Networks

Ask something
Discussion Locked

Do you need some Spyware/Malware help?

0 helpful
23 replies

by themessenger 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Because of the frantic threads created around the latest Spyware/Malware discussion, and the number of emails that I got requesting help in listing ways to block malware from installing, I decided to start this thread. Use it to list information about ways you have found to stop known spyware/malware from installing or to list resources in removing unwanted software. This thread is not a sounding board for Anti-MS "rah-rah". Those are opinions and the facts are that we all are getting paid to support MS software. Let's discuss how to make our jobs easier dealing with it, not "it would be a better world if..." conversations.
With that said, here is some information that I can share.....

Background: 3500+ workstations. 18 different hardware models. 90 remote locations on 256K or slower WAN links. All PC's are XP SP1. Rolling out SP2 currently.
I have engineered a controlled environment where most (95%+) users do not have admin rights. I am using a single image between all hardware platforms, meaning that I have been able to keep a consistent OS load on all computers which makes management and updates simple. I use a software delivery system (SMS) to deliver patches and software. I use Active Directory Group Policy and file permissions to limit a pc?s local administrator from being able to have full control of a computer. (Local policy can be used but once configured it applies to every user who logs in). With the above environment, we have had only 3 spyware infections in 12 months.

How it works:
I block spyware and malware from being able to install. The first thing that you need to do this is a list of files, folders, and registry keys that are used by spyware/malware exclusively.
How I created this list was pretty simple and sort of fun (in a twisted way I suppose). I ran a PC in an isolated environment that had internet access. This can be a VLAN, Virtual PC, or just dial-up (UGH!), but I would recommend keeping it off your production network. I then looked for web reviews of spyware blockers and websites that had lists of the most prevalent and dangerous spyware and malware. The fun was then trying to get the spyware installed (It is amazing how detailed the EULAs are getting now). Once I got the computer infected enough that it stopped working, I then booted to safe mode and started reverse-engineering the installs.
I then copied the exact folder structure and files to a ?source? folder along with exporting registry keys that I identified. Move that off the computer to another location so that you can review it. Parsing through that information may take about an hour, but you should be able to identify the highest level regkeys, folders, or files that, if blocked, will prevent the spyware from working.
It may take a few times at doing this process to successfully get a list of all software.
With that information, the following is the simplest way to stop infections without policy or scanning software:
In FAT32, create a text file named the same as the spyware's/malware's folder name. Remove the extension and mark the file as read only. When the spyware tries to create a folder, it will error out. While this will work also in NTFS, I recommend using the ability of assigning permissions to folders and registry keys to more effectively block spyware/malware.
Here is some information about my policy outputs and the folders I am blocking. This can be done may ways and this is only one, but I think it is effective and has less impact on the workstation resources versus running a local scanning client.

Group Policy Management
StandardComputer Software Restrictions
Data collected on: 3/17/2005 9:57:56 AM hide all

Computer Configuration (Enabled)
Windows Settings
Security Settings
Software Restriction Policies/Security Levels
Policy Setting

Software Restriction Policies/Additional Ruleshide
Hash Ruleshide
(1.0.3.2)
File hash 8C6333BCA9D358CEC6AEA85B61762565:137728:32771
Security level Disallowed
Description MALWARE - IBIS Toolbar
Date last modified 11/15/2004 3:47:08 PM

(1.0.7.14)
File hash 11B112EB1B0F089E3095047A886A979F:498688:32771
Security level Disallowed
Description MALWARE - IBIS Toolbar
Date last modified 11/15/2004 3:46:58 PM

(1.0.7.14)
File hash 11B112EB1B0F089E3095047A886A979F:498688:32771
Security level Disallowed
Description MALWARE - IBIS Toolbar
Date last modified 11/15/2004 3:46:48 PM

(2.1.0.0)
File hash 475D7D91787FC5F24D0025561DEC9FED:827376:32771
Security level Disallowed
Description MALWARE - GAIN DashBar Installer
Date last modified 11/15/2004 3:34:42 PM

(2.1.1.1193)
File hash EF42E89287AB1038ABC75372C07E7C27:558592:32771
Security level Disallowed
Description MALWARE - IBIS Toolbar
Date last modified 11/15/2004 3:46:25 PM

(2.1.1.1193)
File hash EF42E89287AB1038ABC75372C07E7C27:558592:32771
Security level Disallowed
Description MALWARE - IBIS Toolbar
Date last modified 11/15/2004 3:46:17 PM

(2.1.1.6)
File hash 10631BF83BCE57B9283F3B7B8E121863:193536:32771
Security level Disallowed
Description MALWARE - IBIS Toolbar
Date last modified 11/15/2004 3:46:38 PM

(3.0.1.0)
File hash C811D231D68D33124FDE081E7D13B7E2:688104:32771
Security level Disallowed
Description MALWARE - GAIN PrecisionTime Installer
Date last modified 11/15/2004 3:36:33 PM

Download.exe; 49 KB; 11/15/2004 1:41:19 PM
File hash D38DC616CB1E01880EBF1AC9C80F7851:49152:32771
Security level Disallowed
Description MALWARE - DealHelper
Date last modified 11/15/2004 3:47:47 PM

Fun Web Products History Swatter; History Swatter; FunWebProducts.com; f3schmon.exe (1.0.0.47)
File hash C0EE620D0B59ACA4B0EECD9D2EABAFD9:65536:32771
Security level Disallowed
Description MALWARE - iWON Software
Date last modified 11/15/2004 3:45:05 PM

ide21201.vxd; 5 KB; 11/15/2004 1:40:01 PM
File hash EEBCE32039CDD922F541F346B9018ED6:4720:32771
Security level Disallowed
Description MALWARE - WinAD virtual device driver
Date last modified 11/18/2004 1:23:47 PM

IExploreSkins.exe; 7 KB; 3/19/2004 4:21:54 AM
File hash C3C549AC942AAABFE9D7DBBC29EF08EE:6656:32771
Security level Disallowed
Description MALWARE - IBIS Toolbar
Date last modified 11/15/2004 3:46:05 PM

loader2 ActiveX Control Module; loader2 ActiveX Control Module; loader2.OCX (1.0.0.20)
File hash 0D5D3A178411C9D23CC4D33C7575AE39:62672:32771
Security level Disallowed
Description MALWARE - browser hijacker
Date last modified 11/15/2004 3:56:33 PM

MediaMotor25.exe; 9 KB; 11/15/2004 1:41:30 PM
File hash 42CC5AD668F2F61B83047EE6647E38F9:8544:32771
Security level Disallowed
Description MALWARE - MediaMotor Software
Date last modified 11/15/2004 3:43:20 PM

Popular Screensavers; Popular Screensavers; FunWebProducts.com; f3PSSavr.scr (1.0.2.0)
File hash 7F9361A12B2DFEBEC6C22B52446E3CF8:28672:32771
Security level Disallowed
Description MALWARE - iWON Software
Date last modified 11/15/2004 3:43:45 PM

Search Assistant; Search Assistant; 180solutions, Inc.; (5.12.13.0)
File hash 97D1792F15D0A1F1701002885CFBD981:282624:32771
Security level Disallowed
Description MALWARE - 180solutions, Inc. - Search Assistant
Date last modified 11/15/2004 3:33:25 PM

WinAdTools.exe; 25 KB; 11/15/2004 1:40:01 PM
File hash 4A6186BF553C4C209AC09E6403739D0F:25088:32771
Security level Disallowed
Description MALWARE - WindUpdates Software
Date last modified 11/15/2004 3:42:40 PM

WinRatchet.exe; 18 KB; 11/15/2004 1:40:00 PM
File hash A2825D02AB1A37E0289CD1B2245D377B:18035:32771
Security level Disallowed
Description MALWARE - WindUpdates Software
Date last modified 11/15/2004 3:42:55 PM

Path Ruleshide
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%
Security Level Unrestricted
Description
Date last modified 11/15/2004 3:27:43 PM

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%\*.exe
Security Level Unrestricted
Description
Date last modified 11/15/2004 3:27:43 PM

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%\System32\*.exe
Security Level Unrestricted
Description
Date last modified 11/15/2004 3:27:43 PM

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%
Security Level Unrestricted
Description
Date last modified 11/15/2004 3:27:43 PM

C:\Program Files\Comet
Security Level Disallowed
Description Comet Systems Software
Date last modified 11/15/2004 3:32:29 PM

C:\Program Files\Common Files\CMEII
Security Level Disallowed
Description MALWARE - GAIN, Claria Networks Software
Date last modified 11/15/2004 3:39:06 PM

C:\Program Files\Common Files\GMT
Security Level Disallowed
Description MALWARE - GAIN Gator
Date last modified 11/15/2004 3:38:53 PM

C:\Program Files\Common Files\WinTools
Security Level Disallowed
Description MALWARE - IBIS Toolbar
Date last modified 11/18/2004 1:14:02 PM

C:\Program Files\DashBar
Security Level Disallowed
Description MALWARE - GAIN DashBar Software
Date last modified 11/15/2004 3:40:42 PM

C:\Program Files\E2G
Security Level Disallowed
Description DATA MINER - e2Give
Date last modified 11/18/2004 1:16:37 PM

C:\Program Files\FunWebProducts
Security Level Disallowed
Description MALWARE - iWON Software
Date last modified 11/15/2004 3:39:56 PM

C:\Program Files\Gator.com
Security Level Disallowed
Description MALWARE - GAIN, GATOR
Date last modified 11/15/2004 4:01:57 PM

C:\Program Files\MyWebSearch
Security Level Disallowed
Description MALWARE - MyWebSearch
Date last modified 11/15/2004 3:38:30 PM

C:\Program Files\PrecisionTime
Security Level Disallowed
Description MALWARE - GAIN PrecisionTime Software
Date last modified 11/15/2004 3:40:54 PM

C:\Program Files\Toolbar
Security Level Disallowed
Description MALWARE - IBIS Toolbar
Date last modified 11/18/2004 1:18:16 PM

C:\Program Files\Windows AdTools
Security Level Disallowed
Description MALWARE - WindUpdates Software
Date last modified 11/15/2004 3:42:01 PM

User Configuration (Enabled)
No settings defined.

23 replies

by craig herberg

Very interesting approach. This looks similar to what Javacool Software LLC did with Spywareblaster. Obviously, your approach scales much better to a large enterprise like yours. Just out of curiosity, about how much time did/do you take to develop and maintain this info?

BTW, Spysweeper now contains 73,925 spyware fingerprints.

Keep up the good work!

Craig Herberg

by themessenger

I think it took more time to type up the above thread ... Just kidding.
I would say it took about a day total. A few hours getting infected and backing the data up. About an hour documenting my findings. About an hour putting them into policy.
I have only had to go through this process once after that and only picked up a few small changes.

This process will not get every spyware or malware application, only the worst. This would not be affective for me if the users did not also have restrictions in place for creating new folders in the root of C:, C:\windows, or C:\program files. They also do not have the ability to create registry keys at the root of HKLM\Classes or HKLM\Software.

by craig herberg

"This process will not get every spyware or malware application, only the worst. This would not be affective for me if the users did not also have restrictions in place for creating new folders in the root of C:, C:\windows, or C:\program files. They also do not have the ability to create registry keys at the root of HKLM\Classes or HKLM\Software."

Thanks. I think the above is the key. Also, if you can use a script to regularly clean out their temp folders, it will keep them from getting "constipated."

Craig Herberg

by themessenger

I hope that everyone else updates this post. Although I started it, each tech only sees a small amount of the complete aspect of spyware. Together we should be able to create a pretty good listing of information

by bfilmfan

That should be reposted as an article. Really good information and technique. I, sir, am jealous! :)

by roger99a

When I find a spyware infected machine I run a check on the proxy logs to see what sites their machines have been calling to and block them. It probably doesn't stop as much spyware as your method, but it stops quite a bit and prevents it from updating or communicating with their evil masters. All that you did, that's pretty clever.

by cuteelf

Now, since you started a ball rolling on spyware, regkeys etc..
Is there a way to get a db from a utility and just upload that to your settings?

Could someone, say, dl AdAware, crack it, take the needed info out and use it?
Or is that as much of effort as you have done?

I thought you would have used DeepFreeze on the user's pc's, but, users like to save things. People really get territorial bout their stuff!

by craig herberg

Javacool Software LLC has Spywareblaster, which accomplishes what you want legally. This is freeware.

Craig Herberg

by roger99a

Seems to me you can import settings from IE into the Active Directory as part of a Group Policy. That would allow you to use Spybot's immunization settings throughout the enterprise.

by support

You could still use Deep Freeze and train your users to save their stuff on mapped drive(s). It would make backup easier too. You could also try using synchronized files for their fav's and settings.
Or, how about roaming user profiles? Maybe even mandatory ones.. nothing get's saved then, although you still have the question of fav's.
You could also take the "keep it simple" stance and just tell them that they can save their files on a map drive and forget about the rest.

I took over a network 7 months ago that is a domain and everyone has "user" access. I did a sweep with spybot and adaware just recently and it didn't pickup anything. Limiting user acces is key....if they wanna play as power user or admin then they are going to have to pay ($$)to keep getting it fixed.

by themessenger

If you reverse engineer software like spybot, adaware and others to get their information, you are actually breaking their EULA and the law. Also, those softwares are not free for enterprise or commercial use.
If you want to combat spyware/malware, there is a cost. If someone would create a free database that everyone could use, that would be different, but taking someone elses efforts is not right. The software companies have to pay their bills also. Don't steal their information because you don't want to spend the time.

This thread is a good way to start a list, maybe we can grow it into a website of information. It all comes from you guys!

by cuteelf

Good Point. Didnt think of it that way. The efficiency bug has bitten me again :P

by roger99a

From Spybot's site:

II.d. Use of application in whole
Free use is limited to the application in whole. Usage of parts only, for example the database or the plug-ins, is not permitted.

I suppose what we need is a list if IP's and domains that are involved in spyware that could be imported into IE's restricted sites zone. There are several hosts lists available on the internet that could be a good start.

by themessenger

I have found a glitch in just preventing spyware by removing admin rights from a user. When supporting a non-admin user who has had some failed spyware attempts made on the computer by logging in with an admin account, the computer can have explorer hooks which will install the software once it has rights to do so. Another words, the computer was still infected but the software wasn't able to run successfully, making it look uninfected.

by black_eyed_pea

I would like some input on how to best configure Internet Explorer Zones through a GPO to prevent spyware propagation as much as possible, without affecting functionality for the majority of users.

by themessenger

Though my experiences, I think zones are difficult and tedious to maintain.
Once you have a good security zone configuration that allows web applications that are critical to your business to run, you should leave them alone.
We have found, however, that locking down active-X and Javascript is the best way to block spyware, but disables almost any new site that our users need to go to for proper business functions. Although we could add those sites a the Trusted Zone, that would require us adding sites on a weekly basis, which to me is to much maintenance for what it is preventing.
I have found that you must disable scripting or active-x components, not just setting them to prompt in the security settings. Many times when a setting is set to prompt, I found that it still allows execution of malicious code. Unfortuantely this also disables most benificial scripts.
Anyone else have comments on this?

by tsjohnson

I am pretty much a novice, often stumbling
through requests by friends or relatives to help
with their self-described "computer problems"
(with them rarely able to explain what the
'problem' is). I know a little more than they do,
so I try to help.

I start off thinking I can do it quickly, but it
usually ends up taking hours (partly due to my
inexperience and partly to the severity of the
problem).

I have come to believe that it would be quicker
(and easier) just to perform a reformat and
reinstallation of the OS. This is a drastic
solution, I know, but when I spend hours trying
to clean things up instead of just reformatting
etc., I'm the one who feels bad that I can't do it
quicker.

Will reformatting and reinstallation of OS
actually get rid of all existing 'infections'? Any
advice would be appreciated.

by rick_fowler

...anything the users have on their PC is going to be wiped out. In my experience, users pretty much save files any which way they want, making backup a bit more difficult. Naturally they will want to keep their IE bookmarks, which you should check because the spy sites are sometimes installed as "favorites." Documents, letters, etc. will be found outside "My Documents" - a brief scan through the folder tree will identify some, but you may need to search for *.doc to get them all. All of this is a long way of saying that a reformat might not be the best place to start, but keep it around as a last resort.

by tsjohnson

After successful removal of numerous
infections, and re-running AdAware three
times, I could not get rid of a Registry Key for
"AltnetBDE". Adware would seemingly remove
it, but upon restart and a re-run of AdAware,
the Key resurfaced.

Any ideas?

by Member 28662770

Don't limit yourself to One Anti-SpyWare application. Often, it takes 3 or 4 Anti-Spyware applications to get rid of 99.99% of Spyware. I use AdAware, SpyBot, MicroSfot's Anit-SpyWare, Hyjack This, and Spy Killer on the Freebee side, plus Pest Patrol, Counter Spy, and Spy Sweeper on the purchased side. Sometimes I've had to use all of them to get rid of the really nasty items. This crap is no joke. Now some of the SpyWare/Adware creators are filing law suites against the Anti-SpyWare makers for removing their objects.

I would hope that some smart lawyer would start a class action law suite against the SpyWare/Adware creators on the grounds of accumulated Spyware/Adware slowing down the PCs thus reducing productivity plus the cost of labor to clean this crap out of PCs. Sometimes it can take up to 3 hours to successfully clean a single PC.

Unfortunately, most of the small businesses that come to me don't have the resources to have an on-site IT staff. Therefore, the cost of doing the initial cleaning of their PCs and setting up a good defense shield can really cut into their budget. The latest cost for a 15 PC small office initial cleaning and shield setup was $7,000. Each of their PCs had over 150 Spyware/Adware objects and their PCs were running at a snail's pace.

Many people are still un-trained in the proper use of PCs and Internet surfing. They use a PC because advertising has convinced them that it is so easy, therefore, they treat it like a simple kitchen appliance. As a result they get very frustrated with all of this crap loading into their PCs without their knowledge. Sure, the EULA's are great legal protection for the creators of SpyWare/Adware however, many users still view the EULA's as a deceptive trade practice since they are so lengthy and difficult to read. Also, many SpyWare downloading sites don?t even display an EULA.

by mr l

Try re-doing your adaware scan/removal in safe mode. I think you'll find that it will get that spyware gone for you. Safe mode will limit installs, including the sneaky little reinstallers that some spyware comes equipped with.

by tfordii

Working for an ISP / IT consulting company I have seen more than my fair share of Malware / Virus infections. While I try to boot into safe mode and it usually works, there is one particuliar nasty one that seems to require the NVRAM to be cleared and then booted into safe mode. Additionally I always turn off the Restore Points in Windows XP, this helps from it reappearing after normal boot.

MCDST

This discussion is closed to new replies.