Pop-up Help...

I have been seeing an alarming trend here at the office...
I see a lot of pop-ups. Users call our helpd desk and complain that they get their home pages changed and tons of pop-ups. no matter what Web sites they visit. And Its true i can go on to www.yellowpages.com and get porn pop-ups on the inffected machines. they even get them when simply on the intranet.
I have been able to remove some mannualy by editing the registry.
some just keep coming back.
Is there a more efficient way to dela with this issue? any sugegstions? what shoudl i be looking for in the registry? where else should i look?
Thanks, J ::sneeze::

download and run these programs....

http://www.softpedia.com/public/cat/...10-17-69.shtml
http://www.lavasoftusa.com/software/adaware/
http://www.pcworld.com/downloads/fil...d,22262,00.asp
http://www.softpedia.com/public/cat/...0-17-150.shtml

you should be fine after that....also downooad the google toolbar "great for blocking usual pop-ups"

http://toolbar.google.com

1) Download, install, update, and run Spybot Search & Destroy and Lavasoft Adaware
2) Donwload a popup blocker. I suggest FreeSurfer which you can find at www.snapfiles.com
3) Consider a more secure browser, such as Mozilla as opposed to Internet Explorer
4) Go to www.grc.com and use "Shoot the Messenger" to shutdown your Windows Messenging service (or do it yourself through services in the administrative section of your control panel)

Hi

Pop-Ups really are a nuicence. I use Mozilla FireFox It has a inbuilt Pop-up Blocker. For Internet Explorer you can use Yahoo Tool bar which has a Popup Blcker.

For Adware realted Nuicence you might use AD-Aware and Spybot . And For HomePage Hyjack Kind of hijacks CWShredder is a small but effective utility.

Hope that helps

--Good Luck--

Edit

Hey you guys are fast You beat me. Sorry your Posts were not there when i started mine

And as mentioned by groovicus . these tools might not work sometime with new infections then www.google.com is also a very effective tool against new varients that these tools might not touch , Google for the Hijack and you might find a specilized removal tool or procedure someone else might have used. Hey and HijakThis might be useful too here

I would just like to point out that CWS does not remove all variants, so making the assumption that "you should be fine" is a little broad, IMHO.

The NewDotCom hijack is untouched by the tools you have listed, as are the l2m, and the Pepper Trojan, all of which require special attention. Not to mention HackerDefender, of which there is no removal tool.. :D

EMS FreeSurfer also has a feature to protect you from future browser hijacks.

I reccommend ad aware, spybot, and cws shredder if you are doing this alone. If those don't work, post a log from hijack this, from the merjin website.

UPDATE WINDOWS!!!

IE: Use the google toolbar for pop up blocking. I trust google :)
Firefox has it embedded, you can enable it in the options.

I forgot to mention this is for 500 users...

They landed you a position as Network Security Coordinator over 500 people without training you in this first? Dang, and I thought I had it rough! Well, you've come to the right place to learn.

I'd suggest trying out the software yourself. Probably disregard Firefox and other browsers since you don't want the hassle of walking every single user you talk to through it, so you want to focus on Internet Explorer security tools. That said, check out the suggested software, and if you think that's what you need, then that's what you suggest to your users when they call with these problems.

Configure your browser, you can stop "POP UP's" without 3rd party software If you would like.
Open --> IE--> Tools--> Internet Options--> Security--> Custom Level--> Disable Active Scripting--> OK

Even though pop-ups are annoying you could still test out your pop-up blocker at PopupTest.com to see how well it does against those pop-ups that are flooding you...

Never download any programs you do not trust. if it is adware, shareware or freeware, make sure what is bundled. That'll save a lot of troubles. Good luck.

Quote:

---

Originally posted here by AngelicKnight
They landed you a position as Network Security Coordinator over 500 people without training you in this first? Dang, and I thought I had it rough! Well, you've come to the right place to learn.

I'd suggest trying out the software yourself. Probably disregard Firefox and other browsers since you don't want the hassle of walking every single user you talk to through it, so you want to focus on Internet Explorer security tools. That said, check out the suggested software, and if you think that's what you need, then that's what you suggest to your users when they call with these problems.

---

thats right...My background is in PC support and to be honest i havent done that in years...I worked for an ISP as tech support for the last 2 years.


wont the browser security possibly cause ofther issues..IE..not allowing programs/login pop ups they need to run.

I'm a fresh MIS major, and I got thrown into net admin during my last semester in an internship with no security training or real hands-on network experience, and it was friggin' scary for a while. So I can definately relate, especially in regards to the dozens of people who will respond "You didn't know that?!" when you ask them questions!

Tightening security may indeed cause some of those problems. I don't use IE anymore, but on the rare occasions I do for a considerable period of time, I have EMS FreeSurfer running, and it's worked wonders. The only downside I've found is that sometimes it protects your homepage a little TOO well (I never could change the homepage myself!). Few popups/hijacks will get past FreeSurfer, and it's very easy to use.

Its been tough. I have so many questions! the pay was ok and I needed a job!

Quote:

---

wont the browser security possibly cause ofther issues..IE..not allowing programs/login pop ups they need to run.

---

Yes, it can cause problems if you need it for certain web applications. Take !imitation's advice with the scripting, combine that with the trusted zone option. Set only the pages a employee needs to see on the companies website that require scripts. There's gotta be a way to export that and run around with a disk to update, but maybe your admin software will permit that as well.

Scan from a centralized location
http://lavasoft.element5.com/softwar...eprofessional/

Set all your boxes to update automatically and often. If someone complains that they can't run kazaa, then just tell them to shut the hell up ;). Do you currently have an antivirus solution in place?

Well, from one thrown-to-the-wolves n00b to another, here's part of what I did to get set on the right track as a know-nothing admin:

1) Learn everything you can about firewalls, hardware and software, especially log monitoring.
2) Know everything you can about your LAN, it's domain, IP addresses in it, user groups and permissions, what each server does, etc.
3) Find and keep handy a number of quick-reference learning resources handy, such as AO here. Others I use are www.experts-exchange.com and www.tek-tips.com.
4) Become intimately familiar with your antivirus software and watch logs often.
5) Become well familarized with the event viewer in each machine, and reference EventID.Net when something fishy pops up.
6) Google the crap out of everything.
7) Ignore people who say your questions are dumb.

Just read, read, research, research, and experiment with stuff (within the confines of safety of course). I'm a lot better off now and continuing to gain ground going this route.

Jason:

If you have the budget, I would recommend purchasing some type of web monitoring control.

I reviewed surfcontrol, websense and a few apps from CA. In the end I bought websense and their desktop control plug-in. I had many of the same issues ranging from users typing the wrong url to - excuse my attitude - stupidity.

With web monitoring/blocking software the popup sites are usually blocked by default and the end user (with websense) doesn't see the window. The software not only helps defend against m intent but does a good job preventing stupidity at the user level.

The desktop control software is nothing more than a service that checks to see if an application is allowed to run. Haven't noticed significant network traffic, and since the users know I'm monitoring - available bandwidth has almost doubled.

Since I installed 6 months ago I haven't had to change a single homepage or remove spyware. There are other security measures augmenting the web monitoring software but without websense (or any of the other products) the additional security measures would not have been as effective.

I have websense....maybe its just not configured to stop this activity? i havent taken that over yet. only been here 3 months.