users getting infected with spyware

[techie211]

hey ppl, we did a scan on a few systems using Spyware Dr. on a few of our users and they are getting infected with 'Application.TrackingCookies' and 'Adware.Advertising'. These users were getting 'Undeliverable' emails and were send hundreds of emails to different accounts causing our mail server/domain to be blacklisted with Yahoo.com, Verizon.net & Aol.com. We've since then disabled those accounts and reinstated our whitelist status. Just wanted to know what everyone out there uses to prevent these infections...software/hardware/scripts?

thanks

-j

[elsiegee40]

Mandatory profiles are a good start - cookies, etc are not saved back to the profile.

[t_h]

Were the accounts in question Administrator accounts? If so, giving users standard accounts would be a great start.

[mossj]

A decent AV would help, preferably centrally managed we use sophos but i've heard good things about nod32

[dwhyte85]

Prevention we have Sophos AV & Sophos Web Filtering, users are not administrators or power users and therefore can't install things. OpenDNS maybe something to consider as they blacklist alot of dodgy sites.

Removal... MalwareBytes & Nod32 is the way forward. Nod32 seems to get alot of the newly crypted stubs and executables before everyone else, must have good links with the underground :P

[Arthur]

It seems malware/virus authors are targeting applications like Adobe Flash Player, Adobe Reader, Apple QuickTime and Sun's Java Runtime Environment more and more these days probably due to the numerous security vulnerabilities they have, so it's definitely worth updating these apps regularly to prevent computers getting exploited.

[gshaw]

It seems malware/virus authors are targeting applications like Adobe Flash Player, Adobe Reader, Apple QuickTime and Sun's Java Runtime Environment more and more these days probably due to the numerous security vulnerabilities they have, so it's definitely worth updating these apps regularly to prevent computers getting exploited.

Adobe software has so many flaws and vulnerabilities these days it's ridiculous... I mean it's one thing for a huge OS supporting thousands of apps to need regular patching but to mess it up on a program like a PDF reader is shocking imo

[ricki]

Hi

Have a look at spyware blaster and spybot search and destroy. We also filter the internet and ban games sites. This has helped a lot.

Richard

[JJonas]

I dont rate spybot anymore. Found too many things it missed and too many things it could not remove. Try malwarebytes instead Malwarebytes.org

[mossj]

Although both malware & spybot are good they aren't centrally managed therefore you would have constent problems in medium/large networks.

With our Sophos we can deploy updates/set allow rules/deploy the AV or firewall or both/and set what it does on discovery/start scans all centraly from one server. Our users don't start screaming for us when something pops up on there screen... because it doesn't.

Will make your life so much easier!

[elsiegee40]

Spybot S&D is only free for personal use. You can pay for a corporate/small business version which runs on a server. Spybot S&D for non private use