Block spyware and malware by locking down the computer & Registry? 1

[GVN]

Is there a way to block spyware and malware by locking down the computer and Registry, instead of buying software to remove it once its already on there, or letting the software try to actively block it? I haven't had too much luck keeping 100% of my machines clean on our network... I would rather lock or modify the OS instead of buying more software that may or may not work.

GVN

 

[Grenage]

You'd be surprised how many registry entries are written or modified while you do the most basic of things. A good start is not using the computer as an administrator, but on a basic user account. Permissions in the registry tree can be changed using regedt32, but I'd think very carefully about whether you want to do that.

Educating users can also help a lot. An ounce of prevention is worth a pound of cure.


Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[GVN]

I agree with you, however most of this stuff we keep seeing on the machines is getting pushed or installed silently without their knowledge. Many aren't even aware of it being on there, but call me because of performance issues or their computer just acting abnormal.

GVN

 

[GVN]

Carlsberg beer? LOL

 

[Grenage]

That's right, Carlsberg beer

I know this is not an option for a lot of companies, but have you considered an alternative web browser? I personally find Firefox to be excellent at resisting software installs (most of which are admittedly down to users accepting options that come up, just to make them go away).

That said, the latest revisions of IE have been much better at stopping rubbish getting installed!


Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[Stevehewitt]

There's a suprising amount you can do.

Users should be just that - users. If I can do my job as a network admin without being logged on as a permenant administrator so can salesmen. If users only have user access then the registry should be in pretty good shape as default permissions are reasonably secure.

Also make sure you are using WSUS and it's managed correctly. A patched system can do wonders for security!

The obvious such as a decent hardware firewall at the network edge and also turn on Windows Firewall. (XP SP2)

I agree with grenage regarding browsers. Either upgrade to IE7 which appears to be in a much better shape security wise or switch to Firefox.

If things are getting really bad then try a proxy / content filtering. SurfControl / WebSense are pretty good and can help stop a lot of this stuff. We use FortiGate networking products that scan for viruses and malware on HTTP and POP/SMTP which is incredibably useful!

That, plus training/education should be enough.




Steve.

"They have the internet on computers now!" - Homer Simpson

 

[tfg13]

Stevehewitt,
You still forgot one thing. As Grenage states:

Educating users can also help a lot. An ounce of prevention is worth a pound of cure.

If you have the latest stuff, technologically, yes, you will stop an abundance of malware/spyware. However, all that is needed is for someone to click on a nice website, which just happens to have malware. Even though you have the computer locked down (via registry), the stuff (insert your own explecative if you wish) still can be written to HKCU (HKEY_CURRENT_USER). Unless there is a complete re-write of the registry/OS, then I believe this will still happen. We just need to educate our users more, so they understand the "awesome chick" emails they receive with links are not to be followed.

 

[GVN]

Try AntiVir Antivirus:

http://www.free-av.com

Spybot:

http://www.safer-networking.org

AdAware:

http://www.lavasoftusa.com

I'm sure that there are many more, but this is just off the top of my head...

GVN

 

[Grenage]

We use AVG (grisoft.com) at home, and I use their free personal edition at home. I've not had any viruses yet, but then again like most of us here, I'm quite particular about what sites I visit. Sandboxes help a lot, although perhaps not for the average user.


Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[Lunatic]

What are sandboxes? I'm not a security/IT person but I try to keep up on things...

 

[tfg13]

This might be a good read:

http://en.wikipedia.org/wiki/Sandbox_/computer_security/

 

[Lunatic]

Thanks! The name makes sense...

 

[Grenage]

GRISOFT is announcing a new version of the AVG Anti-Virus Free Edition. This new 7.5 version with improved performance and full compatibility with the latest Windows Vista version is available. Users that are using AVG Free 7.1 will be provided with a specific dialog, within the next few weeks, with the opportunity to choose the right option fulfilling their needs. AVG Free 7.1 version will be discontinued on 15th of Jan 2007.

It doesn't appear so, just a new version coming out.


Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[Salem]

Another tool I find useful is Drop My Rights which allows you to run programs with reduced privileges.

--