Printable View
I know i asked a similar question already but I am not clear on what you guys do win a bigger environment to avoid Pop-ups/malware and spyware/addware?
I have 450-500 nodes and constantly get people complaining of pop-ups.
What do you guys do? I NEED a solution...
EDIT: we run Trend Micro on the desktop/email and serverside for anti virus.
all Microsoft environment.
You need to start employing solutions on a larger scale then. WebSense might be a way of stopping or preventing it from even coming close to users. Using browsers other than IE (remove it or lock it down) would be good options.
I am a consultant here on a company that has 16,000 pc networked. No anti-spyware is currently implemented or choose. They are just running norton enterprise edition on each pc. At corporate entrance, they have huge scan softwares attached to ISA server(proxy), firewall (nokia appliance) and e-mail (exchange). those software are very effective, but time to time some smart malware pass thru them and hit some computers. War casualities...:P
mine was never compromised :)
Jason, You almost all ways have to treat popups on an individual basis. I have never heard of an enterprise solution that applies.
Make sure that 'Messenger Service' (not the IM Messenger by the way) is turned off on all workstations and install something like the 'Google Toolbar' on all workstations.
That would be the only solution I could recommend. (note: you might be able to write a script that would turn off 'Messenger Service' network wide, but I am not sure if you could script installation of the 'Google Toolbar')
Perhaps Tiger or Pooh, both of whom have vastly more large network experience than I ever will, could give you better suggestions on a solution.
Definately kill Windows Messenger, like he said. Do this either through services manager or go to www.grc.com and use "Shoot the Messenger".
I don't know of any enterprise-wide solution either. This, unfortunately, is a machine-by-machine kinda problem, because pop-ups and malware come through each individual browser. As long as pop-ups are not excessive, you may just have to tell your users to live with them and go through HUGE inconvenience of "x-ing" them out. ;)
However, the good ol' Spybot/Adaware combo with a good browser in place (with me it's Firefox) will weed out the vast majority of problems, other than uneducated users who will hit "download" on just about anything ever-so-blindly.
Key thing to remember: you're biggest problem can never be solved with an enterprise-wide tool. Your key problem must be dealt with case-by-case. That key problem is named "user". :D
Messanger service should be off your right...Quote:
Originally posted here by moxnix
Jason, You almost all ways have to treat popups on an individual basis. I have never heard of an enterprise solution that applies.
Make sure that 'Messenger Service' (not the IM Messenger by the way) is turned off on all workstations and install something like the 'Google Toolbar' on all workstations.
That would be the only solution I could recommend. (note: you might be able to write a script that would turn off 'Messenger Service' network wide, but I am not sure if you could script installation of the 'Google Toolbar')
Perhaps Tiger or Pooh, both of whom have vastly more large network experience than I ever will, could give you better suggestions on a solution.
I cant use google tool bar because if it blocks pop-ups it will also block a very vital banking software we use... :(
Sigh.
The link I posted is called Websense. It is an Enterprise solution for spyware. Add to that filtering on your firewall to deal with scripts in advance and you have something that can take care of users/mitigate anything they may do.
The user may be the risk but if they never see it, it's harder to happen. Good firewalls (not simplistic packet filtering) have content stripping options that should help with ad blocking/spyware blocking.
We have websense...I didnt know it could be used to deal with spyware? is it an add on you have to purchase seperatly? I dont manage the websense just yet....Quote:
Originally posted here by MsMittens
Sigh.
The link I posted is called Websense. It is an Enterprise solution for spyware. Add to that filtering on your firewall to deal with scripts in advance and you have something that can take care of users/mitigate anything they may do.
The user may be the risk but if they never see it, it's harder to happen. Good firewalls (not simplistic packet filtering) have content stripping options that should help with ad blocking/spyware blocking.
Ok, so, just disgregard my last post altogether. :) Thanks a lot MsM, you just destroyed my attempt to look good, yeah, thanks a lot. ;)
If you don't manage it, then who does? Are you actually infected with spyware? If not, then websense is doing it's job. If you are, then there probably is a misconfiguration. You might want to visit their website and learn a little more about their product.
That said, even a decent firewall setup to stop active-x and other scripts should help.
While I agree with Ms. M. I'll prewarn you that messing with the content filters will make your phone ring a lot. There's very little content you can filter that doesn't cause a lot of false positives and your users will get pissy. I find it better to use a site filtering system like WebBlocker that is built into the WatchGuard firewalls or SurfControl that filters the sites the users visit. It doesn't get everything but if you filter the category "Advertising" it kills a surprising amount and the users get used to the Ad's on pages saying "Access Denied" and many of the popups just say access denied too.....Quote:
Good firewalls (not simplistic packet filtering) have content stripping options that should help with ad blocking/spyware blocking.
Sorry :D but when I see someone asking how to deal with lots of users, doing it by hand makes no sense. It's too time consuming and would become a job in-of-itself, with lots of overtime. Rather than being reactive, it would make sense to be proactive. That is:Quote:
Thanks a lot MsM, you just destroyed my attempt to look good, yeah, thanks a lot.
- - firewall setup to limit/mitigate script activities
- remove/lock down IE usage
- remove/lock down Outlook usage
- disable/remove Windows Messenger (not MSN)
- employ a solution that identifies and targets spyware BEFORE it enters the network (Websense is the most well known -- at least to me -- but I'm sure there are others plus some firewall manufacturers have these included with it)
Hey Jason,
I'm stuck in a similar situation with user's running amuck on the internet and have found a *.reg file to be most helpful in clearing out unwanted registry entries. It can be easily edited as changes occur and is a great time saver in removing or changing the registry. It can be implemented individually or deployed on a larger scale, which I've done utilizing SMS.
I've posted a basic example for download on the web at:
http://home.cfl.rr.com/savvyshe/IEfix-lock.reg
http://home.cfl.rr.com/savvyshe/IE-unlock.reg (just in case)
Or below is the basic script example: (It's pretty easy to figure out and/or plenty of resources on the web) Here, I've reset some string values, deleted entries, and implemented a lockdown.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"=http://www.google.com
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page"=http://www.google.com
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Bar"=http://www.google.com
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Search Bar"=http://www.google.com
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Use Search Asst]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Use Search Asst]
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
"NoBrowserOptions"=dword:00000001
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"Homepage"=dword:00000001
Couldn't you just edit your security settings to allow work related site scripts, and block the rest? As for adware being the source of your popups, I think adaware has a corporate solution, with remote scanning, but I haven't used it. I would like to know what others think about it, does anyone have experience with Ad aware professional?
Hi Jason,
Sorry to be a trifle vague, but I cannot lay my hands on the CDs at the moment :( I would suggest that you have a look at an outfit called Ashampoo (I think it is German). I am running their pop-up stopper at the moment, and it seems to work without blocking ones that I want.
It might be a part of their WinOptimizer suite? I got a couple of their products to help me produce animated, voice-overed user manuals/guides/tutorials and this must have been on it.
It has an "edit exceptions" feature which lets you decide where you will allow pop-ups from.
It does not seem to interfere with any software that uses pop-up screens, or with sites that produce a pop-up in response to a user originated request.
I must admit that I haven't tested it thoroughly, as I have never found pop-ups a personal problem either at home or in the workplace.
It might be worth a look?
/slightly off topic
Can anyone recommend a link to a relatively "safe" site that does have pop-ups, so I can check out some of these apps (I must have collected several over the years) /
Cheers
I've used the AdAware professional and was disappointed with its performance. We currently use both AdAware and Spybot to ensure the removal of all files. In comparison, if AdAware removes 6 entries, Spybot will find 10+ that were missed.
As for editing the security settings, that can't be done in some corporate environments. Our users have a myriad of tasks that must be completed and although we can restrict some to the intranet, that user group is limited to a handful.
I saw someone else suggest a migration away from MSIE... this is a terrible idea.
It will give you less control over the environment as a whole not more, as MSIE can be (and should be) configured and locked down via the domain policy.
Most of the rest about killing messenger etc looked good (and can also be done at the domian level.)
Security settings can and should be established in all corporate environments offering the capability. If someone tells you that it can't be done for whatever reason, talk to someone smarter or less lazy.
catch
According to my boss its his boss the VP of IT who manges us now, but at some point ill be taking it over.Quote:
Originally posted here by MsMittens
If you don't manage it, then who does? Are you actually infected with spyware? If not, then websense is doing it's job. If you are, then there probably is a misconfiguration. You might want to visit their website and learn a little more about their product.
That said, even a decent firewall setup to stop active-x and other scripts should help.
What plagues our network seems to be pop-ups that come from programs that get installed over http. like virus warning pop-ups from the creator of some cheesy anti virus software.
I now have access to the websense consol but it seems as though the peice your talking about is under the desk top section and we didnt buy that portion.
Whatever happend to less = more security theory, atleast I've been reading my OS theory books. ;)Quote:
Originally posted here by catch
I saw someone else suggest a migration away from MSIE... this is a terrible idea.
It will give you less control over the environment as a whole not more, as MSIE can be (and should be) configured and locked down via the domain policy.
Most of the rest about killing messenger etc looked good (and can also be done at the domian level.)
Security settings can and should be established in all corporate environments offering the capability. If someone tells you that it can't be done for whatever reason, talk to someone smarter or less lazy.
catch
Websense has premium groups, one of which is spyware, another of which is called productivity. You need both (how convenient) in order to effectively stop spyware. Easy to add to the websense server, seems to work pretty well.
Also, there is a client policy manager that can be set up to stop programs from running on the desktop. Doesn't remove anything, but it will stop unauthorized .exe's from running. You could probably get similar functionality from Windows 2000/2003 Group Policies by setting it to only allow specific programs to run, w/out the high price tag.