Security

Ask something
Discussion Locked

Security Solutions: Remove spyware

0 helpful
22 replies

by discussion

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

In this week's Security Solutions e-newsletter column, Mike Mullins discusses spyware. Do you allow users to download and install freeware programs on your network? What steps have you taken to get spyware off your network?

Here's the links to the resources mentioned in this column:

- Ad-aware Professional
http://www.lavasoftusa.com/

- Gorilla Design Studio:
http://www.accs-net.com/hosts/
(Note: This site was unreachable when the Security Solutions e-newsletter was published.)

* Remember to remove any extra spaces from these URLs before pasting them into your browser.

22 replies

by jellimonsta

We do not allow unauthorized freeware or shareware software on our network. We have written policies and procedures that are enforced to that effect. In fact, we are currently in the middle of a "crack down" initiative to verify compliance of these policies.

by dave howe

We tried a similar crackdown a few years ago - and found it promoted a culture where users would strip off all "incriminating" software before reporting a fault or if there was a authorised upgrade due. I am sure you can see how all those installs and deinstalls from poorly written installers cause enough trouble on their own, without the variety of spyware and outright trojans that get re-installed the second our backs exit though the door.
Instead, we accomodate freeware and shareware as preferred solutions - not only does this save us money, but we can be sure that what IS installed is clean. We maintain a directory of acceptable freeware (and some shareware, with a notice about registration and that licence costs come from *their* departmental budget) and link to it from our intranet; there is also a mechanism where users of packages from the intranet download page can "register" their usage so they can be notified by email of any updates or security patches - which usually one or more of the regular users notify *us* about long before we notice ourselves.
All this really costs us is a little space on the intranet server and a willingness by the helpdesk to listen to "do you have a package to do $FOO" requests and recommend a free (or shareware, or sometimes commercial) package or packages.
The same site lists a page of "known bad" applications - spyware riddled, or just machine destablizing - with a clear, easy to understand paragraph detailing why that particular package is on the embargo list.
on the management side, there was considerable scepticism right up to the point we put dollar values on the "savings" from the free software; it is rare we can't find a commercial package or three to compare to the free one, and saying "we have xxx new installs this month of $FOO, potentially saving the company $xxxx in licence fees" tends to get management interest FAST.

by ar.finders

Spyware; Privacy Act should be enforced against the Companys that invade people's computers. Thanks; Shirley Elton

by oz_media

I let anyone install ANYTHING to the networks I admin. I don't work directly for the company so their breaching any company policies is not my problem. That aside, if people install crap, I get called out (If I can't jump into their PC)and that means MO MONEY, MO MONEY.

If I need to remove spyware I ALWAYS use and recommend Adaware. It is truly the cats ass at catching EVERYTHING!

Yuo wanna screw up your PC and possibly destroy the network? Have at 'er. Just don't forget to call me. :-)

by sgt_shultz

I agree pretty much with OzMedia. But i would never think or say, go ahead, screw it up, make my day. I am there as net admin to serve the customer. the computers are business tools and should just to work the way the customer expects. nobody wants to be restricted out, at least at my companies. i just make sure we have excellent historical backups, good security patch procedures, educated users, and i try to leverage 'freedom' constantly, as in 'because we maintain as user-friendly network as possible, i need you to team with me for security and accept changing your (strong) passwords frequently, always log out etc etc. and they do. i find them very receptive to learning about social engineering etc, wireless issues etc. i find they give me plenty of work anyway and you can't beat the open dialog/trust relationship. they may install stuff but they pretty much ask me first or at least are prompt to 'confess' during troubleshooting. i also engage my customers as much as they like in troubleshooting process. i alwyas tell them i need their help, which i do. i never say 'NO KAZAA!!! we just talk about kazaa and how it works and recommend we don't allow it. or we set it up on a non-networked machine, like that. i try to give them what they want. i think of tight restrictions like the wind blowing on the man with the coat. he just hugs his coat tighter and resists the wind more. i'd rather be the sun, shining pleasantly down until he wants to take his coat off, see? besides, there is no security without physical security and none of my people have locked server room so throw my hands up anyway! just gotta do 'due diligence', have good backups and cultivate good will. my final comment is: the days of being able to cripple the customer into dependancy are over. they are now too sophisticated to put up with that. which is why i can compete at all in this tiny town full of good IT folks.

by leyther

Rather than using Ad-aware, i'd much rather use Spybot Search & Destroy (http://spybot.safer-networking.de). This will find spyware but has also got the added bonus of being able to immunize your computer against future possible spyware downloads. Plus it also has the advantage of allowing u to lock your (or someone elses) homepage and hosts file to stop any hijacking or alteration, and its free.

by bluemoundshandyman

I've used the freeware versions of both Spybot and Ad-Aware. While Ad-Aware has a nice interface, and Spybot's is a little clumsy, for performance, my preference is definitely Spybot. It takes off a wider range of stuff, innoculates, and also quaranteans the removed stuff so if a customer (I'm a self-employed computer tech) just has to have the freeware version of Kazaa, you can put it back on for them.

Don't forget to make donation to Spybot if you use it a lot. It's a great piece of ware.

by puffx0r

I much prefer this over Adaware and such; not only is it completely FREE but its definitions are updated more frequently than other software. Gogo Spybot!

by straffin

LavaSoft abused their user's trust by leaving Ad-Aware 5 un-updated for months. I won't be burned like that...

by robbi_ia

But I recommend Ad-Aware to any of my end-users who come to me with questions about their home machines. Reason? As much as I love Spybot's ability to pick up a wide range of spyware, an untrained user could wreak havoc on their home computer with it. Of course, I have business cards for techs who will happily go to their homes for a fee and run Spybot for them if they ask for it!

by milton

Perhaps I just don't understand what is being offered or how to utilize Active Directory group policy but Mike's comment's suggest I visit every user machine. NO

I want a management console tool I can run from a server and remotely remove and monitor spyware. I wish there were a all in one tool. Antivirus, defrag, anti spyware, installed application monitoring, instead I pay a several dollars for each function for each desktop.

by mike mullins

Milton - I don't advocate visiting peoples workstations. Everything can be done through policy, access lists, good configuration and a centralized software solution. It's just a matter of appying the right balance to fix the problem.

Thanks,
Mike Mullins

by joshua1

I agree w/ a couple of the posts here about administering things on a 'per-pc' basis. It's too difficult. If you can't centrally administer it from 1 interface...it's probably out, *even if it's free.*

Ad Aware Pro "Designed with the IT professional in mind" is $50/client. That's a bit steep, isn't it?

Spybot *is* genius, no doubt! Thanks PepiMK!

by faj

There are really two problems discussed in the article; spyware and blocking access to add sites.

For spyware, there are excellent tools, such as Ad-Aware and SpyBot Search and Destroy. Unfortunately, these are used on individual machines.

As others mention, using policies, not allowing installs, having non-priviledged user accounts,etc. can mitigate the problems.

For blocking access to sites, it seems to me that using a redirect to local host, through the hosts file, is a terribly inefficient way to manage the problem. You will end up with the need to frequently update this file on potentially thousands of machines. For blocking ad sites, I'd use a proxy. That way, you can also find out which sites people are trying to get to.

by jnance

It's not just the corporate servers and/or other computers that are bombarded with spyware. I also find tons of it on my home computers. Every time I browse the internet from home, I run my spyware finding software and find from one to several dozen spyware packages. If you haven't scanned you desktop for spyware, you are probably experiencing a slow down in processer speed. The spyware runs in the background all the time and eats up CPU cycles.

At home I use a free spyware finder called SpyBot. It is really easy to use and extremely user friendly. Also, any spyware it finds is displayed with information that tells who wrote it and what it does. It is available to anyone at Security@kolla.de and other sights. Try it and see if you like it as well as I do.

THANKS!!!
J. Nance

by spamnews

While admittedly disallowing end-users to self-install *any*
application is a good idea if one is trying to create a secure
computing environment, casting aspersions on shareware or
freeware in toto is miss the point.

In fact, MSIE is freeware, last I checked (OK, bad
example!). Seriously, my machines are rife with freeware,
shareware and commercialware, but I would put them up
against secured machines, anywhere. Admittedly, they are
running Apple OSX, so I have a unfair advantage.

There is not much more likelihood that spyware will come
bundled with FW or SW (what *is* the difference between
commercial software and shareware, anyway? Price point?) than
with a commercial product, as we have seen time and time
again.

Let's give the innovators in the open-source community, the
freeware developers, and the smalltime shareware publishers
their due. And those wo develop malware their lumps, as they
respectively deserve.

regards,

by trader369

The challenge is to get a system before the spyware is already on. If the system you want to add this file to is already littered with spyware, then overwriting the old HOSTS file with this one will certainly slow things down or max out the cpu. Be aware of this before attempting this very ingenious idea.

by trader369

The challenge is to get a system before the spyware is already on. If the system you want to add this file to is already littered with spyware, then overwriting the old HOSTS file with this one will certainly slow things down or max out the cpu. Be aware of this before attempting this very ingenious idea.

by jlouis45

i could find two host files in my pc. i edited both the files and put this 127.0.0.1 bad_ad.com but i feel it doesnt work. i could see advts poping up. Any solutions or advice.
regards & thanks - Louis

This discussion is closed to new replies.