What do you do? IP Address Browsing, Viruses, BBC iPlayer and S4C Clic

Hi,

I would like to find out how other schools are tackling the following problem.

We have been blocking IP address browsing for a while now due to having a large number of infections coming from websites using IP addresses as opposed to URL's. All of these websites seem to impersonate "My Computer" for Windows XP and make you think that your PC is infected and usually install an infection which poses as an antivirus. We are using Bloxx Web Filter which has an antivirus built in (I can't remember which one it uses) and Symantec Endpoint Protection and neither of them were catching the infections. I spoke to Symantec on a few occasions and their answer is always "download this tool and it will remove the infection for you". But if that's the case, what's the point in having Symantec Endpoint Protection if it doesn't stop infections and instead I have to download a tool and manually remove the infection every 5 minutes? I've also spoken to Bloxx and they just ask me for the address so they can add it to their URL database. But there are so many of them and it wouldn't surprise me if they are continuously changing their addresses, so this isn't going to help much.

The problem we have now is that websites such as BBC iPlayer and S4C Clic stream all of their media from IP addresses. So staff are now understandably unhappy because they can't access videos they want to use in their lessons. I agree that they should be able to use these two websites in particular (maybe some others too). I thought of simply unblocking the specific IP addresses used by these two websites, but first of all I don't have a list of them (and neither do Bloxx) and second, even if I can get hold of a list I don't know if or how often these addresses are going to change. This isn't going to be any good if teachers are planning their lessons around these videos only to find that on the day the IP's have changed and the videos are blocked again.

So my questions are:

1) Is anybody else having/had the problem with these viruses coming from IP based websites? (I have seen similar websites using URL's but the majority seem to be IP addresses.)
- a) Do you have a solution for this problem other than blocking IP addresses?

2) Is there anybody blocking IP addresses with a solution for allowing BBC iPlayer and S4C Clic?

3) How many schools are blocking IP addresses? Are we part of a small group or do most schools do this?

4) Does anybody have any other tips or advice?

Thanks in advance,

Daniel

Our LEA use Smoothwall for filtering, which the schools connect to as their proxy server. That blocks websites with only an IP address, but iPlayer etc get through no problems.

Is your desktop AV not picking things up? What are the details of what the infections are?

It's been a couple of months if not longer since we blocked IP addresses to stop this. Unfortunately I can't remember the names of the fake antivirus infections; there were several different ones. Our desktop AV (Symantec Endpoint Protection) was not picking them up at first. Each time I removed an infection using the tools provided by Symantec there would be an update with a virus definition for it a couple of days later, but then we would get infected with a different fake antivirus. At least with a different name and slightly different appearance, not 100% sure that the infection itself was different. Our AV was picking up other things though, it wasn't completely broken.

Some, if not the majority of the websites seemed to appear when a user hovered over or clicked on an image from Google Images. It wouldn't happen with every image, just random ones. I searched the web and found other people reporting the same problem. I also emailed Google but never received a reply. (I'm not trying to point fingers at Google themselves) Since blocking IP addresses we have had very little problems with infections.

With regards to the poisioned Google Image results, that were a big problem globally last year, most of them get stopped by blocking ur.php and ru.php with a regex expression. It works on our Smoothwall G3 here; don't know if Bloxx can do similar.