Slashdot Mirror
Spyware/Adware Prevention In Large Deployments?
foQ writes "I work in the IS department for a ~2000 networked computer environment across 10 locations. As with most people, we have experienced serious problems with spyware/adware. We have SpyBot and Ad-Aware installed on most computers, but this doesn't prevent the computers from getting these programs and only sometimes properly removes all of them. Is there a tool that we could push out to all the PCs to basically do what anti-virus programs do and block these programs from running and clean them from the computer?"
I took a look at enterprise antispyware software for a client and particularly liked Webroot's Spy Sweeper Enterprise product. It provides centralized management and automatic deployment though you can do it manually as well. Definition upgrades as well as version upgrades of the sofware is also automated. Take a look at this page from their website. Lavasoft also has an enterprise product that is pretty good though I think Webroot has a slight edge.
http://www.busyweather.com/
besides freezing them?
Use FireFox instead of Internet Explorer. www.mozilla.org
What about blocking or filtering the spywares and adwares at your proxy? If it don't get into the network, it will not affect your computers.
I usually dont reccomend upgrading antivirus programs to my clients, but the latest round of 2005 versions basically have adware in with their virus defs. Not sure about the corporate level stuff, but almost all the major consumer AVs do.
Disable write permissions for all users. Roaming profiles, no browser cache whatsoever, no ability to write any file to the drive.
I never said it was a -good- solution...
Stop dedicating your life to subsidising Microsoft's hegemony. Move people to a good, maintained Linux Distro. Yes, it is possible.
* Don't let the users work with an admin account
* Use a proxy
* Use Firefox instead of IE
Oh yeah. Use that firewall that comes if XP.
I would also download ZoneAlarm too.
We use Symantec at work on the network. Seems to work great.
Also, all suspicious attachments are not let through (quarantined) because the users are too stupid -- they seem to open them mindlessly.
I'm not totally clear on what these machines are used for (custom web apps w/ heavy activeX use? Random surfing?), but assuming you haven't heavily focused on IE with custom software, Mozilla/Firefox plus a proper permissions system that denies access to IE and program installation should prevent 95% of the infections.
Top it off with a local DNS that nulls known ad sites and spyware supplies, and you should be good to go.
Sounds like the same problem we face--4k client PCs in five locations--and we don't have too good of a solution.
We're currently taking a two-pronged approach. First, for the big baddies like Gator or Bonzi, we use Altiris Notification Server to find them and block their execution. This works tolerably well, but it's a reactive process--for me to block a spyware app, I have to know about it, and it has to be something of which I can deny exeuction (so, no browser helper objects).
Second prong is a managed install of Spybot S&D--we're enterprise licensed and maintain our own update server. We stick Spybot S&D in our base loads and force it to run on a schedule, automatically updating itself and running non-interactively. This catches lots, but can sometimes interfere with the users' work.
There is also an ongoing user education effort, consisting of mandatory training and constant reminders about how spyware works and how one gets infected, but that's about as hopeless as bailing the ocean with a kid's toy bucket. I'm long past the point of hoping that the general user population can learn about how not to get infected with spyware; I'm resigned to spending the rest of my days hearing about how someone in Marketing was hitting the gambling sites at lunch and picked up yet another malware app.
Proven on two medium-sized networks I maintain for clients. No spyware in two years and I don't even bother with up-to-the-minute patches. Just patch for serious problems or when a service pack comes out.
Limited User accounts also provide the best AV on Windows, second only to MS Office SP3 and later which block bad e-mail attachments, bad macros, etc by default.
Finally, stand-alone NAT routers that act as firewalls keep worms out.
Worried that your software won't work as a limited user? Harass the vendor. Go to their competition. Loosen up security on individual files and folders (hence, suggesting XP Pro instead of XP Home). Test, test, and test some more. You'll save hundreds if not thousands on annual AV subscriptions and catch new threats before the AV vendors (and Spybot / Ad-Aware) can.
Use Evolution instead of Outlook? Bewa
I did some spyware experiments of my own one day, to "ferret out" where some of this stuff came from. I did a clean install of XP on a machine, and carefully documented what I did, and the resulting changes in cookies, commit charge, etc. The results were interesting - I visited a lot of adult porn sites - literally just combining verbs and adjectives, and got very little in the way of spyware. I went to a particularly vicious site - default-homepage-network.com, and instantly got hit with a bunch of popups and three items immediately went into add/remove programs. Then I installed the "standard" kazaa - installing spyware programs was part of the initial installation!!! Commit charge went from about 100 megs right after a bootup, to 212 after installing Kazaa. Then, I wiped the machine out and installed XP and then SP2. The first things I tried - porn sites and default-homepage-network, didn't do anything - only Kazaa resulted in spyware, because installing it yourself is part of the package. When I clean out clients' PCs, I do the following: 1. Safe mode, command prompt - delete everything I recognize as a spyware .dll or .exe, and I rename anything I believe may be a system file.
2. Normal mode, uninstall any program with "rebates" "shopping" "bargain" etc...
3. Install and run Adaware, Spybot, Hijack This, CW Shredder, and Spyware Blaster.
4. Install SP2 if it's a recent machine - SP2 tends to crush PCs that have been running for a while.
5. Scold them for downloading music, and remind them that not only will they have to pay me if their internet habits cause reinfection, but the greedy RIAA bastards may even come knocking one day.
I agree that most 2004 and up versions of Symantec and McAfee include anti-spyware protection, as well.
Not too impressed with Webroot Spysweeper - it's a rather ponderous product.
Firefox is a damn good idea, too.
And of course, stay away from "Spyware Stormer"
NAV 9 handles both viruses and spyware...
A man who can't pronouce "nuclear arsenal" shouldn't have one -sig ends here.
Assuming you have to run Windows, first remember there are multiple steps that you'll likely have to take with no silver bullet. Consider these 10 steps as a spring board:
The first step is to put in place policies (where possible) on domain controllers that prohibit both the installation of BHOs and of other software by anyone other than Administrators. Given that many, many bits of spyware (I'll go out on a limb and say most) work as (so called) "browser helper objects", don't let people install them at all. Other software Administrators can install when needed. It's actually fairly easy to do.
Second, where possible, deploy W2K or XP, and...
Then, third, where possible, yank people's admin privs. In virtually all cases, with a bit of good ol' trial-and-error, you can successfully adjust users' permissions to take away admin from most folks. Let's face it, most people SHOULD NOT have the ability to have admin on their own machines.
Fourth, where possible, dump IE.
Fifth, do some short SMALL GROUP tutorials about the evils of spyware and how it works. (I found this to be surprisingly useful for teaching users about passwords.)
Sixth, where possible, dump IE.
Seventh, consider netbooting the workstations and storing users files on fileservers. That way the OS you give 'em is the OS they get and it's always the same every day. (Tell them to think of it as life imitating art as in "50 First Dates", where they get a fresh start every day....)
Eighth, where possible, dump IE.
Ninth, go with something many of the folks here have/will recommend in terms of enterprise-based anti-spyware/anti-virus/anti-?????? software. I used Norton Corporate Edition in a fairly recent gig, and while that particular version didn't check for sypware, there are a number of solutions others are proposing that will. (The Corporate Edition is critical to your sanity--you can manage the AV software on *all* desktops via a central console.)
Last, and not least: dump IE.
------
Running 'Nix is like owning a Lightsaber. It's "a more elegant weapon for a more civilized time."
Sorry to shoot your idea out of the water, but I've had XP with SP2 for a while, and Ad-Aware comes up with plenty of hits, and I don't visit porn sites. I'm just running it now and it already recognized 6 new objects.
:-)
Ahh well, it was a nice theory while it lasted.
=======================
Psyclo, the dark night.
Mike, the computer geek.
Active Directory allows an Administrator complete and total control over his/her domains, up to and including limiting the ability of other administrators to install/remove software. On my last assignment we used a combination of AD, RIS and scripting to monitor the computer states of those with local administrative rights (think executives here who incessantly whine about not being able to control their computers) so that any unauthorized changes to the allowed states were undone every 5 minutes. When I started the assignment the Cisco routers were reporting over a Gb of spyware-related traffic every day. We reduced that to less than 1Mb per month. MS SMS pretty much does the same thing, but if you know anything about scripting and batching you can accomplish just about everything that overpriced product does.
End of Line.
Many vulnerabilities in Windows aren't so much in Windows itself, but in IE (or Outlook, or ...). Some of those flaws can be avoided by not using IE, but some more may be avoided if you have IE not installed at all.
By default Windows doesn't allow IE to be uninstalled, and MS once claimed it would render Windows unusable. Tools found on above website prove otherwise. You can also use these to remove other unneeded Windows components.
Fully removing IE may have some drawbacks, but usuallly you can do fine without. If you have doubts, just try the preview version on a couple of boxes. There's a free utility for just removing IE from Windows 98 systems.
For best results, consider removing Windows as well...
You need to stop them before they are able to install one peice of code on the system.
1). You can do a few things, namely locking the computers down using the Microsoft Policy Editor (as I am sure you are aware of it's existance).
2). Make sure that no user has administrative access, and that downloading / installing programs is not allowed - if they need programs, that is what their roaming profile is for.
3). Also keeping a image available of every system so that you can restore to a known good working point
4). Invest in a decent SAN and keep the roaming profiles there, ALL documents should be kept on the SAN / roaming profile so that re-imaging the computers when they do get things on them does not cause valuable work to be lost.
Perhaps suggest hiring a freelance IT guy who knows how to do such things if you do not, there are plenty here who need the work.
If you can get to the control panel, display settings, look in the C: drive, change IE options, etc, you're doing things wrong, it's not locked down enough.
Yes it's a pain for the users, but it does alleviate the potential of corporate espionage (don't beleive it doesn't exist, it most certainly does) and also spyware/adware/etc screwing up your computers.
These are just the basics but it's worked fine for the company I work for, after some user adjustments it's actually not that bad. The only thing you loose is the storage on the clients, and possibly a big investment in a SAN ranging from 1TB on up, which can be moderately expensive.
http://www.fsckin.com/
If your users must have windows workstations, set them up with thin clients via PXES. Have them connect to MS terminal servers (2003 ent preferred).
Single point of control (at least per server). Save insane ammounts of money.
-- Note: If you don't agree with me, don't bother replying. I won't read it.
It selectivly breaks activeX to prevent spyware. I use it on my only windows box. Failling that, I have linux on 2 systems and Mac OS X on the other two. And on my work box which is dual boot I have spywareblaster on the windows part.
This is where Privoxy (http://www.privoxy.org/) comes in; they don't even see those snappy ads!
Now you're ready to do a dd if=/dev/source_partition of=my_image.img
When you zip the resultant img, it will compress much more because, instead of random data on the unused parts of the drive, it's just a bunch of nulls.
When you go to restore, it will also uncompress quicker because, again, the empty space is just a bunch of nulls, instead of random bits.
This means you could do a quick restore from a compressed image off a cd-rom, even with the cd-rom's lower data transfer rate.
Pest Patrol. There is a 30 day / 25-user trial available online. Pest Patrol They were recently purchased by Computer Associates, and this product will be rolled into their Secure Content Manager package in a year or so.
-sid
My solution is simple.
No user can write to the registry in the common spyware places. All access to write to the ares of the registry that is commonly attacked by spyware is removed by GPO. That is - no unapproved shell extensions, no BHO add access, no new Explorer bars, no ability to modify the Winsock32 stack, no install priveleges. All apps are deployed through GPOs. There is a white list of approved ActiveX in general and BHO controls.
Spyware usually requires BHO access to tap into IE. Removing that access is good. White list enables the ability to provide desirable BHOs, such as Google and Yahoo bars, as well as internally developed apps.
Leonid S. Knyshov
Find me on Quora
First off, you are going to have to start off clean. That means spending time at each workstation. There is no magic wand that will get rid of everything your machines have gotten. You got to use the tools that are available to start clean and then focus on prevention. Cleaning: Have someone set down at each workstation. Install and update ad-aware and spybot and start them running, clear temp internet files and cookies. Prevention: You are running a DNS server on your network, right? Put this list domains in your dns pointing to the loopback address: http://mvps.org/winhelp2002/hosts.txt Or, you can install the file on individual machines as a hosts file (as was intended by the authors of the list above) and "lock" the file with this http://www.mvps.org/winhelp2002/lockhost.bat Install Spybot and during installation, install the updates and use the "immunize" feature. Increase Internet Explorer security settings. Install Mozilla Firefox, make Qute theme the default. Right click on the Firefox icon on the desktop and quick launch bar and change the icon to the famous blue e icon. Change shortcut name from "Mozilla Firefox" to "Web Browser". Install the flash plugin and put the stupid "go" button on the tool bar. Make firefox the default browser when asked and also go into the windows control panel and make it the default again. (Windows Update when lauched from the start menu will still launch in IE.) Tell users not to download and install anything from the internet because it will break their computer. If you don't tell them, they won't know. Good luck!
Sometimes management is just clueless and will buckle to user's demands to allow them ot have admin access. Sometimes, they tun specialised programs that will not NOT run properly without admin. Espically in the case of engineering apps, there sometimes is no alternative, this is the only thing that does what it does.
I agree as a general princliple: Users should have the minimum amount of access they need to do their job. Unfortunately, that is sometimes full administrative access.
I manage an active directory domain and I've taken care of the major offenders through group policy.
First, I attempt to download the spyware much like any user would. When I get the prompt asking me to approve this installation, I view the certificate that it was signed with and save the certicate to the file.
Next, I add that certificate to the list of banned certicates domain wide. It works great and fixes the problem of people installing spyware without knowing it.
Install VNC over the network (or other comparable remote-control software; VNC is free and GPLed) and put HijackThis on a read-only network share.
If the user reports problems, VNC into the machine, run HijackThis as root, and remove what you need to.
Running as User or Power User will help, but it won't stop everything.
Try adding the MVP Hosts list to the firewall's shit-site blocker.
If you can, put SpywareBlaster into your image set for the machines you clone and force a once-a-year reclone with updates.
There's also the simple idea of not letting your users use IE. Force them to use Firefox, Opera - anything but IE.
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
SpywareGuard does exactly what you require. It scans software when you open it and stops it from mucking about with obvious spyware related registery keys.
Any time you have to deal with a technical issue that involves user interaction as a component of success, you will need to propose to management, a policy that bolsters the behavioral aspect of the solution; Users need to be made, by management, to have some degree of awareness and culpability for virus and spyware infections.
"Frequent-fires" users will be compelled to learn some digital hygine.
Most large and medium-sized businesses operating today have some sort of policy on sexual harassment/hostile workplace/conflict of interest/Internet and PC usage policy, etc. Generally, users understand that these policies are for eveyone's protection - With ~2000 PCs in the mix... This is definately where you should start... Policy Covers Your Ass.
On the technical side:
1. Router logs, intrusion detection, and sniffing as trending tools to show your boss what's up with traffic.
2. Good, solid desktop images/ app pushes/ GPO's - harden the Registry, Security Policy, individual apps as necessary. Beyond that - when a machine is sufficiently infected, it should be replaced with a re-imaged one --- it can be faster than cleaning, and is a hell of a lot more complete. This also reinforces the notion of users not storing important things locally.
3. Helpdesk tracking software - What users/machines/network segments are continually having the same problems? Does Human Resources need to be the next step for some people?
4. Desktop management software - provide your boss with stats on just what kind of crap is showing up.
5. If you must use/develop software that may enable or even contain spyware, you have a particularly tricky problem that concerns both company policy and IT best practices.
Of course, you know your boss, I don't... How you implement these suggestions is different for everyone. To some, it may seem draconian, to others, quite lax.... To some, budgets will not allow the necessary attention - for others, this kind of focus could perhaps justify a budget increase.
Oh... And consider the broswer's role in the business - what is an acceptable $$ loss for a preventable issue? Have you already spent that?
My $.02
Actually, the notes web interface works fine with firefox (at least for email, I don't play with the calendar & such via web).
http://pivx.com/qwikfix/
Qwik-Fix Pro is not a spyware killer but it is enterprise level and do protect against all of the browser based vulnerabilities (among others) that are being used to forcefully install spyware. It is a perfect combo together with a spyware killer such as The Cleaner from Moosoft (http://www.moosoft.com/) or Lavasoft Ad-Aware (http://www.lavasoftusa.com/).
The protection against IE vulnerabilities was implemented in September 2003 and has since protected against all command execution vulnerabilities discovered since then without a need for updates. These very improvements to IE were subsequently included by Microsoft in Windows XP Service Pack 2, though the implementation Microsoft choose failed to protect against several vulnerabilities discovered since then such as the Drag'n'Drop vulnerability which Qwik-Fix Pro protected against.
That's not making money, that's "not losing money".
Exercise: Let's spin you off as a separate company. How long do you keep getting paychecks? What's your revenue stream? Don't have one? Then you're not MAKING money.
You are a SERVICE, and an EXPENSE. Certainly it's a necessary one, but if it weren't, you'd be on the street in a second.
Aside from individually going to each machine and cleaning them, we try killing the spyware installers and executables. First we installed on a box as much spyware and peer-2-peer apps as we possibly could, and also browsed executable lists on antispyware/malware sites. Then we made a monster list of these executables.
If we were running an XP only shop (this won't work in Win2000 or 98) we would use Microsoft's software restriction policies in active directory. We don't, so this is out of the question.
Novell Zenworks (versions >=4) rogue process management sounds like it may work, but when we tested it doesn't kill apps that start up before the user logs in. So any spyware services aren't killed, even after the user logs in.
Next up was Progkill, an application on Sourceforge.net. Seems to work well on Win95/98/2000 boxes if it starts up. Has a few bugs when starting up. I wish I had a Delphi development box else I would debug it. Bonus points to it for its gui interface.
Finally was roguept (rogue process terminator) on Sourceforge.net. Does the same thing as Progkill, but not as easy to setup. Extremely small though and fast. It is written in C++ and runs as a service so it kills Spyware from the getgo. This speeds up system bootup time.