Spy-Ware Detection for Small Networks

From: Thiago Lima (thiagolima_at_webforce.com.br)
Date: 04/18/04

  • Next message: ZEN: "Re: restore Administrator password" 
    To: <security-basics@securityfocus.com>
Date: Sun, 18 Apr 2004 12:15:45 -0300

     
        I run several small networks using a Linux Server to act as a
    Firewall/Proxy HTTP/Mail server/Caching DNS/DHCP/Samba File Server for
    Windows networks (98/XP/2000).
     
        I also do desktop maintanance and I'm seening a growing problem in
    Spy-wares and malware. It is becaming unmanageable to deal with it.
     
        I've tryed to educate users, but they really seen not care, they click
    on everything they can.
     
        So I'm looking for some solutions that can make my life easier, and I
    want some comments on what I've came thru to try to find a balance between
    all solutions that can prevent most infections and keep the usability of the
    system.
     
        1) Spy-bot : Looks to me that it is the best tool to remove
    spyware/malware, but it is host directed. It's hard to run it on all
    machines periodically. There's any way to centralize it ? Or there's any
    other program that will run in a centralized way?
     
        2) Firewall blocking List : I've seen some IP lists that will prevent
    spywares to "call home". It is usefull to detect machines that are infected
    and blocking spyware to call home, but it does not prevent users from
    getting dirty. It helps a lot and I'm using
    http://www.geocities.com/yosponge/ list. Does anyone knows others lists?
     
        3) Content filtering : Viruses spreads by mail, spyware/malware spreads
    mostly by HTTP. Maybe filtering some words/parterns in HTTP Proxy I could
    block some problems. Dans-Gaurdian seens to be a solution for this. Does
    any one knows any list of words/sites, file extensions or any alternative to
    this?
     
        4) Removing user access to his own machine : Removing users privilegies
    (at least in XP/20000) will make spyware/malware infection harder or not?
    Looks to me that at least IE infections still contiunes. At opinion on that?
     
        5) IDS : Using snort or any other IDS will help me with malware/spyware
    detection?
       
        Is that all I can do? I'm open to any tip, solution or reading that can
    help me with this annoing problem.
     
     
    Regards and thanks in advanced for all replys,
    Thiago Madeira de Lima.

    ---------------------------------------------------------------------------
    Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
    any course! All of our class sizes are guaranteed to be 10 students or less
    to facilitate one-on-one interaction with one of our expert instructors.
    Attend a course taught by an expert instructor with years of in-the-field
    pen testing experience in our state of the art hacking lab. Master the skills
    of an Ethical Hacker to better assess the security of your organization.
    Visit us at:
    http://www.infosecinstitute.com/courses/ethical_hacking_training.html
    ----------------------------------------------------------------------------

  • Next message: ZEN: "Re: restore Administrator password"

    Relevant Pages

    • RE: Three Errors on Server 2003 SB Any idea?
      ... occurring on your SBS 2K3 Server: ... expand the Recipients object -> Offline ... Address Lists. ... Ensure a valid Public Folder Store is set for the Offline Address ...
      (microsoft.public.windows.server.sbs)
    • Re: redhat-list Digest, Vol 2, Issue 1
      ... end-of-life of Red Hat Linux 9.0.... ... In this case, if this is an important server, then it may as well be ... The problem with mailing lists like this one is that the from ...
      (RedHat)
    • Re: DNS poisoning block list?
      ... I have checked lists, and as an individual user they are really so far ... site for DNS poisoning, I don't know why I shouldn't try to explicitly ... that I was served from a poisoning DNS server like this that I had taken ...
      (comp.os.linux.security)
    • Re: fedora-list Digest, Vol 46, Issue 104
      ... server can't probe the monitor (but this isn't the real ... F8 Network Woe ... bridge-wlan0: enabling the bridge ... Most other lists I follow have this feature and it help a lot when trying ...
      (Fedora)
    • RE: SMTP error (only from Outlook)
      ... This issue appeared on specify user or all SMTP clients? ... If yes, in Exchange System ... Is there any local bridgehead server listed in "Local ... to over three dozen open relay block lists. ...
      (microsoft.public.windows.server.sbs)