Control Methods"
    Date: Fri, 7 Jan 2005 11:21:26 -0800 (PST)
    To: incidents@securityfocus.com
    
    

    massa, et al,

    > I'm sure you all realize the growing threat of
    > malware and spyware to
    > Internet Explorer. It has been my experience that
    > the initial
    > infection and/or removel of an infection by
    > anti-spyware products can
    > permanently damage a windows workstation. This
    > damage occurs in many
    > forms and often leads too the workstation being
    > reformatted and
    > rebuilt before going back into service.

    Having dealt with a great many spyware infections,
    I've successfully removed all of those that were
    identified with no negative side effects. I've never
    had to have a workstation rebuilt.

    I think that it would behoove the list and this effort
    in general if you could be a bit more specific about
    the conditions under which a removal damaged a
    workstation. For example, was the removal done by
    hand? If not, and a tool was used, which tool was it,
    and which bit of spyware was involved?

    > A recent example is earlier this week, in spite of
    > content filtering,
    > a workstation was infected with "wintools",
    > "mysearchtoolbar" etc. The
    > tough part of this is that such malware has multiple
    > instances/threads
    > and renames system files like msconfig to resist
    > removal.

    Can you be a bit more specific with regards to what
    you mean by "system files"? I'm curious about this,
    as many "system files" are protected by Windows File
    Protection (WFP) from being modified. As yet, I'm not
    aware of any spyware that disables WFP before
    installing itself.

    Also, msconfig.exe isn't necessarily considered a
    "system file".

    > Often
    > IE/Windows is so damaged it's more time effiecient
    > to just replace the
    > box and rebuild the infected one.

    Again, I'm not clear on what you mean by "damaged".

    > My question is this, I'm batting around the idea of
    > using Group Policy
    > in our Active Directory to try and choke IE down to
    > the point where
    > such Malware has trouble installing itself. Has
    > anyone here ever tried
    > such as this with any degree of success?
    >
    > Other than Group Policy I'm also considering
    > deploying an alternate
    > web browser that isnt subject to malware infection
    > but doing so
    > complicates my patching/reporting routine for our
    > security audits.
    >
    > I look forward to your comments and idea's.

    An alternate web browser is definitely a good idea.
    Other than that, knowing how malware/spyware infects a
    system via the browser is key when developing your
    Group Policy. For example, BHOs install via specific
    Registry keys, as do most malware.

    =====
    ------------------------------------------
    Harlan Carvey, CISSP
    "Windows Forensics and Incident Recovery"
    http://www.windows-ir.com
    http://windowsir.blogspot.com
    ------------------------------------------


  • Next message: sunzi: "RE: IE Malware / Spyware Control Methods"

    Relevant Pages

    • Re: Windows XP update WOW32.DLL CRC error
      ... me thinks you have an infection of spyware/malware etc ... Please note that some malware may kill the internet connection when it is removed, ... Fight Spyware - articles by Microsoft ... Downloadable McAfee AVERT Stinger: ...
      (microsoft.public.windowsupdate)
    • Re: Apple makes Macs run Windows XP
      ... Those between them are worse than any malware that's out there. ... the spyware in question installed from ActiveX? ... are your machines configured to _not_ try to boot from a diskette ... the systems down to the point that the infection can't get a foothold. ...
      (rec.photo.digital.slr-systems)
    • Re: virtual memory increases fast and slows machine down
      ... Did you delete two system files because of infection? ... just deleted the symptoms of the infection, ... They're all free - and most pretty small, so they download quickly enough. ... Now check for, and remove, spyware. ...
      (microsoft.public.windowsxp.perform_maintain)
    • Re: virtual memory increases fast and slows machine down
      ... Did you delete two system files because of infection? ... just deleted the symptoms of the infection, ... First, download LSP-Fix and WinsockXPFIx from, ... Now check for, and remove, spyware. ...
      (microsoft.public.windowsxp.perform_maintain)
    • Re: windows xp locks up
      ... It could be spyware, malware, application conflict, corruption of operating ... system files, or other possibilities. ...
      (microsoft.public.security)