Security Incidents mailing list archives
Re: IE Malware / Spyware Control Methods
From: Harlan Carvey <keydet89 () yahoo com>
Date: Fri, 7 Jan 2005 11:21:26 -0800 (PST)
massa, et al,
I'm sure you all realize the growing threat of malware and spyware to Internet Explorer. It has been my experience that the initial infection and/or removel of an infection by anti-spyware products can permanently damage a windows workstation. This damage occurs in many forms and often leads too the workstation being reformatted and rebuilt before going back into service.
Having dealt with a great many spyware infections, I've successfully removed all of those that were identified with no negative side effects. I've never had to have a workstation rebuilt. I think that it would behoove the list and this effort in general if you could be a bit more specific about the conditions under which a removal damaged a workstation. For example, was the removal done by hand? If not, and a tool was used, which tool was it, and which bit of spyware was involved?
A recent example is earlier this week, in spite of content filtering, a workstation was infected with "wintools", "mysearchtoolbar" etc. The tough part of this is that such malware has multiple instances/threads and renames system files like msconfig to resist removal.
Can you be a bit more specific with regards to what you mean by "system files"? I'm curious about this, as many "system files" are protected by Windows File Protection (WFP) from being modified. As yet, I'm not aware of any spyware that disables WFP before installing itself. Also, msconfig.exe isn't necessarily considered a "system file".
Often IE/Windows is so damaged it's more time effiecient to just replace the box and rebuild the infected one.
Again, I'm not clear on what you mean by "damaged".
My question is this, I'm batting around the idea of using Group Policy in our Active Directory to try and choke IE down to the point where such Malware has trouble installing itself. Has anyone here ever tried such as this with any degree of success? Other than Group Policy I'm also considering deploying an alternate web browser that isnt subject to malware infection but doing so complicates my patching/reporting routine for our security audits. I look forward to your comments and idea's.
An alternate web browser is definitely a good idea. Other than that, knowing how malware/spyware infects a system via the browser is key when developing your Group Policy. For example, BHOs install via specific Registry keys, as do most malware. ===== ------------------------------------------ Harlan Carvey, CISSP "Windows Forensics and Incident Recovery" http://www.windows-ir.com http://windowsir.blogspot.com ------------------------------------------
Current thread:
- IE Malware / Spyware Control Methods Illuminatus Master (Jan 07)
- Re: IE Malware / Spyware Control Methods Gary Baribault (Jan 07)
- Re: IE Malware / Spyware Control Methods harley mcdonald (Jan 07)
- RE: IE Malware / Spyware Control Methods George M. Garner Jr. (Jan 07)
- Re: IE Malware / Spyware Control Methods Valdis . Kletnieks (Jan 10)
- Re: IE Malware / Spyware Control Methods Chris Krough (Jan 07)
- Re: IE Malware / Spyware Control Methods Harlan Carvey (Jan 07)
- Re: IE Malware / Spyware Control Methods Valdis . Kletnieks (Jan 10)
- Re: IE Malware / Spyware Control Methods Paul Laudanski (Jan 10)
- <Possible follow-ups>
- RE: IE Malware / Spyware Control Methods Paris E. Stone (Jan 07)
- RE: IE Malware / Spyware Control Methods Jose Nazario (Jan 07)
- Re: IE Malware / Spyware Control Methods Saad Kadhi (Jan 10)
- RE: IE Malware / Spyware Control Methods M. Shirk (Jan 10)
- RE: IE Malware / Spyware Control Methods Jeff Bryner (Jan 11)
- RE: IE Malware / Spyware Control Methods Bernie Cosell (Jan 12)
- RE: IE Malware / Spyware Control Methods Orlando Richards (Jan 12)
- RE: IE Malware / Spyware Control Methods Jose Nazario (Jan 07)
- Re: IE Malware / Spyware Control Methods Gary Baribault (Jan 07)
- RE: IE Malware / Spyware Control Methods David Gillett (Jan 10)