Spyware/Adware Prevention In Large Deployments? 782
foQ writes "I work in the IS department for a ~2000 networked computer environment across 10 locations. As with most people, we have experienced serious problems with spyware/adware. We have SpyBot and Ad-Aware installed on most computers, but this doesn't prevent the computers from getting these programs and only sometimes properly removes all of them. Is there a tool that we could push out to all the PCs to basically do what anti-virus programs do and block these programs from running and clean them from the computer?"
Webroot Spy Sweeper Enterprise and Lavasoft too (Score:5, Informative)
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:5, Informative)
The only one that I've seen get through (and it's not really spyware) is changing a person's homepage. I'm not sure why IE even allows this. Fortunately, the main reason for switching someone's home page (slamming them with pop-up ads) is kind of diminished with SP2.
My feeling: the vast majority of administrators don't take advantage of the tools MS has provided. The one complaint I've heard ("We use programs that require special permissions, so we can't have staff run as limited users") is bollocks. Do what we do: take a few hours out during a deployment, contact the original software manufacturer (or figure it out in house) and set all the permissions correctly.
And it's not just unknown shops. I recently read an article where Kinko's reimages computers after guests pay to use them. This can take 5-10 minutes. What the hell? Just set a limited user and recreate that one folder. What are their administrators thinking?
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:3, Interesting)
This is so true. I wor
Unfortunately it's not always possible (Score:3, Informative)
I agree as a general princliple: Users should have the minimum amount of access they need to do their job. Unfortunately, that is sometimes full administrative access.
Re:Unfortunately it's not always possible (Score:3, Interesting)
First thing that happens when we hire a new developer
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:4, Interesting)
Works great, until you run into something like Palm software, which won't cooperate with permissions. I've tried several methods to make it possible to sync a Palm Pilot with Outlook, and none work, if the user doesn't have administrator privileges on the computer. Apparently, some of the Palm conduits try to write to directories that aren't available to mere users, and I haven't been able to track all of them down.
And it's the executives that have the Palms, so not letting them work isn't a viable option...
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:5, Informative)
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:4, Informative)
At least, this was my experience after many experiments.
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:3, Interesting)
This isn't to say they can't hotsync - Anything they put into the Palm software application works just fine, and the data they grabbed from Outlook on the earlier sync will be backed up, but they can no longer attach to their Outlook data, once their privilege level is reduced to "power user".
Note that even this proposed solution isn't that great - what if the user has something in
Executive's Palm. (Score:3, Insightful)
You explain to the suit that you can't install the software because that would make your network a virus/spyware testbed.
If the suit inisist have him put it in writting exhonerating you from any responsibility and financial damage the company may suffer
It always amazes me the deference that some people have for somebody wearing a suit and with an important sounding job description.
Your job is to make that network safe, in spite of the owners of
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:3, Interesting)
This came up in a
I'll look through my replies and repost it. He said that it's a bit tricky, but it can be done.
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:4, Insightful)
I wonder how much productivity you lock-'em-down admins are costing the economy as a whole. You wanna know something? LAN administration isn't the most important part of a company, you aren't making the company any money. Your job is to help us users be more productive in doing our job, it isn't to cause you the least hassle.
How does it help the company when everytime I need to install some software to do my job I have to call you up and waste a couple of days for it to get aproved by the all-mighty-admin? How does it help the company when I can't immediately respond to a customer!?
OK, so there are stupid users, but I don't care about them, they don't affect me, I'm just trying doing my job. Leave me alone god damnit!
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:4, Insightful)
Microsoft has greased the wheels with its exploit ridden, high maintenance software, creating security problems of epic proportion that are helping justify the return to the "glass house" in the eyes of management, who worries about things like HIPAA, Sarbanes Oxley, EU privacy directives, Gramm Leach Bliley, and all that--and creating a class of well-paid overseers to manage it.
The users are mere pawns in the game.
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:5, Insightful)
That's because we know what we're doing. And, if we cause problems, we're the ones that have to fix it.
Who do you think is responsible for keeping track of the licenses for that software you want to install? Given admin access, how many users do you think will pirate software? (Answer: a lot). How many users will knowingly or unknowingly install spyware? (Answer: a majority) How many will get a virus? (Answer: A few. But those few will impact the entire company.) And, when they do all of this, and it takes 1-2 days to clean up their computer, how many users will understand that it's their fault and not blame the IT department? (Answer: None.)
I suppose you feel the same way about your Purchasing Department (Why should I have to get a PO before ordering something? How does it help the company when I can't immediately order something I need?). Our job is not to help you be more productive in your job. It's to help the company be more productive. You're just a tiny little part of the equation.
If there truly is someone who is (a) knowledgeable of computers, (b) appropiately cautious of installing unknown or unlicensed programs, (c) reasonable enough to not blame IT for all of his computer woes, and (d) wants administrator access (and his manager doesn't care) - then I'll usually give it to them. In most cases, this guy also becomes my go-to guy for the department - which saves me from visiting for little issues.
If you truly can't do your job because of restrictive policies (note that installing WeatherBug and AIM does not constitute doing your job) then you should explain your situation to your admin, your manager, and your admin's manager. If nothing gets done, then noone thinks you need admin access to do your job. Live with it.
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:3, Interesting)
Who made your stupidity MY problem?? (Score:3, Insightful)
Here's what I'm tired of...
-------
15 hours spent tracking d
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:3, Informative)
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:3, Insightful)
If having them locked down costs the company less, then guess what - you get to put in change requests for that software install.
Re:LAN Admins don't make money??? Are U crazy? (Score:3, Informative)
Exercise: Let's spin you off as a separate company. How long do you keep getting paychecks? What's your revenue stream? Don't have one? Then you're not MAKING money.
You are a SERVICE, and an EXPENSE. Certainly it's a necessary one, but if it weren't, you'd be on the street in a second.
Re:LAN Admins don't make money??? Are U crazy? (Score:3, Insightful)
You pay $100,000 per month for our services. We guarantee service will work no matter what, or you don't pay. Your regular package is a web server, some file servers, and 100 desktops. The desktops have access to the 'net and an office suite.
If some worm comes along and starts deleting the office suite and clogging the 'net connection, our revenue stream is on the line. Stupid users would then be cutting into our bottom line, and we'd have no choice but t
Because people need to work.... (Score:3, Insightful)
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:5, Insightful)
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:3, Insightful)
Because not every company is employing a bunch of idiots. Some users actually NEED to do things that are out of the ordinary.
If anyone has a complaint, tough.
IT's job is to secure the computers, but not just for the sake of security. It's to secure them so that people can do work. If you only care about one part of your job, that's a really good way to lose the rest of it.
I recently read an article w
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:5, Informative)
and doesn't the great grandparent (first) poster read like astroturf?
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:3, Interesting)
I found out I got my system reineffective just from watching a mpeg of porn.
The stream was infected and using buffer overflows to execute and install itself in the system registry.
No problem under FreeBSD since its mpeg libraries are safer with some of the holes fixed.
Its just insanse what these applets using javascript use to get themselves installed without the user knowing.
A policy will not prevent the overflows since
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:5, Interesting)
I hear completely where you're coming from, but you're only talking about the side that you see.
Locking people down, while it may well be a desirable solution because of the shite that is MS, very often leads directly to lost productivity that affects many more than just "folks that like to use their computer to screw off all day". In many cases, the problem is made worse by unresponsive IT departments who have an inbuilt superiority complex and think all users are jerks. Well, many users are jerks, but guess what - if they can't do their jobs, they cost their employer money, normally in a way that IS is utterly unaware of (and probably couldn't give a shit anyway).
Recent examples at our clients (we provide our system as an ASP, not least to avoid the claws of those freaking MS bastards, but as you can see we are still the victims):
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:4, Interesting)
This problem is just lazy IT. If they can't take 5 minutes to add an HP scanner then you've got the wrong guys in IT.
2. Customer B wants to use our system - its an ASP after all, no software to install - but their procedures for gaining web access are so cumbersome that it is simply impractical to give wide access throughout the business. More lost $$$, to us and them.
Again bad IT practise
3. Customer C has their image locked down to Office 97 because of various (no doubt valid) MS problems. Users are unable to handle incoming documents written in later versions of Word. IS has no solution apart from waiting until 2006 for a company-wide upgrade. (Yet, strangely enough, the IT dude has Office 2003 on his OWN desktop)
And again, if there's a valid reason to upgrade office and it's showing up multiple times perhaps IT should either distribute a newer image w/ Office 2003 or perhaps OO.o, alternatively they could just have a copy of Acrobat on the IT network so any incoming Word documents can be sent to them for conversion to something that can be read by the current image.
I've administered networks as well as used rather locked-down networks. The problem with locked down networks in my experience happens only when the IT guys are too lazy or stupid to make changes. Any idiot can lock down windows. It takes someone with more intelligence to actually allow the useful while blocking the harmful. As long as the IT department is large/trained well enough for the number of seats it really shouldn't be a problem.
Kleedrac
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:4, Interesting)
These would be true statments should the company in question be small - several hundred employees. It's a whole different deal in a large company. In a large company (thousands or 10's of thousands of emplyees) IT policy is often designed such that the (inadvertant) end result is: slow. The overriding concerns in large-company shops are things like security, audit, documentation, repeatability. In an IT shop supporting a large user base, the CIO is often more of s business type than an IT type. Hence lots of compromises, negotiation, changes in direction. Couple that with in-house development efforts and one often gets re-work and that translates into slow.
It's darn near impossible to be large and nimble.
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:4, Insightful)
Jeremy
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:4, Interesting)
This problem is just lazy IT. If they can't take 5 minutes to add an HP scanner then you've got the wrong guys in IT.
Interesting. You attribute following policy to laziness. Since there aren't enough resources to go around installing HP scanners for everyone and supporting the associated software, the department has made the decision to support a single centralized scanning infrastructure. Unfortunately, they made this decision at a time when OCR wasn't an issue. Generally, the $200 HP scanner isn't going to be an isolated case. Once one is deployed, there need to be others. Now the IT department is forced to support several additional devices and new software. Oh, and while they are providing this additional support, the CFO is busy taking three more people out of their headcount. In a situation like this, the proper solution is for the IT department to follow policy and request that the person who has the need escalate through their management. If it's important enough, it will reach the CEO, who will tell IT they need to provide this service. At that point, they can force the CFO and the CEO to sit at the same table and decide whether its more important to provide this piece of hardware or to reduce the IT budget. Now, if IT hadn't locked down the system and employed this practice in the first place, guess what would have happened. The requesting department would go around IT to buy and install the scanner, and IT would have still ended up supporting the thing.
Again bad IT practise ... think of an IT department run by intelligent IT guys not lazy management types like you're describing.
Again, you've attributed draconic procedures for gaining web access to laziness. What you are missing is that such decisions rarely come directly from IT, and are instead a direct response to a requirement from the CEO. Just like the previous situation, the issue would have to be escalated. The CEO will either approve, deny, or realize that he needs to change his requirements for IT.
And again, if there's a valid reason to upgrade office and it's showing up multiple times perhaps IT should either distribute a newer image w/ Office 2003 or perhaps OO.o, alternatively they could just have a copy of Acrobat on the IT network so any incoming Word documents can be sent to them for conversion to something that can be read by the current image.
Again, somebody has to support this, and most IT budgets are yielding their dollars up to the Marketing budget. Although, I like the idea of a copy of Acrobat because it would then possibly require only one resource within the IT department.
The problem with locked down networks in my experience happens only when the IT guys are too lazy or stupid to make changes.
No, most locked down networks happen when the IT department is afraid to make changes. Usually this is because the CEO or CFO puts very heavy restrictions on them. Remember that 80s and 90s buzzword, empowerment? Well, we all laughed back them because we knew it wasn't true. It's obviously not true today either.
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:4, Interesting)
Why wasn't IT involved in the requirements discussion of your ASP solution? Who did you think was going to be implementing the client side of the solution? A lot of issues could be solved easier if IT was asked for advice before a problem arises. Instead, departments make (sometimes) dumb IT-related decisions, and expect IT to implement them.
Sounds like a department or group of people within Customer B wanted to use your system. Once again, it doesn't sound like IT was involved at all. Nor does it sound like the company as a whole wanted it - or they would've worked with IT to get access to it.
AFAIK, Word 97-2003 have the same file format. Excepting some possible formatting issues, reading the documents shouldn't be a problem. However, realize that an Office upgrade is a huge expense in terms of both time and money. Expecting IT to jump to fulfill your requirements on their existing budget is a bit unfair.
Just because you, understandably, see your solution as the greatest thing since sliced bread doesn't mean IT or the company as a whole does. It would seem that IT, and the executive management, were either not made aware of the business need of your solution, or felt it was not worth the impact on IT's budget and responsibilities. Perhaps involving IT in your next client discussion could point out these issues before the ink is dry.
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:5, Informative)
There are incompatibilities between the paragraph and character styles and the numbering mechanisms among the versions of Word you talk about (97/2000/XP), and going back and forth among them is a sure way to almost-irremediable document corruption. As a corporate-law attorney, my wife runs into this problem all the time.
Word can't deal with it; the commercial product for cleaning up the mess runs $5000/seat and many law firms consider it well worth the price. (Or you can use the industrial-strength .doc-parser found in abiword or
OpenOffice.org:-) .)
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:3, Interesting)
I admit to being somewhat clueless, being that Office 2003 is covered under our site license (which is dirt cheap, due to gov't status) and I don't use Word ver
Re:Yea you are really safe keep telling yourself t (Score:3, Funny)
Although you make a salient point - use of IE at all is a risk in any IT organisation.
To an extent locking down a workstation is effective when using IE - most (not all) spyware is derived from popups and click-here's that launch as a result of the very flawed design of MSIE. Locking down the WINNT or Windows folder will prevent these spyware articles from installing correctly. This does offer a good degree of protection fr
Re:Webroot Spy Sweeper Enterprise and Lavasoft too (Score:3, Informative)
Better yet, use group policy. Go to User Configuration\Administrative Templates\Windows Components\Internet Explorer and enable these policies:
Disable changing homepage settings
Search: disable search customization
Re: Those are after the fact solutions. (Score:5, Informative)
1). You can do a few things, namely locking the computers down using the Microsoft Policy Editor (as I am sure you are aware of it's existance).
2). Make sure that no user has administrative access, and that downloading / installing programs is not allowed - if they need programs, that is what their roaming profile is for.
3). Also keeping a image available of every system so that you can restore to a known good working point
4). Invest in a decent SAN and keep the roaming profiles there, ALL documents should be kept on the SAN / roaming profile so that re-imaging the computers when they do get things on them does not cause valuable work to be lost.
Perhaps suggest hiring a freelance IT guy who knows how to do such things if you do not, there are plenty here who need the work.
If you can get to the control panel, display settings, look in the C: drive, change IE options, etc, you're doing things wrong, it's not locked down enough.
Yes it's a pain for the users, but it does alleviate the potential of corporate espionage (don't beleive it doesn't exist, it most certainly does) and also spyware/adware/etc screwing up your computers.
These are just the basics but it's worked fine for the company I work for, after some user adjustments it's actually not that bad. The only thing you loose is the storage on the clients, and possibly a big investment in a SAN ranging from 1TB on up, which can be moderately expensive.
you mean... (Score:5, Informative)
DeepFreeze = best. prog. EVER. (Score:5, Informative)
Re:DeepFreeze = best. prog. EVER. (Score:5, Interesting)
1) set up windows on half the drive
2) install a small version of linux on the other partition
3) make an image of the windows drive that is stored on the linux side
3) I set up some rudimentary scripting that worked with lilo boot options.
Normal operation is to boot to Linux, then extract the windows image over the windows partition. It then reboots. You can feed lilo an option to override its default boot option and go directly into windows. On next reboot, you go back into linux.
I even set flags where you can turn off the auto-rebuilding, set it for daily rebuilding only (first boot of the day), or make it strictly manual "your computer is goofy? Okay, reboot, and select rebuild. Get some coffee and come back".
As another poster said, you do have to turn off all the auto-updates because they'll continually trigger. But it is so nice to not have to tend to the machines until you want to do those updates.
I don't have the setup on a website, but if you're interested, send an e-mail to username dfrakes at the new google email service. I'd be glad to send my scripts along along.
We had a lab of win98 boxes - all PII-300's or less that would rebuild their 1.5GB windows image in about 11 minutes. I used tar/gzip for the image, but it can work just as well with dd/gzip and may even go faster. In that case, the smaller your windows drive, the better your performance will be.
It was great in an academic computer lab where the users shouldn't be messing with things!
Re:re-imaging (Score:3, Informative)
Now you're ready to do a dd if=/dev/source_partition of=my_image.img
When you zip the resultant img, it will compress much more because, instead of random data on the unused parts of the drive, it's just a bunch o
Re:DeepFreeze = best. prog. EVER. (Score:4, Informative)
I hope this helps! If you find any mistakes, please feel free to contact me. If you find it really useful, I'd love to hear about it.
I'd release this under the GPL, but darn, it just doesn't seem like there's enough there to bother. I mean... can you really GPL some config scripts?
I found it helpful to configure the Linux stuff on one computer, then using a bootable Linux CD (I didn't want the local box slowed down by unnecessary services like networking), I put it on a server, called lin.tgz. I then booted on another machine with the bootable cd, and applied it to the
Good luck!
Linux Rebuilder
By Dale Frakes
Write-up version 0.1, 19 October 2004, 4:17AM
This set of tools helps automate the process of keeping a Windows box with a consistent image. It works similarly to "Deep Freeze" by storing an image of the Windows system and all its software on a Linux partition. The computer boots into Linux, which restores this image to the Windows partition (overwriting whatever the user did before). It then reboots into Windows.
** Installing/Setup **
The scripts as I have written them use tar/gzip to make the image of the Windows partition. This is because I was working on Win98 boxes that use FAT32 (which Linux can easily read and write). Linux does not yet reliably write NTFS, so to use this on an NTFS based Windows system, such as Windows 2000, or Windows XP, the scripts will need to be rewritten using dd/gzip rather than tar/gzip.
Here are the basic steps:
1) Install Windows on your computer. If you are using one drive, partition that drive in half (or, if you know how much space you'll need, just a little more than that). Install all your applications and customize the Windows "image" so that it is exactly the way you want it to be each time you reboot.
2) Install some Linux version on the other half. Keep it small, since you won't need networking, X, or much else.
3) Create a
4) Modify
5) Modify
6) Create a
For FAT32 systems using tar/gzip, you'll need to add an entry to your
** Useful Points **
There are two main keys to why this thing works pretty well. First, lilo can invoke the same kernel with different options. The menu options I place in lilo.conf do this. The other key is contained in the win_reboot file. By invoking lilo with the -R option followed by a boot label, (eg. "lilo -R Windows"), lilo will override its default boot option on the next reboot.
There are two other nice features that work nicely. The first one is that while the kernel is loading, the keyboard cannot interrupt the process. This is great for keeping someone from hijacking the system. The second is that by putting the line "password=""" in lilo.conf will password protect the boot options that do not have a "bypass" in them. This allows the user to do some things, like boot directly into Windows, or even rebuild the Windows partition, but not make a new image of the Windows partition.
If you're going to do a dd/gzip option, you'll want to wipe your Windows partition's empty space. From the documentation for g4u, there is a link to a program called nulfile, which will fill up the empty space with 0's. http://www.feyrer.de/g4u/
(If you like imaging, check out g4
Re:DeepFreeze = best. prog. EVER. (Score:5, Informative)
A somewhat better way to handle the freeze/thaw thing is to run your updates weekly and cycle the machines on the weekend. If you're really worried about your users losing data you can search their machines (via administrative shares, in an automated fashion) for documents modified in the last week and shovel them into a separate folder on the permanently thawed drive.
Don't let'em in. (Score:3, Informative)
Re:Don't let'em in. (Score:3, Insightful)
Yes, you could also filter outgoing packages, neatly making the spyware/adware useless, but I've seen spyware that killed a computer's internet connection if it couldn't communicate with its home system (on a user's computer in college, which was a pro
Re:Don't let'em in. (Score:3, Informative)
http://www.squid-cache.org/related-software.html [squid-cache.org]
http://sites.inka.de/sites/bigred/devel/squid-filt er.html [sites.inka.de]
There is a proxy called Privoxy [privoxy.org] with some advanced filtering capabilities.
the newer AV's do (Score:5, Informative)
Windows XP and Serice Pack 2 (Score:2, Interesting)
Ever since I have installed SP2, Ad-Aware from Lavasoft has not found one spyware program -- even after installing the worst offending sites - porn sites.
Re:Windows XP and Serice Pack 2 (Score:3, Funny)
Thank you for taking the risk of testing that so that others won't have to.
Symantec (Score:3, Insightful)
Easy and cheap (Score:5, Funny)
If someone needs to access a site, have a system where they can request a site to be opened for access. Of course they will need to have a valid reason and you (as network admin) have final say as to letting them have that access or not.
The www is something that can be surfed at home on personal time. Work is for work.
Re:Easy and cheap (Score:4, Insightful)
Others realize that computers are tools and that disabling web access makes them worse tools. They know that their job is not to find ways to make their own jobs easier, it is to make other people's jobs easier.
Kudos to the story submitter for being one of the type that wants to do his job right.
Dancin Santa, fuck you and all others like you.
Re:Easy and cheap (Score:3, Funny)
Re:Easy and cheap (Score:5, Insightful)
Many other people have pointed out the value of being able to surf sites for work-related information (booking hotels, looking at competition, finding reference materials, finding suppliers/products, finding potential customers, posting job listings,
There are other ways to prevent misuse as well, rather than blocking port 80 - block specific sites (ie, hotmail) and/or use content filtering to stop people from looking at pr0n while at work. Keep in mind that these can be detrimental - at a health care related job, for example, there will be legitimate reasons to look up legitimate sites that will be blocked by content filtering.
One thing that has been shown (I know I've read articles about this before, unfortunately I can't find referencse) is denying people "personal time" at works leads to an increase in sick days and other time off. Basically, if you don't let someone spend half an hour doing something personal while "at work", then they end up just taking an entire day off to get what they need done. This is my take on the matter, and I don't block any sites on our connection. (and no, I don't consider pr0n to be a legitmate "personal" use of time, but we're also a small company and no one really has much of a private office to use..)
Re:Easy and cheap (Score:3)
I am the company network engineer. And the Security Officer. If you know how to discern legitimate traffic from 'bad' traffic over an allowed port, please, do enlighten us all.
And do it as something other than AC. I know all about fingerprinting traffic patterns...but won't take any more crap from someone who says 'make my day', while hiding behind an AC
Re:Easy and cheap (Score:3, Funny)
Easy (Score:5, Funny)
Get spyware, get shot in the head. After two or three pluggings in front of coworkers, NO ONE will get on the net period, or even check e-mail.
Harsh? Yes. Effective? HELL YES!
Obvious solution (Score:2, Informative)
Re:Obvious solution (Score:5, Insightful)
There is no god damned Access for Linux either. Heres a newsflash a lot of companies have database frontends that rely on Access, it may not be the best solution but it is the current system and to change it would cost thousands of dollars.
Like it or Loathe it Visual Basic is used throughout many companies. Please correct me if I am wrong but do any Linux office products work with Visual Basic?
These are just a few of the many examples why you couldn't just switch to Linux like that. Those are just the software factors too, forget user training, the cost of changing hardware that isn't supported to Linux etc.
What about thousands of pissed off users because they can't figure out why the hell the start button looks different or why text on the screen doesn't behave as expected.
I'm not trolling, I like Linux I think it is great for the home and for a hobby but its just not ready for the mainstream. Perhaps in a few years, but not today.
Actually (Score:4, Interesting)
I believe Spybot does protect you ("immunize") from around 2000 different pieces of software, if you let it.
Yes... Pest Patrol and Spy Sweeper Enterprise (Score:2)
Some hints (Score:2, Informative)
* Use a proxy
* Use Firefox instead of IE
Re:Some hints (Score:3, Insightful)
Top bras simply did not want to pay to replace those computers.
As far as firewalls go, things still slip through, and once they do, what then?
And firefox only stops most automatic installs, it still won't keep Joe Idiot from downloading Bonzia Buddy...
I have it (Score:2, Funny)
We have all of the software you need! Just tell us what you want the software to do, give us the name of open source software that already does the task, and in three weeks we will have a brand new software package *just* for you, for the low low price of $50! Unfortunately, our website is down because of high traffic and hackers. Still, you can view videos of the as-of-yet-non-existant software here [nowhere].
14" monitors (Score:5, Funny)
When a user has to make a decision between h4rdc0r3 p0rn and a 6" monitor, they might be a little more proactive in preventing spyware!
Software Restriction Policy (Windows XP) (Score:5, Interesting)
you can still play the game (Score:3, Insightful)
You need the support of your own management, and a evil+political person to prepare the very thorough document describing all the problems caused by $stupid_app. Don't be afraid to estimate costs incurred by the incident.
If management finds their own nuts in the wringer because of a dumb decision, they might not sign off so qui
yeah (Score:3, Informative)
Top it off with a local DNS that nulls known ad sites and spyware supplies, and you should be good to go.
Sounds like the same problem we face (Score:5, Informative)
We're currently taking a two-pronged approach. First, for the big baddies like Gator or Bonzi, we use Altiris Notification Server [altiris.com] to find them and block their execution. This works tolerably well, but it's a reactive process--for me to block a spyware app, I have to know about it, and it has to be something of which I can deny exeuction (so, no browser helper objects).
Second prong is a managed install of Spybot S&D--we're enterprise licensed and maintain our own update server. We stick Spybot S&D in our base loads and force it to run on a schedule, automatically updating itself and running non-interactively. This catches lots, but can sometimes interfere with the users' work.
There is also an ongoing user education effort, consisting of mandatory training and constant reminders about how spyware works and how one gets infected, but that's about as hopeless as bailing the ocean with a kid's toy bucket. I'm long past the point of hoping that the general user population can learn about how not to get infected with spyware; I'm resigned to spending the rest of my days hearing about how someone in Marketing was hitting the gambling sites at lunch and picked up yet another malware app.
Win2K or XP Pro, and Limited User Accounts (Score:3, Informative)
Limited User accounts also provide the best AV on Windows, second only to MS Office SP3 and later which block bad e-mail attachments, bad macros, etc by default.
Finally, stand-alone NAT routers that act as firewalls keep worms out.
Worried that your software won't work as a limited user? Harass the vendor. Go to their competition. Loosen up security on individual files and folders (hence, suggesting XP Pro instead of XP Home). Test, test, and test some more. You'll save hundreds if not thousands on annual AV subscriptions and catch new threats before the AV vendors (and Spybot / Ad-Aware) can.
Heretical advice??? (Score:3, Informative)
FFox (Score:3, Interesting)
The truth of the matter is Mozilla does indeed prevent quite a bit of malware from entering your computer.
Oh well, I'm sure this will be modded 1 - Redundant
The layered onion approach... (Score:5, Informative)
The first step is to put in place policies (where possible) on domain controllers that prohibit both the installation of BHOs and of other software by anyone other than Administrators. Given that many, many bits of spyware (I'll go out on a limb and say most) work as (so called) "browser helper objects", don't let people install them at all. Other software Administrators can install when needed. It's actually fairly easy to do.
Second, where possible, deploy W2K or XP, and...
Then, third, where possible, yank people's admin privs. In virtually all cases, with a bit of good ol' trial-and-error, you can successfully adjust users' permissions to take away admin from most folks. Let's face it, most people SHOULD NOT have the ability to have admin on their own machines.
Fourth, where possible, dump IE.
Fifth, do some short SMALL GROUP tutorials about the evils of spyware and how it works. (I found this to be surprisingly useful for teaching users about passwords.)
Sixth, where possible, dump IE.
Seventh, consider netbooting the workstations and storing users files on fileservers. That way the OS you give 'em is the OS they get and it's always the same every day. (Tell them to think of it as life imitating art as in "50 First Dates", where they get a fresh start every day....)
Eighth, where possible, dump IE.
Ninth, go with something many of the folks here have/will recommend in terms of enterprise-based anti-spyware/anti-virus/anti-?????? software. I used Norton Corporate Edition in a fairly recent gig, and while that particular version didn't check for sypware, there are a number of solutions others are proposing that will. (The Corporate Edition is critical to your sanity--you can manage the AV software on *all* desktops via a central console.)
Last, and not least: dump IE.
------
Did you pay for it? (Score:5, Insightful)
My guess is that like most companies you installed them without paying because you didn't have to fill out forms or break your budget. Now you are looking to pay somebody else for software after using their products for all this time.
Just doesn't seem fair.
Is this a company? (Score:3, Insightful)
- Obnoxious, nazi-like filtering at the proxy level.
If people want to surf or play games, suggest they seek another job.
Lock 'em Down (Score:3, Interesting)
Do all the computers (or even most) really need to be able to install applications and such? Is that really neccessary? Lock them down! Lock them down TIGHT so the users can't install stuff. Lock out all internet access (through a proxy or something) for any computer/user that doesn't need it for their job. Use something like Ghost or DeepFreeze to restore computers nightly/weekly/whever there is a problem. That way, even if something DOES get installed, it will be gone when the computer is re-imaged over the LAN (overnight, perhaps).
And don't forget the users. Not only do they need to be educated, but put some kind of penalties on them for getting spyware installed. Give them one "warning", then after that start doing things. They lose internet (if possible), they get docked a little pay/vacation time/sick days, something. You'd obviously have to talk to a lawyer to make sure it's legal and such, but when it becomes the user's problem too, they'll care a lot more. Another great suggestion is this. Is there some kind of message of the day or builten board or something? Post the names of repeat offenders on it for a few days after each incedent. That kind of publicity can work too (again, make sure it's worded in a way that can't get you in trouble, check with the law guys).
Through removing unneccessary premissions, restoring the OS, and just plain old humiliation... you can make your spyware life easier.
Man... (Score:3, Insightful)
Thin Clients (Score:3, Informative)
Single point of control (at least per server). Save insane ammounts of money.
xterm (Score:3, Insightful)
spywareblaster (Score:4, Informative)
easiest solution (Score:4, Funny)
There's no reason for most people to need access to the whole internet at work, other than work would really suck if I actually had to work instead of sitting around and reading Slashdot.
www.pestpatrol.com (Score:3, Informative)
-sid
Deny write access to the registry. Whitelist BHOs (Score:5, Informative)
No user can write to the registry in the common spyware places. All access to write to the ares of the registry that is commonly attacked by spyware is removed by GPO. That is - no unapproved shell extensions, no BHO add access, no new Explorer bars, no ability to modify the Winsock32 stack, no install priveleges. All apps are deployed through GPOs. There is a white list of approved ActiveX in general and BHO controls.
Spyware usually requires BHO access to tap into IE. Removing that access is good. White list enables the ability to provide desirable BHOs, such as Google and Yahoo bars, as well as internally developed apps.
EnCase Enterprise (Score:3, Interesting)
The Enterprise version takes forsensics a step further, utlizing a client listener app which runs on the desktop and after establishing a baseline of permitted apps, can be used to detect and counter malicious apps running on the LAN and WAN as well as imaging drives realtime for investigative purposes.
Investigations have been performed from halfway around the world with the click of a button. Another selling point to the PHB's is that it can be used for HR investigations as well, making it an easy ROI for most companies.
http://www.encase.com/ [encase.com]
windows admins (Score:4, Insightful)
What do you do to avoid catching the flu? That's right you get a flu shot. So do yourself a favor and get a flu shot, install mozilla on the clients everyone will thank you for it anyhow.
Ban their certificates? (Score:5, Informative)
First, I attempt to download the spyware much like any user would. When I get the prompt asking me to approve this installation, I view the certificate that it was signed with and save the certicate to the file.
Next, I add that certificate to the list of banned certicates domain wide. It works great and fixes the problem of people installing spyware without knowing it.
Well, I rather think it's simple. (Score:4, Informative)
If the user reports problems, VNC into the machine, run HijackThis as root, and remove what you need to.
Running as User or Power User will help, but it won't stop everything.
Try adding the MVP Hosts list to the firewall's shit-site blocker.
If you can, put SpywareBlaster into your image set for the machines you clone and force a once-a-year reclone with updates.
There's also the simple idea of not letting your users use IE. Force them to use Firefox, Opera - anything but IE.
Technical solution useless w/o policy 2 back it up (Score:4, Informative)
"Frequent-fires" users will be compelled to learn some digital hygine.
Most large and medium-sized businesses operating today have some sort of policy on sexual harassment/hostile workplace/conflict of interest/Internet and PC usage policy, etc. Generally, users understand that these policies are for eveyone's protection - With ~2000 PCs in the mix... This is definately where you should start... Policy Covers Your Ass.
On the technical side:
1. Router logs, intrusion detection, and sniffing as trending tools to show your boss what's up with traffic.
2. Good, solid desktop images/ app pushes/ GPO's - harden the Registry, Security Policy, individual apps as necessary. Beyond that - when a machine is sufficiently infected, it should be replaced with a re-imaged one --- it can be faster than cleaning, and is a hell of a lot more complete. This also reinforces the notion of users not storing important things locally.
3. Helpdesk tracking software - What users/machines/network segments are continually having the same problems? Does Human Resources need to be the next step for some people?
4. Desktop management software - provide your boss with stats on just what kind of crap is showing up.
5. If you must use/develop software that may enable or even contain spyware, you have a particularly tricky problem that concerns both company policy and IT best practices.
Of course, you know your boss, I don't... How you implement these suggestions is different for everyone. To some, it may seem draconian, to others, quite lax.... To some, budgets will not allow the necessary attention - for others, this kind of focus could perhaps justify a budget increase.
Oh... And consider the broswer's role in the business - what is an acceptable $$ loss for a preventable issue? Have you already spent that?
My $.02
Re:Easy solution (Score:5, Informative)
Though this is a quick way to get a "+5 Informative", it is not a valid solution to most Adware/Spyware/Malware exploits. The majority of this software is installed as part of another application. For instance, the notorious "Internet Optimizer" and "Gator". Running FireFox does nothing to stop an ignorant user from falling for a snappy ad and installing something bad on their workstation.
I'm not defending IE, I'm just pointing out how it does not apply in this particular case and Mozilla will, by no means, be the end all of web-related tragedies.
Re:Easy solution (Score:3, Interesting)
There are however more issues then this. For example firefox's cache is stored in the wrong directory in your user profile so if you have the standard 50 meg cache and log onto another computer you have to wait whilst it copies across.
Why Mozilla/Firefox is a good partial solution (Score:4, Funny)
Because pop-ups can be disabled in Mozilla/Firefox, said users never see them and therefore are far less likely to install the crap.
Lets not forget the tradition of there being a new remote exploit discovered for IE every couple of weeks.
I do IT support in an academic environment and I've found that just hiding IE's presence on a system and replacing it with firefox means that I'm far less likely to have to deal with some security issue on that system again in the future.
My steps to securing an XP Box:
0) Optional: Install SP2 if possible/safe
1) Turn on the firewall
2) Set the system to auto-update
3) Install good AV software and set it to auto-update and scan the system each day
4) Get rid of IE
5) Get rid of MSN messenger
6) Cross your fingers
7) Pray
Optional:
8) Sacrifice Chicken
Lee
Re:Sacrifice Chicken (Score:3, Funny)
The optimum cerimony changes involve using the grease form the paper bag in leu of the standard chicken blood and doing all requisit latin chanting with a strong nasal drawl
Re:Easy solution (Score:5, Informative)
Because that computer thing is meant to be USEFUL
Re:Easy solution (Score:5, Insightful)
Re:Easy solution (Score:3, Informative)
Re: Consider removing IE completely (Score:3, Informative)
Many vulnerabilities in Windows aren't so much in Windows itself, but in IE (or Outlook, or ...). Some of those flaws can be avoided by not using IE, but some more may be avoided if you have IE not installed at all.
By default Windows doesn't allow IE to be uninstalled, and MS once claimed it would render Windows unusable. Tools found on above website prove otherwise. You can also use these to remove other unneeded Windows components.
Fully removing IE may have some drawbacks, bu
Re:Easy solution (Score:5, Interesting)
Methinks it says much more about the people who utter the phrase than it does about the systems they suggest are inherently equal.
Re:Easy solution (Score:5, Funny)
Oh wait. Never mind.
Re:Easy solution (Score:4, Insightful)
You also still have to exit and restart the browser every few days as it tends to get sluggish after a while.
Re:Had to be said... (Score:3, Insightful)
Re:Securing insecure systems? (Score:3, Insightful)
Whether you choose Mac OS, Linux, BSD, Irix, Solaris, VMS, or the Amiga obviously depends on what sort of apps your users need, but most everything can be done without Windows.
Some people will tell you that Total Cost of Ownership i