Call for help - Proactive Malware Steps

[bcastner]

It has bothered me that we on Tek-Tips do not have a good FAQ on proactively preventing infection.

I invite your comments on products, freeware or commercial, that are part of your arsenal to prevent having a malware issue.

A short description of your steps would be appreciated.

Bill Castner

 

[BadBigBen]

Hi Bcastner - Good idea...

PROACTIVE though, the only thing that is running on my system is TeaTimer out of SpyBot S&R and AntiVir 6.28, aswell as using FireFox Browser (less prone to getting hit with malware than IE)...

I've innoculated the PC using SpyBot and Spyware Guard, against ActiveX installs and have used several others, like XP-Clean (Unfortunately only in German) to edit/lock my HOST file against HiJacking...

now after getting hit with a bady (or as a preventive messure) I scan my system at least once a Week, using SpyBot S&D, AdAware SE 1.05, Giant AntiSpyware, and HiJackThis! and have found this to be one of the better combos to use... sofar no serious infections to be noticed...



Ben

If it works don't fix it! If it doesn't use a sledgehammer...

 

[MichealC4]

BigBadBen took pretty much what I was going to say.

I use Teatimer from Spybot, Spybot's host list (adservers.v3.net also has a good list, but blocks some legit sites, such as google's ads), I use Mozilla/Firefox, I educate users as much as I can (including myself) by staying up-to-date on latest viruses and malware, and I also make use of content filtering (which the home user can do as well) which helps protect against known exploits. I also make use of an IPS and firewall to again, block known baddies. And finally, on email, I use spamhaus'es sbl-xbl, to block sites that are known to send out spam and exploits through email. Hopefully you can decipher something out of that. Of course, there is the usual av software. We use McAfee at work.

----------------------------
"Security is like an onion" - Unknown

 

[MakeItSo]

Hi Bcastner!

Excellent idea. I'm using
[ul][li]McAfee 7.1, Weekly update[/li]
[li]AdAware SE 1.05[/li]
[li]JavaCool SpywareBlaster[/li]
[li]SpywareGuard[/li]
[li]HiJack This 1.98.2[/li]
[li]Spybot S&D 1.2[/li]
[li]ie-spyad (self-installing list of restricted sites for ie)[/li]

at my workplace and additionally on my notebook:
[li]ATGuard SW firewall[/li]
[li]Mozilla firefox[/li][/ul]
Although I still occasionally use IE on my notebook too, since firefox won't display all pages correctly...

SpywareGuard runs permanently, Regular AdAware & S&D scans round it up...
Started getting this kind of paranoid a couple of months ago, when I was pestered by a CoolWebSearch...
Fixed it with HJT, re-boot in safe mode, clear all temp folders, re-run HJT.
No attacks ever since! ;o)


[blue]The last voice we will hear before the world explodes will be that of an expert saying:
"This is technically impossible!" - Sir Peter Ustinov[/blue]

 

[jrbarnett]

I've implemented a Win2003 style lockdown on my flatmate's PC using IE6 options. If it seems to work, I'll give details on what I did (will know later this week or early next).

John

 

[spool]

Hello,

I use most of the mentioned utilities. I also have a customized HOST file with a list of garbage sites furnished by.

http://www.mvps.org/winhelp2002/

Updated at least once a month.

Entries marked with Parasite or Trojan comments I
place them in the Internet Explorer Restricted Zone.

spool



Don't argue with an idiot, he will bring you down to his level and beat you with his experience.

 

[confusedlady]

Since I switched from IE to Firefox, I really have much less trouble. I encourage everyone I know to dump IE. Besides that, everything is free.

Ad-Aware
Spybot (tea timer)
Spyware Blaster
HiJack This
AVG (anti-virus)
Sygate (firewall)

All of this info and recommendations was trial/error based on reading a lot at this site!

 

[2ffat]

Even though I've been using Mozilla for years, I am still forced to use IE for some things. As a result I lock IE down. These are simple steps and by no means are they comprehensive but they help. If you are using only IE, this is the minimun, IMHO, you should do.

In IE Properties, select the Security tab. Next hit the Custom Level button . . .
Download signed ActiveX controls - Prompt (I would prefer Disable but there are some situations where they must run, e.g. MS Update Page)
Download unsigned ActiveX controls - Disable
Initialize and script ActiveX controls not marked as safe - Disable
Run ActiveX controls and plug-ins - Prompt
Script ActiveX marked safe for scripting - Prompt
Font download - Prompt
Java Permissions - High
Access data sources across domains - Disable
Display mixed content - Prompt
Don't prompt for client certificate select . . . - Prompt
Installation of desktop items - Prompt (Disable if you never want to install a Google bar, etc.)
Launching programs and file in an IFRAME - Prompt
Software Channel permissions - Medium (at the least)
Active scripting - Prompt

James P. Cottingham
-----------------------------------------
^{To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.}

 

[devastator]

At home i run
Spybot Search and Destroy
Adaware SE
Spyware Blaster
AVG Antivirus
CA PestPatrol 5
SP 2 With Firewall Settings
Enable Firewall settings on Wireless Linksys Router

Run from time to time
McAfee Stinger tool
CWShredder
Track Eraser Pro 5 and Plugins / Run after Browsing

At Work
Pix Firewall
CA PestPatrol 5 CE Scheduled to update/run and delete once a week Workstations only
Norton Antivirus Corp Edition 9 updated daily
HFNETCHKPRO for MS lovely monthly updates
Servers run Spybot, Spyware Blaster, and Adaware

Drew

 

[bcastner]

This is just great stuff.

When I write it up it is slightly unclear as to whether some of these things are duplicating efforts, or possibly can interfere with each other.

I will try to sort and test myself to see something sensible. If you have run across a link that discusses this issue, I would appreciate it.

Bill Castner

 

[MakeItSo]

Almost forgot:

Here is a comparably excellent resource on Spyware/Adware/Virus removal:

http://forums.spywareinfo.com/index.php?b=1

Hope this helps,
Andy

[blue]The last voice we will hear before the world explodes will be that of an expert saying:
"This is technically impossible!" - Sir Peter Ustinov[/blue]

 

[pechenegs]

i use most of the above plus CWshredder. I also use Kerio firewall with sygate, they don't conflict. I use AVG 7 and also have avast 4 which I use as a secondary scanner, but i have it disabled through msconfig. I also use aboutbuster for coolwebsearch probs.

khaz

 

[2ffat]

Here is a good site with some simple (yet important) programs to stop DCOM, Messenger server, etc. See:

http://www.grc.com/default.htm

James P. Cottingham
-----------------------------------------
^{To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.}

 

[greyted]

This will be so useful Bill, good idea.

Have a list of software programmes that I install for people, mostly home users. Some I remove after cleaning the machine but leave items 1, 2, 4, 7 and 8, also ensure there is anti-virus software installed.

Here is my list:

1. AdAware SE Personal

http://www.lavasoftusa.com/support/download/

2. Spybot S&D 1.3

http://www.safer-networking.org/en/download/index.html

3. AVG 7.0. (Free version if they have no anti-virus).

http://free.grisoft.com/freeweb.php/doc/2/

4. SpywareBlaster

http://www.javacoolsoftware.com/spywareblaster.html

5. ZoneAlarm or Kerio 2.15(for more experienced users)

http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp

6. Bazooka (Your recommendation I believe?)

http://www.kephyr.com/spywarescanner/supportus.phtml

7. SpywareGuard (Keeps a very good record of BHO changes)

http://www.javacoolsoftware.com/spywareguard.html

8. IE Spyad

https://netfiles.uiuc.edu/ehowes/www/resource.htm

9. System Security Suite (For cookie, temp and temp internet removal)

http://www.igorshpak.net/

10. GRC (Some good information and utilities here.)

https://www.grc.com/x/ne.dll?bh0bkyd2

11. Bleeping Computers (Tutorials)

http://www.bleepingcomputer.com/forums/tutorials.html

12.Eric L. Howes list for Spyware and Adware removal tools, most comprehensive list I have seen to date.

https://netfiles.uiuc.edu/ehowes/www/soft6.htm

If people show any interest in securing their system I steer them towards a site like Bleeping computers where there are very good tutorials for most if not all of the above programmes.

Now I reach the part I find most difficult, getting users to update frequently. Had a good example today. Had a request from a guy to have a look at his system as it was giving him problems, very slow to boot...

Discovered that he had not updated any of his security software since my last visit in June. My flabber was well and truly ghasted, quite incredible as I left him written instructions on how to perform the updates.

As a last thought, I try to get my people to make a donation for any free software they install and use, most users can afford this expense and willingly donate.




Ted

"The difference between a misfortune and a calamity is this: If Gladstone fell into the Thames, it would be a misfortune. But if someone dragged him out again, that would be a calamity."
Benjamin Disraeli.

 

[bcastner]

Wow,

You guys/gals are just great.

Let me see if a coherent FAQ can be developed.
Consider it a work in process, but I will make a stab at it later today.

Bill

 

[jrbarnett]

Folks, just discovered my flatmates PC has a very serious hardware problem so won't be able to tell if my changes increased the security or not. (You have one guess as to who is trying to fix it)...

Can still write up what I did though and perhaps someone else can test.

John

 

[bcastner]

jbarnett,

I have seen in the last two weeks VX2 variants, where a reinstall is the only solution.

 

[pechenegs]

bill, you can get rid of it using findit and the killbox, it's a tedious process in tracking down the culptit dlls, and the guard tmp file if there.

khaz

 

[Kesser]

All very useful stuff.... thanks people, we have a home network and so have a firewalled gateway machine just for the job as well as many of the applications mentioned above..

I'm going to be coming back to this post a good few times over the next few days I think...

As an addition, I also use Sysclean from trend micro (

http://www.antivirus.com)

which I have found picks up alot of trojans that others miss - you have to use it in conjunction with the latest pattern file and it takes a little while but I have found it to be a helpful tool when used in conjunction with the others..

Great thread guys!

Kes

 

[MichealC4]

Something else I forgot to add:

http://www.ubcd4win.com/

It has some great tools, free, and you can add your own tools to customize your installation.

----------------------------
"Security is like an onion" - Unknown