Security Incidents mailing list archives
RE: IE Malware / Spyware Control Methods
From: "Jason Albuquerque" <JAlbuquerque () northkingstown org>
Date: Mon, 10 Jan 2005 09:11:49 -0500
I can honestly say that all of our users are "Restricted Users" on our XP Pro and W2K Pro Workstations, and none have fallen victim to malware or spyware. Now yes, this could create more work, because users will not be able to install any software or patches on the PC, but with the implementation of management tools such as SUS or SMS (to push patches) and an Remote control software such as VNC your PC workload will actually go down. You will not have to worry about Spyware/Malware being installed, your Windows Updates will be pushed automatically, and if a new piece of software needs to be installed you can get to the Machine remotely switch the User to an admin, drop the user back down to "restricted user" and you are done. Jason Albuquerque GIS Manager Department of Information Systems 80 Boston Neck Road Town of North Kingstown, RI 02852 Tel. (401) 268-1516 Fax (401) 295-2594 www.northkingstown.org love does not delight in evil, but rejoices with the truth C13:6 -----Original Message----- From: Chris Krough [mailto:ckrough () vet upenn edu] Sent: Friday, January 07, 2005 3:07 PM Cc: incidents () securityfocus com Subject: Re: IE Malware / Spyware Control Methods Following the concept of least privilege is very effective at preventing spyware installation. We've reduced the access level of most of our users to 'Domain User'. For users who require frequent administrative access we provide them with a secondary, preferably local only, administrative account. For users with occasional administrative needs we either upgrade their account temporarily or just perform the installation/changes ourselves. This practice has almost completely eliminated spyware problems from our network. Depending on your users needs there is a good chance that lowering default account privileges will increase the load on your support staff. Installations and low-level configuration changes will require attention from someone with administrative privileges but the time saved over handling spyware/virus incidents is greater. Have you upgraded your clients to XP SP2? Illuminatus Master wrote:
Hello List, I'm sure you all realize the growing threat of malware and spyware to Internet Explorer. It has been my experience that the initial infection and/or removel of an infection by anti-spyware products can permanently damage a windows workstation. This damage occurs in many forms and often leads too the workstation being reformatted and rebuilt before going back into service. A recent example is earlier this week, in spite of content filtering, a workstation was infected with "wintools", "mysearchtoolbar" etc. The tough part of this is that such malware has multiple instances/threads and renames system files like msconfig to resist removal. Often IE/Windows is so damaged it's more time effiecient to just replace the box and rebuild the infected one. My question is this, I'm batting around the idea of using Group Policy in our Active Directory to try and choke IE down to the point where such Malware has trouble installing itself. Has anyone here ever tried such as this with any degree of success? Other than Group Policy I'm also considering deploying an alternate web browser that isnt subject to malware infection but doing so complicates my patching/reporting routine for our security audits. I look forward to your comments and idea's. Thanks, massa
Current thread:
- RE: IE Malware / Spyware Control Methods, (continued)
- RE: IE Malware / Spyware Control Methods Bernie Cosell (Jan 12)
- RE: IE Malware / Spyware Control Methods Orlando Richards (Jan 12)
- RE: IE Malware / Spyware Control Methods David Gillett (Jan 10)
- RE: IE Malware / Spyware Control Methods Dave Dennis (Jan 07)
- Re: IE Malware / Spyware Control Methods gadgeteer (Jan 10)
- RE: IE Malware / Spyware Control Methods sunzi (Jan 07)
- RE: IE Malware / Spyware Control Methods James C Slora Jr (Jan 10)
- RE: IE Malware / Spyware Control Methods King, Stephen (Jan 10)
- Re: IE Malware / Spyware Control Methods lightweb (Jan 10)
- RE: IE Malware / Spyware Control Methods matt (Jan 10)
- RE: IE Malware / Spyware Control Methods Jason Albuquerque (Jan 10)
- RE: IE Malware / Spyware Control Methods k levinson (Jan 12)
- RE: IE Malware / Spyware Control Methods k levinson (Jan 12)