Security Incidents mailing list archives
Re: IE Malware / Spyware Control Methods
From: Paul Laudanski <zx () castlecops com>
Date: Fri, 7 Jan 2005 19:06:39 -0500 (EST)
Still isn't too late, so Happy 2005! I have my comments below. On Fri, 7 Jan 2005, Illuminatus Master wrote:
I'm sure you all realize the growing threat of malware and spyware to Internet Explorer. It has been my experience that the initial infection and/or removel of an infection by anti-spyware products can permanently damage a windows workstation. This damage occurs in many forms and often leads too the workstation being reformatted and rebuilt before going back into service.
From the extensive experience in working with members at
http://castlecops.com in using applications like hijackthis, the staff have not run into the same issues you state above. It is not common to rebuild systems after they have been hijacked, those systems can be, and often times, are saved.
A recent example is earlier this week, in spite of content filtering, a workstation was infected with "wintools", "mysearchtoolbar" etc. The tough part of this is that such malware has multiple instances/threads and renames system files like msconfig to resist removal. Often IE/Windows is so damaged it's more time effiecient to just replace the box and rebuild the infected one.
Well there are many nefarious spyware files which are completely random. Take note that some files, if the system has proper permissions, won't be able to overwrite critical files. You can take a look at the lists we keep for files, BHOs, Toolbars, LSPs: http://castlecops.com/CLSID.html http://castlecops.com/LSPs.html http://castlecops.com/StartupList.html On the two you cite, you can search the threads here for solutions aside from system rebuild. http://castlecops.com/modules.php?name=Forums&file=search
Other than Group Policy I'm also considering deploying an alternate web browser that isnt subject to malware infection but doing so complicates my patching/reporting routine for our security audits.
Scott Lemmon, bless his soul, wrote Proxomitron, an application that if installed and used as a local proxy could put a stop to all of this. As for alternate browsers, each have their own issues. Firefox for example is susceptible to phishing attacks: http://castlecops.com/article-5659-nested-0-0.html Here is the dedicated homepage for Proxomitron: http://www.proxomitron.info (appears to be down ATM) Here is an excellent article on how one got infected in the first place, and provides suggestions on how to shore up by Tony Klein: http://castlecops.com/postt7736.html If you find that rebuilding systems is getting common for you, you may want to visit some spyware help forums. Ours is here: http://castlecops.com/forum67.html However, there is a whole team of sites that participate in cleaning up spyware infected systems: http://a-sap.org/ However, Eric Howes has done extensive testing on anti-spyware applications, and touches on knock offs: http://www.spywarewarrior.com/rogue_anti-spyware.htm http://spywarewarrior.com/asw-test-guide.htm I hope this information helps. There shouldn't be reasons to rebuild systems on a regular basis. -- Regards, Paul Laudanski - Computer Cops, LLC. CEO & Founder CastleCops(SM) - http://castlecops.com Promoting education and health in online security and privacy.
Current thread:
- IE Malware / Spyware Control Methods Illuminatus Master (Jan 07)
- Re: IE Malware / Spyware Control Methods Gary Baribault (Jan 07)
- Re: IE Malware / Spyware Control Methods harley mcdonald (Jan 07)
- RE: IE Malware / Spyware Control Methods George M. Garner Jr. (Jan 07)
- Re: IE Malware / Spyware Control Methods Valdis . Kletnieks (Jan 10)
- Re: IE Malware / Spyware Control Methods Chris Krough (Jan 07)
- Re: IE Malware / Spyware Control Methods Harlan Carvey (Jan 07)
- Re: IE Malware / Spyware Control Methods Valdis . Kletnieks (Jan 10)
- Re: IE Malware / Spyware Control Methods Paul Laudanski (Jan 10)
- <Possible follow-ups>
- RE: IE Malware / Spyware Control Methods Paris E. Stone (Jan 07)
- RE: IE Malware / Spyware Control Methods Jose Nazario (Jan 07)
- Re: IE Malware / Spyware Control Methods Saad Kadhi (Jan 10)
- RE: IE Malware / Spyware Control Methods M. Shirk (Jan 10)
- RE: IE Malware / Spyware Control Methods Jeff Bryner (Jan 11)
- RE: IE Malware / Spyware Control Methods Bernie Cosell (Jan 12)
- RE: IE Malware / Spyware Control Methods Orlando Richards (Jan 12)
- RE: IE Malware / Spyware Control Methods Jose Nazario (Jan 07)
- Re: IE Malware / Spyware Control Methods Gary Baribault (Jan 07)
- RE: IE Malware / Spyware Control Methods David Gillett (Jan 10)
- Re: IE Malware / Spyware Control Methods gadgeteer (Jan 10)