mrtechsystems Posted June 15, 2005 Posted June 15, 2005 This is my first Post is go easy I was wondering how schools are battling againist Spyware/Adware on workstations now and what product do there use on a enterprise scale Senior Tech 8)
Dos_Box Posted June 15, 2005 Posted June 15, 2005 I go with Microsofts Anti-Spyware, with talk of active directoy integration it does exactly what you want. We looked into it as an LEA and it got to be hideously expensive to buy in a corporate solution. Like anti-spam, the industry has you over a barrel.
RobC Posted June 15, 2005 Posted June 15, 2005 Spyware is the curse of my network, and if I get hold of the guy that wrote CoolWebSearch, I am going to subject him to the longest, most painful & most humiliating fate imaginable. Unfortunately, the way our service is run, I'm stuck with running Ad-Aware from a network share. Tried running Spybot S&D, but it choked on the amount of crap being found.
tarquel Posted June 15, 2005 Posted June 15, 2005 I install Spywareblaster and Spybot on them all. Although the "Immunize" bit will (in XP) only give you protection for the local machine settings i.e. if another user logs on, they need to immunize also, etc., I haven't had any real trouble with spyware. That being said, we do have our internet feed from the county feed which (at last fair play hehe) now recognises Spyware and blocks certain websites - not that it is fool proof by any means One not to install is the MS AntiSpyware Beta if you are using GP on your Domain as it will pop up stuff all the time - keeps thinking everything is spyware or asking the user what to do..... definately not as god intended there lol --- EDIT: link to my private site where you can currently get various repacked apps from if in my sig - if user/pass if leaked, they will be changed. Pls no posting of it elsewhere. Cheers. --- Regards, N.
Dos_Box Posted June 15, 2005 Posted June 15, 2005 Non of us here in Lancashire seems to have that big a problem with spywear (or am I just being naive?). But we have been discussing it between ourselves for some time now and we have all pretty much got it nailed down.
Geoff Posted June 15, 2005 Posted June 15, 2005 The problem with spyware is that you don't know you've got a problem unless you specifically go and look for it with some specialist scanner. Its designed to hide itself and collect information on the machines usage patterns and popup adverts. At CarrHill the average machine seems to get 10 or 20 bits on it. We've had a few tragic cases with teachers laptops though with hundreds of things on them. Omce the local proxy goes live (Squid + dansguardian + smartfiler + squidguard + clamAV + Sophos ) I'll be scrubbing a lot more rubbish out before it even reaches the desktop.
KeithFermor Posted June 15, 2005 Posted June 15, 2005 I have Ad-Aware, Spybot S&D (don't you just love the 'search AND destroy'!) and use HiJackThis to check for loaded registry items. Carry them all on ma faithful data stick for those times when nothing else will do... Alongside these annoying little spyware, malware droids are the delivery agents; trojan horses et al. As long as our Sophos AV is maintained and distributed frequently, with a check & delete config, then the entry points are reduced. Finally, its not just the sllooowwww down of systems thats bugging, its those little side effects that interefere with daily computer activity and are caused by (or appear to be as they disappear after cleansing) background installed spylets. The fireaxe is always on hand for those finer techy moments!
Geoff Posted June 15, 2005 Posted June 15, 2005 My favorite is a dialup hijackers on teachers laptops. We've had no end of fun with those.
Dos_Box Posted June 15, 2005 Posted June 15, 2005 It really does make you wonder just where on the net they go when they are at home doesn't it? I've always resisted the temptation to look at the history logs when reparing leporetic teachers laptops.
Geoff Posted June 15, 2005 Posted June 15, 2005 Seems I stop having problems with the laptop once the owner gets their quarterly phone bill.
Mungo Posted June 15, 2005 Posted June 15, 2005 We run a central McAfee (Network Associates) EPO server for all our schools. Certainly in the last 4 months McAfee have pulled their finger out in respect of spyware (v8). Licences for the county (4000 seats) worked out at just under £5 per seat per annum (been running it since 4.5.1) But there are added advantages to it also. Had a school wanting to be rid of MSNMessenger from their school (installed by default). Add the .exe to the unwanted programs list and Hey Presto! 220 PC's cleaned of Messenger in the twinkle of an eye. One false move from Nelson Thorn and they are next. Getting it back on there may be a different matter though!
russdev Posted June 15, 2005 Posted June 15, 2005 i have looked very scary and at times had to have quite word with theacher and a child at home has gone on something which they shouldn;t reminding them that it is a ltft... Russ
tarquel Posted June 15, 2005 Posted June 15, 2005 You think they'd have the sense not to do that on school equipment but still... 'thought' does bypass them sometimes lol anything "real" bad should be reported to the police you know - the school cant shout at you for it, nor should they try to either. IMO that is Regards, N.
mrtechsystems Posted June 16, 2005 Author Posted June 16, 2005 Thankyou for all your info much appericated and some really info here think I will stick with forum really good and fast yeah I have no protection at the moment on a Windows 2000 Network apart from Microsoft Antispyware which I run at home I have been told by my LEA that Webroot Spy Sweeper do and Enterprise edtion but I have no feedback from them With regards to the Comment on Websearch I will personnally kill them myself also these auto install toolbars
RobC Posted June 16, 2005 Posted June 16, 2005 Actually, talking about toolbars... Does anyone else have a problem with the Yahoo toolbar installing on their IEs? I've blocked the toolbar download URLs for both Yahoo.com & Yahoo.co.uk and yet people are still ending up with this on their systems. Ordinarily it wouldn't be a problem, but we use Symantec Web (in)Security for web filtering & for some reason, if the Yahoo toolbar is installed, SWS will not authenticate the user. I've tried contacting Yahoo, but got nowhere very fast. And while I'm rambling on... if anyone else does use SWS, have you got Firefox to work with it? Firefox seems to do the same thing as the Yahoo toolbar, but I really can't figure out how to solve it. RobC.
russdev Posted June 16, 2005 Posted June 16, 2005 You think they'd have the sense not to do that on school equipment but still... 'thought' does bypass them sometimes lol anything "real" bad should be reported to the police you know - the school cant shout at you for it, nor should they try to either. IMO that is Regards, N. yes and would well would report it to my manager etc... most stuff found was where it was fairly obvious look at it that a kid was on it due sites around and near it most time has been google images putting naughty words in. quite word usaaly sufices as you remind them it is a school laptop and next will have to go higher and suprise suprise they don't let there kids on it. But would always report anything really bad... Russ
tarquel Posted June 16, 2005 Posted June 16, 2005 I find strange that they cant find £400 on a basic system for home - i.e. for the kids - but what do I know? lol We bought 3 laptop's about 4 years ago that were *meant* to be for any teacher to use and then bring back. Amazing how only 4 teachers seem to have them continually when they are meant to be for all tachers "when they need them" but there I go again (digressing) Regards, N.
tarquel Posted June 23, 2005 Posted June 23, 2005 Just for info/reference - I use the following antispyware programs: - Spybot - Search and Destroy - SpywareBlaster for limited protection i.e. havent configured a way of protecting each user but its not high priority atm as local machine will be protected this way (I think)... For cleaning spyware, I use: - Spybot - Search and Destroy - CWShredder - HiJackThis Havent had to use Ad-aware yet. [btw - I have made a few silent/automated install version which u can fetch from my site - see sig - but no msi versions ....yet] Altho the above method doesn't allow for updating them continually, if you reimage the main IT suites often, then it shouldn't be a problem i.e. if you notice a machine acting oddly and find the cause to be spyware, you can just update the computer image and redeploy but so far so good atm. Plus content filtering will help here if the proxy server/filtering system you use has spyware definitions/filtered sites. Regards, Nath. PS Mark - powys' does now these days but it aint foolproof i dont think so a bit of added protection is always handy
MkII Posted June 23, 2005 Posted June 23, 2005 Just checking a room of poorly PC's: 1 had 650+ instances of a tracker and another 850+. Put Spyware Blaster on them and removed with Adaware. On one IE is totally corrupt - loads up but with a blank screen - removed and re-installed but no good. Just fighting the bios to let me re-image...
tarquel Posted June 24, 2005 Posted June 24, 2005 Have you tried HijackThis to remove the probable hijacked entries causing the blank screen? uninstalling/reinstaling IE or XP usually wont make a difference btw - reason being that in reinstalling either, it generally preserves the registry entries - and thats where the spyware entries are lurking and in so doing the reinstall, will solve nothing (hope that makes some sorta sense lol). I'm happy to say that there isn't a bit of spyware that I've seen that has beaten me yet - and in the past two/three years - I've seen ALOT! lol 99% out of school tho. Cheers, N.
Inox Posted July 29, 2005 Posted July 29, 2005 Guys, have a look in the download section...I have posted a program called HITMANPRO in there, this automates scanning for spyware/adware for you and it uses most of the top tools to do it (i.e. it incorporates adaware/spybot/CW/etc). It's really good and detects more than each single program does
Inox Posted July 29, 2005 Posted July 29, 2005 Mark - there is....if u download it and install it (to do so, just keep clicking the next button and dont change anything. The 1st time u run it it will do an update and restart, then it's all in english ;-p
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now