Internet Explorer as an antivirus app

Strange as it sounds, one of the best antivirus apps on any given Windows PC is...Internet Explorer.

That's right: Internet Explorer.

I've worked as a field tech over the last few years. I learned early on what a time killer it can be updating someone's AV client. Or replacing it. Brand name AV apps can be a big headache. Sometimes you need a special file just to remove them. You can lose some real time there. So I just by-pass them now and go straight to IE.

The much-maligned (deservedly so) ActiveX technology, embedded in Windows and Internet Explorer, has one redeeming feature. It enables a user to scan their computer for viruses from a number of commercial AV sites. Some popular ones are Trendmicro and Panda. There's dozens out there, including spyware scanners. Most are reputable, though I'm leary of some spyware scanners. But our focus here is viruses and, by and large, these sites are great. In fact, the good online AV scans will find spyware too.

My personal favorite is Panda's online scan. For others, it's Trendmicro. Norton, McAfee, I believe they have online scans available, too. RAV had an absolutely great scanner until Microsoft bought them out and shut it down. These scanners, in fact, rival any of the AV clients for finding viruses. But don't count on them to remove much of anything. That's OK though.

Finding viruses is one step, removing them is another. Don't worry, there's a slew of great removal tools. Norton's tools rank among the best. I've got a thumbdrive (usb drive) full of them. F-Secure and other outfits offer them too. These small exe's are only designed to remove a specific virus. They aren't going to find or remove anything else. You'll find readme's with these AV tools, so RTFM! Pay attention.

The one requirement for running these online AV scans is that ActiveX must be enabled in Internet Explorer. Being the default setting from Microsoft, this is seldom a problem. Any user advanced enough to disable ActiveX and tweak Windows' security settings probably isn't going to need a technician anyway. With XP's service pack 2, you are going to be prompted to install an ActiveX applet. No applet, no scan.

Also note these online scans aren't going to typically work using Firefox, even with their ActiveX plug-in. All of the ones I ever tried required IE. Once in a while, the online scans will generate false positives, so you want to do your homework and google file names if need be.

Happy Hunting (again)!

p.s. -- let me add, IE as an AV app is no substitute for an updated AV client on your PC. It's a great supplemental tool and very useful in the field.

Greeting's

I would just like to add that trendmicro's online scan works with Firefox (it uses a Java plug-in). Anyway like brokencrow said USE IE as a secondary backup and not as your first line of defense for viruses.

I have no idea how good panda is I have never tried it. But I would seriously like users to take a look at http://safety.live.com/site/en-US/default.htm (Its by microsoft, so it only works with IE). The virus scanner is great I have scanned with trendmicro and Symantec before I went to this site and it still found viruses on my PC (although only one's that affect mobile phones, ESP series 60 and 80) but I think this is still help full because I have heard that mobile viruses also double up as Trojans on PC but I don't remember where I head it.


Anyway brokencrow and excellent work mate online scanners are always the best backup's.

Thanks mate.

Quote:

---

Anyway like brokencrow said USE IE as a secondary backup and not as your first line of defense for viruses.

---

Your first line of defense should be local security policies and service restrictions.

No matter what anybody tells you, AV's are a "reactive" technology. If they find something, it means you have already been compromised. You need to prevent this.

while synja has a valid point, I like your discovery, brokencrow. It is somewhat fast and practical. However, I don't think that I would bet my life on it because of the Active X. I have had a bad experience from Active X malware.

Quote:

---

I have had a bad experience from Active X malware.

---

Now... shall I quote myself?

Quote:

---

Your first line of defense should be local security policies and service restrictions.

---

This means locking down scripting services on your machine as well. And not just ActiveX, but also VBS, JS, Perl if you have it, etc...



Antivirus software does not *defend* you from anything. It merely cleans up the effects fo poor security.

I enjoyed reading your post, and the information you present in it. But without a doubt, Synja is 200% (feel free to add as many 0's as you wish) correct.

You need to keep in mind that there are quite a few malware out there in the wild that alter Active X settings, and some actually disable the ability to use the online scanners via redirects. I have had several users bring notebooks to me (not company ownered, personal) that have been so infected that the ability to get to trendmicro or panda has been impossible. In some cases, I have found that the service for the local AV has been disable in the registery.

And while updating AV software, or installing it if it isnt even there, can be a headache (I guess... never thought of it as a problem) it has a benefit the online scanners don't. IT can handle real time detection, and the online versions can't. Nothing in the online scanners will prevent reinfection.

Just tidbits to keep in mind... :)

I totally agree with you synja. I was just amused by brokencrow's method.


by the way, I want to add, say, five zeros.....

Quote:

---

Originally posted here by MrCoffee
I enjoyed reading your post, and the information you present in it. But without a doubt, Synja is 200% (feel free to add as many 0's as you wish) correct.

---

Quote:

---

Antivirus software does not *defend* you from anything. It merely cleans up the effects fo poor security

---

Have to disagree with that one, a properly updated Anti Virus Software will stop "known" malware from getting onto your machine, Trend Micro Internet 2005 has a very useful internet lockdown when encountering java byte type trojans, or in the "wild" types, and while you are correct that these programs do for the most part catch the malware after the machine has been infected, it is still down to the user to properly update all definitions/patterns/patches that are available, as most reputable vendors will try to get the updates out as fast as possible..this includes windows security patches for IE....

Properly configured and updated, Antivirus software can also catch "known" maleware in e-mails, before they infect a computer, even if the computer has a vulnerability still left unpatched.

Properly locking down a computer helps with the "unknown" that the AV missed because, well, it is unknown to it.
And the rate at which these things are coming out and being mutated, there are a lot of "unknowns" out there.

Quote:

---

Have to disagree with that one, a properly updated Anti Virus Software will stop "known" malware from getting onto your machine, Trend Micro Internet 2005 has a very useful internet lockdown when encountering java byte type trojans, or in the "wild" types, and while you are correct that these programs do for the most part catch the malware after the machine has been infected, it is still down to the user to properly update all definitions/patterns/patches that are available, as most reputable vendors will try to get the updates out as fast as possible..this includes windows security patches for IE....

---

Ugh... malware getting to any place that a AV scanner can see it means you need to harden your machine.

When Trend Micro is running it detects the network virus or trojan before it gets to your PC, it is not "scanning", it is live detection, as long as the virus/trojan is in the data base of Trend Micro it will detect the malware's signature, and quarantine the virus/trojan before it gets onto your PC, wether through a properly locked down IE or configured FF browser.

This is before the fact not after......

So... it gets the malware before it has connected to a vulnerable service?

And it gets it before the download starts?

Pardon my frank response, but why the hell would anyone trust mobile code executing on their host from a site that claims to be doing AV scanning? This model is one of the most widely used vectors used by criminals world-wide.

ActiveX and Java are the *worst* things you can allow to execute on your host. If IE is the best antivirus solution then Windows is the most stable OS.

The logic here, to me, is like saying that I'm going to leave my door wide open so that the criminals don't break the door off the hinges when they come to rob me.


-TH13

Quote:

---

The logic here, to me, is like saying that I'm going to leave my door wide open so that the criminals don't break the door off the hinges when they come to rob me.

---

Actually, when I was building houses, after I finished the interior woodwork, I'd leave the door unlocked.

That way... when the locals jacked the new appliances, I wouldn't have to come back to replace the door. If it's locked, they just kick it in... Hey South St. Pete has its own rules....

;)

Quote:

---

That way... when the locals jacked the new appliances, I wouldn't have to come back to replace the door.

---

Then you were doing it wrong... You placed your things of value before you could properly protect them... Bad idea... The things of value are the last things you place... otherwise you lose them, anywhere, not just south St. Pete... Basic rule of any kind of security.... :)

Quote:

---

Then you were doing it wrong... You placed your things of value before you could properly protect them... Bad idea... The things of value are the last things you place... otherwise you lose them, anywhere, not just south St. Pete... Basic rule of any kind of security....

---

Wasn't my decision. The comany that contracted us made that choice. For example... THe alarms aren't active until a few weeks after the house is finished, the code is the same in every house they build from Lakeland to Sarasota, and there is a master key that opens every house. When you consider how many people are unlikely to change the alarm code or the locks when they move in....

OK... I retract my statement...

_Everyone_ is doing it wrong... ;)

_Everyone_ is doing it wrong?

Even Microsoft?

Don't tell HT...

:(

And why the hell WOULD anyone trust mobile code executing on their host from a site that claims to be doing AV scanning?

Maybe they trust the site? Might not be good policy on a network, but for a home PC, I'll take what I can get. I hate to quote one of America's premier a-holes, but "you go to war with what you got"...

You guys need to get out of your ivory towers more often.

:p

Quote:

---

So... it gets the malware before it has connected to a vulnerable service?

---

sometimes, that is the idea.

Quote:

---

And it gets it before the download starts?

---

The AV is supposed to intercept the download, determine if it has a malicious payload, and isolate it ( or prevent it from being downloaded, depending how it is configured ) before it can install itself and do any damage if it is deemed malicious. The download must start for the AV to intercept it.

I’m talking here about client side solutions, not on-line scans. ( the original statement concerning AV was extremely broad. )

As far as on-line scans, I have used them, but don’t necessarily like to. Sometimes they are easier for the layman, sometimes they will point someone in the right direction to start. But they are not my first choice, just an alternative. The target audience and situation should be considered before recommending them. But if they find something, that something has already started to do its damage. The horse has already left the barn, now you have to go chase it down, then figure out how and why it got out, then try to fix it.

To clean a box, I much prefer disconnecting it completely from any and all connections, using known good software, stand-alone. Even for my own boxes here at home, I don’t rely solely on my AV, but periodically take boxes off-line and check them with known ( believed to be to be more precise ) good software, as well as checking for rouge programs, proper permissions, etc. Not everyone does this, most users don't know how, thus why I clean so many boxes!

I also try to educate people when the box is returned, to prevent further situations. But sometimes, that is hopeless.

Quote:

---

Originally posted here by Synja
So... it gets the malware before it has connected to a vulnerable service?

And it gets it before the download starts?

---

Right on both accounts, it mostly acts like a "firewall" I suppose, it will detect the threat of a network virus and depending on how you have it set up will either quarantine the malware or shutdown the network connection, or both.

If a local process can see it, it has already reached the machine.


I will post some suggestions about locking down IE through local security policy and file permissions later tonight. I just have to wait for t3h b4by to go to sleep. If I don't get to it tonight, I'll do it tomorrow morning when everyone's still sleeping.

Quote:

---

If a local process can see it, it has already reached the machine.

---

And your point is ?

If you connect to it with IE, IE is a local process, and it can see it too. But the question is, what will your system do with it?
IF you have locked down your system so it won’t run ActiveX components, then you have told it to ignore what it sees.
If your AV quarantines it, it doesn’t run.
If you have your system locked down and an ActiveX runs, but doesn’t have permissions to alter or install anything on the system, then you have mitigated damage that way.

An AV is just another layer. If the AV catches something before it has had a chance to do its damage then where is the difference and what are you talking about?
It is just a different local process that sees it and prevents it from doing damage. ( we are talking web browsing here, you have not addressed e-mails, etc., although I tried to earlier.)

Want some examples ( beyond the masses of stupid people who are everyday users of computers? )
How about you, while browsing and have your kid on your lap, you go to look at something only to find that it has an ActiveX script to run. You are distracted by your kid. You get prompted to run it, you don’t want to, but your kid picks that moment to fling the bottle at your groin; you clicked on accept instead of cancel ... now you are hoping you have something else in place just in case. ( I was going to use the drunk scenario, but thought this would ‘hit home.’ If it didn’t, it will! )

Or what about when your ‘significant other’ is trying to view something, then can’t? ( or that bastard at work who wants to make your life miserable, and has the ear of your boss’s boss ? ) Or you want to view the new Harleys, but they use off-site images, etc.?

I posted this ( in disgust ) on another site, think it appropriate here. It exemplifies the mind set of people in general about computers:

Quote:

---

Something caught my eye in the February 16 edition of Network Computing Magazine :

"AJAX Isn't Squeaky Clean "
( the title of the online article is a little different: Is Is AJAX a security risk? )

What really intrigued me was the last line,

Quote:

---

Is AJAX a security risk? Probably. But let's not drag Web services through the mud just because AJAX is one of today's most commonly used SOA clients.

---

Does this chew at anyone else?

I mean not just the statement, but the underlying concept behind it. It is prevalent throughout the industry, has steered the development of the IT industry for the past decade, but isn't it time that people in general came to grasp that security is everyone's responsibility, and liability?

Am I off base here? Or doesn't anyone else see what I see?


Terms used in the article:
Ajax
SOA

---

That is the reality of what we are dealing with.

Don’t get me wrong. AV software is not ( although many believe it is ) an end-all to answer security. Far from it. But it fills a gap, especially when people want to view sites who’s only consideration is usability and convenience and have no concern for security. ( BTW, this is also applicable to software developers, ISPs, etc. )

The concept has been around for years: Security in Depth, Layered Security, whatever you want to call it. Hopefully, those in the field will eventually be able to understand and overrule when it comes to security, but right now the all mighty dollar and user conveyance rule.

Education is the key.
AO has been a place for people to learn this. Hopefully, it will continue to lead in this respect

Quote:

---

You guys need to get out of your ivory towers more often.

---

LOL. Be sure to tell me this when your identity is being used by Dr. Akeem Hoobackaloo, the sole benefactor of the kingdom of Zamunda.

I think he may still need some additional info from you so he can transfer your 2 million dollars of US.

;)

How did you know my real name, horse?

;)