Your opinion counts --spyware tools

The usefulness of HJT showed itself to me in the dorms this past school year. I would always have a usb key ready with adaware, spybot, a batch file with "shutdown -a" and a sasser cleanup tool.

Whenever I got an IM from someone asking to "fix their internet" (I work for dvd borrowing privledges :cool:) I would update the ref files and cleanup tools on the key and head on over.

Safe mode, scan, safe mode / networking, scan, normal mode, scan and I'd would hope to be done. 4 times out of 5 however, something wouldn't be stopped. Viruses would be taken care of nicely it seems, but CWS and others are clever.

I haven't been doing spyware kind of work since this past year at school, but ad aware and spybot did next to nothing for hijacks when I did. Their definitions were rarely bleeding edge. I don't blame them though, CWS and otheres seemed to change really really often.

This is exactly what I would try to prevent....is to be forced to travel around with your "spyware medical pack" and deploy it on all computers. I guess the people in AO (in no offense at all) are more client type users than enterprise users...thanks for the help however.

If you want to protect your users on a wide scale, prevention is more effective than widescale, multiple solutions. Tighten down the browsers they use, or consider moving to a mozilla variant w/ tightening, add AV products acrosss all systems, Scan for viruses at the mail server (or make like Tiger Shark and remove anything with legs) and implement / enforce a strict user policy.

The only problem with this is that users bring their laptops home and bring malware into work. In that case you would need some realtime adaware action in hand with realtime AV. So far I haven't heard of any reccommended AV / Spyware hybrid solutions.

But by then malware appearances will be so slowed that a solution like a live disc wouldn't be so bad after all I guess?

What about Websense, which seems to be the mainstream enterprise-level spyware/adware/etc application?

Greens go out to MsMittens...thats one product I have yet to hear about. Thank you. I will look into it.

Quote:

---

This is exactly what I would try to prevent....is to be forced to travel around with your "spyware medical pack" and deploy it on all computers.

---

What are you trying to prevent.. ? The fact that machines get infected or is it to be traveling out to each PC to remove the parasite's?

If it is the first:

Review or write a company Policy for Internet use (and users responsabilities - Check the tutorials.. I think Tiger Shark has a tut on this subject)
Lock down the machines - those that don't need Internet access - block it..
Consider useing an alternate browser to IE.(ok this can be site dependant)
Yes and install a product like Websence.
Threaten bodily harm to any user that breaks policy

Cheers

Edit: I basicly rewrote Soda's reply.. sry..

Quote:

---

So far I haven't heard of any reccommended AV / Spyware hybrid solutions.

---

I add.. that work !
I

To take a topic that is dangerously off topic even further off topic..

Quote:

---

Both adaware and spybot are free. Both have features that have been proven to speed up system recovery and repair times. Both inform you to processes and threats that not even google is very good at explaining. Am I missing something?

---

Yes and no. Adaware and Spybot do the best they can, but they are limited. There are just some things that thay can't handle. I will give Adaware due credit though. They are developing plug-ins that are starting to target specific malware.

There are many other applications that will list running processes..HJT was developed to target specific vulnerable areas in the registry and OS that malware takes advantage of. (poorly stated, but hopefully you understand) No other tool does that.

Quote:

---

As you may tell though, I've quite a bit of pent up rage against HJT because of the damage I've seen it to do users, both guru and end alike.

---

Me too. I cringe when I see "Run Adaware, Spybot, the Shredder, and HJT"..reminds me of Sesame Street.. "Three of these things belong together, three of these things are kind of the same.." It is not a safe tool. It removes nothing. It is simply another tool in the arsenal for when everything else has failed. And until I find something that works better, I'll use it.

**************************************
Now to try and bring this back on topic..

Quote:

---

Review or write a company Policy for Internet use

---

I seem to remember Catch had a few nice posts related to this also. I'm not having much luck finding the right threads though.

For what it is worth, although I don't use it myself, I have heard good things about Websence on other forums.

Cheers!!