massa, et al,
I'm sure you all realize the growing threat of
malware and spyware to
Internet Explorer. It has been my experience that
the initial
infection and/or removel of an infection by
anti-spyware products can
permanently damage a windows workstation. This
damage occurs in many
forms and often leads too the workstation being
reformatted and
rebuilt before going back into service.
Having dealt with a great many spyware infections,
I've successfully removed all of those that were
identified with no negative side effects. I've never
had to have a workstation rebuilt.
I think that it would behoove the list and this effort
in general if you could be a bit more specific about
the conditions under which a removal damaged a
workstation. For example, was the removal done by
hand? If not, and a tool was used, which tool was it,
and which bit of spyware was involved?
A recent example is earlier this week, in spite of
content filtering,
a workstation was infected with "wintools",
"mysearchtoolbar" etc. The
tough part of this is that such malware has multiple
instances/threads
and renames system files like msconfig to resist
removal.
Can you be a bit more specific with regards to what
you mean by "system files"? I'm curious about this,
as many "system files" are protected by Windows File
Protection (WFP) from being modified. As yet, I'm not
aware of any spyware that disables WFP before
installing itself.
Also, msconfig.exe isn't necessarily considered a
"system file".
Often
IE/Windows is so damaged it's more time effiecient
to just replace the
box and rebuild the infected one.
Again, I'm not clear on what you mean by "damaged".
My question is this, I'm batting around the idea of
using Group Policy
in our Active Directory to try and choke IE down to
the point where
such Malware has trouble installing itself. Has
anyone here ever tried
such as this with any degree of success?
Other than Group Policy I'm also considering
deploying an alternate
web browser that isnt subject to malware infection
but doing so
complicates my patching/reporting routine for our
security audits.
I look forward to your comments and idea's.
An alternate web browser is definitely a good idea.
Other than that, knowing how malware/spyware infects a
system via the browser is key when developing your
Group Policy. For example, BHOs install via specific
Registry keys, as do most malware.
=====
------------------------------------------
Harlan Carvey, CISSP
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com
------------------------------------------
