Blocking fake antivirus

AtomBomb

So I manage a computer network with about 120 or so PCs. It's always been an issue, but lately it seems that we're seeing a lot of the fake antivirus type infections. They're usually not too bad to clean up (they're usually isolated to a single user profile), but if there is something I could put in place to stop them before it happens that would be awesome.

Some relevant info:

* Machines are XP Pro
* Users are defined as Power Users and I can't really change that
* We have Symantec Endpoint Small Business Edition, which seems to do fine with traditional viruses
* Users aren't very sophisticated. I've trained them what the real AV looks like and how to avoid these infections, but they will get confused and click everything. Also, we have part-time employees who don't give a shit and will install Gamevance or whatever they can find.
* Budget is very tight, so free is best
* Machines have to run IE8

Halp?

ATIRage

Man, I know you want something that is free but my experience is that the paid for programs, like NOD or kaspersky, are the kinds that are more able to scan registry files and clean things up and recognize fake anti-virue programs. There may be cheap network administrator versions of these programs that have a high number of licenses for you to install on your computers.

I've tried ad-aware for this and it has never been able to rid me of fake anti-virus software

You might try Microsoft Security Essentials (it is an independent pack of security programs created by microsoft engineers, type the name in google and it should directly link you to teh download, it is free to boot).

Good luck man

JLM-AWP

I manage a 150 user environment as a system admin, and we use Trend Micro for anti-virus and anti-malware. While it tends to work pretty well, and catches all kinds of trojans on a daily basis, it just cannot prevent this sort of attack. It's not really their fault...the spyware and malware versions change so frequently, that all companies can do is obtain them ASAP and create definitions to pass out to user as quickly as they can.

One thing you COULD try is SpywareBlaster. I've used it on all of my personal PCs for years, and it seems to be pretty preventative. It's silent and requires manual updating unless you pay for it (which can be worked around via a batch script if you push a logon script daily).

For removal, which sounds like you already have covered, I always defer to Malwarebytes, as it is the best anti-spyware program ever created - free or not.

One thing I have done as an alternative to prevention, is to warn and re-warn my users of this sort of thing and ask them to contact me ASAP if they see something of this nature. The less they click and the less time it has to spread and invite other spyware to the party, the better.

Good luck man.

EDIT: And to make your life easier, I would HIGHLY consider removing local admin rights from your PCs. It will save you immense headaches.

EDIT EDIT: Nevermind, I just re-read and saw the power user thing.

Nightslyr

You may want to ask in one of the appropriate threads in our technology sub-forum: http://forums.penny-arcade.com/forumdisplay.php?f=56

AtomBomb

Thanks everyone

I use Microsoft Security Essentials at home and it's great. They had a bad experience with it before I got here (which makes it more than 3 years ago, people remember a bad experience) which makes them kind of hostile to it.

I think I'm going to give spywareblaster a shot. I'll put it on some of the more "high-risk" PCs I have and see how it goes. I do some stuff with scripts, but I'm self taught so I need to do some more research. Specifically, how to make a task not run if it already has run. For example, if there were daily updates but people were logging in and out of the PC multiple times per day.

Yup, I use Malwarebytes for removal, and it crushes these things 90% of the time. CCleaner is decent for finding all the registry entries at once as well. Sometimes MBAM will clean the infection, but users will still see error messages when startup tries to run some of the now deleted files. CC fixes that pretty easily.

I'm reading through the tech forum now, some good stuff there.

JLM-AWP

AtomBomb wrote: »

I think I'm going to give spywareblaster a shot. I'll put it on some of the more "high-risk" PCs I have and see how it goes. I do some stuff with scripts, but I'm self taught so I need to do some more research. Specifically, how to make a task not run if it already has run. For example, if there were daily updates but people were logging in and out of the PC multiple times per day.

If they were logging in and out multiple times a day, just use a switch at the end of the command to overwrite with essentially a "yes to the re-copy" command. I forget it off the top of my head. If you do a Google search for "Logon script switches", you'll find a lot (a LOT) of methods you can apply to make things easier for yourself on a daily basis in various programs and functions on the network.

For SpywareBlaster, it might be tedious to update with the daily definitions...and this is why there is really no perfect solution to the problem. You're damned if you do and you're damned if you don't with this type of stuff. What I would do is see if you can install it to a server or shared network location. Once you have that set, find the folder that SWB updates to, and have that copy down to all other PCs using the login script. You'd want to do an xcopy command, and just move everything in the network folder to the local installation folder for each PC. If you choose this route, don't forget to set office-wide permissions on the network folder so the script can see and pull from it.

Hope this helps. God speed.

TetraNitroCubane

In this situation I highly recommend combining Limited User Accounts with a Software Restriction Policy. That would make your woes disappear overnight, more or less. However, since your hands are tied and each user needs to be a 'Power User', I assume you mean that they all need administrative rights. That sucks in an environment where you're responsible for 120 computers. You're never, ever, ever going to find an active solution (i.e. always-scanning program) to block the rogue anti-virus suites. They're changed pretty much every hour to circumvent new definitions, so traditional, legitimate anti-virus programs miss them all the time.

Some things I'd recommend would include the following (keeping in mind I'm no expert):

• Forcing all of your users to run web-facing applications (particularly browsers) in a dropped-rights environment. The users themselves would still be administrators, but the programs they'd be browsing with wouldn't have administrative access. Check out DropMyRights as a possible solution for this.
  
  
• You said these machines are running on XP. Do they need to be consistently updated? Would a solution like Deep Freeze, or Returnil be applicable? These might confuse users more than help them, though.
  
  
• Since you're encountering the malware on a regular basis, browsing in a sandbox would be ideal. This has the disadvantages of being either (1) confusing for your users if you use a virtual machine, or (2) costly if you use a solution like Sandboxie, which would require a license for each machine. Honestly, having properly configured Sandboxie setups for each machine would be the most transparent solution available (with a bonus of having dropped rights functions included), but it'd cost you some dough, for sure. I'm not sure if the developer is willing to offer a discount for bulk, but the licenses are one-time only.
  
  
• Edit: I just remembered - If you're on XP with these machines, there's a freeware solution that might be very similar to Sandboxie. Check out GesWall from Gentle Security. I admit that I'm not terribly familiar with it, but it might be a good preventative measure at zero cost.

There's some more passive protection-type info, and more detail on the options I just described, in this post of the security thread, if you want to take a look.

Hevach

I've set up Geswall with success. I prefer Sandboxie, but the cost will rack up fast on that many systems.

Just to share the pain, the last few months rogue antivirus programs have become particularly aggressive, they're popping up more than I've seen before and many are nastier to clear out once they're in. Nearly all my service calls this week were for them, and I've started encountering ones that are difficult to immediately distinguish from real programs, primarily AVG but I also ran into an Avira clone just today.

My biggest fear is that one of our home users who uses AVG gets the AVG clone. I couldn't immediately tell it wasn't actually AVG, only the fact that the user told me he never installed AVG clued me in, I was actually trying to use it to track down the rogue at first.

CptnNick

Also block browser popups, I belief that will stop those fake pop ups generated by bad ads/sites.

TetraNitroCubane

CptnNick wrote: »

Also block browser popups, I belief that will stop those fake pop ups generated by bad ads/sites.

Oh holy cripes on toast this. I completely forgot this, but blocking ads, blocking javascript, and blocking Flash should be a high priority for the browsers. If you can whitelist javascript and plugins for only the sites required, you can cut most of these things off at the legs before they launch.

The primary attack method is to hide a redirect script somewhere in a compromised webpage or advertisement. Then that boots the user to a malicious page that usually relies on javascript to scan for day-0 exploits, and/or uses a fake window to coax the user into downloading and running the payload. If javascript and flash are disabled, or are only allowed on trusted domains, the redirect in this case will just give the user a blank page.

Also, one thing that can make life a lot easier: Disable javascript in Adobe Reader/Acrobat.

AtomBomb

Lots of good tips here, thanks all. It will take me a bit to go through them all. I'm going to try a few on my machine and see how it goes. A lot of the permission issues we have are related to old and/or shitty software that needs elevated permissions to run, along with some browser based stuff. Unfortunately it's all kind of propreitary and specific so I can't get rid of it, and everyone has to use it.

I really like the idea of dropping the rights that the browser runs under. That's pretty slick.

Willeth

Are you in a position to write a proposal for a computer safety course for the company? Better-educated users is the best way to stop this stuff, and if you can pull numbers into it saying that if x users are prevented from clicking popups and infecting y computers, then that gives you more time to do z for the company which will make them $babillion, it'll make it much more likely to pass muster. It'll also get you credit for being pro-active, company-minded, thinking outside the box, and other buzzwords.

TychoCelchuuu

This costs money, but instead of doing any or all of this you could just get something like Deep Freeze and just restart the computer any time it gets a virus. Depending on your setup it might not work, but if it's a fit for your needs then it'll save you tons of time.

AtomBomb

Training would be nice, but it's 120 computers and 500 users (with a decent turnover) so I don't think it's my best option.

Deepfreeze and the like are rad, but it won't work in my situation. It's really great for public access type PCs though.

NailbunnyPD

Are you open to switching AV software? Does Symantec update often enough, and do you have the software set to grab those updates as often as they come out? I like NOD32 because ESET is pretty responsive to new threats, and updates are pushed out multiples times a day.

Can users accounts be demoted to standard users, and elevated to Power Users as needed? I do this for problem users when I have to clean their PC more than once. Basically, I have a Local Admin group which is assigned to the Administrators group on the local machine. By default, every user is a member of this group, but when they prove they can't be trusted, they are removed. If there are software updates that are due to be installed, they are added back into the Local Admin group temporarily.

Spudge

AtomBomb wrote: »

Lots of good tips here, thanks all. It will take me a bit to go through them all. I'm going to try a few on my machine and see how it goes. A lot of the permission issues we have are related to old and/or shitty software that needs elevated permissions to run, along with some browser based stuff. Unfortunately it's all kind of propreitary and specific so I can't get rid of it, and everyone has to use it.

I really like the idea of dropping the rights that the browser runs under. That's pretty slick.

My previous company had this. Their workaround was archaic but it did...work..around the...situation as it were

Instead of launching the original application (requiring user to be power or above) they created a new .exe that automatically run the application under the local admin account. Like an automatic "run as" without any input needed

It worked but we could not change the admin password as it was tied to so many different processes. I guess if you keep a good handle on what processes are done you could change the password and pass an updated .exe to the affected machines...

edit something along the line of this

illig

AtomBomb wrote: »

Some relevant info:

* Machines are XP Pro
* Users are defined as Power Users and I can't really change that
* We have Symantec Endpoint Small Business Edition, which seems to do fine with traditional viruses
* Users aren't very sophisticated. I've trained them what the real AV looks like and how to avoid these infections, but they will get confused and click everything. Also, we have part-time employees who don't give a shit and will install Gamevance or whatever they can find.
* Budget is very tight, so free is best
* Machines have to run IE8

all that, plus your insistence that a program like Deep Freeze can't be used leads me to believe that the problem is not the virus, but the company's strange hangups about implementing proper desktop security

i know your budget is essentially $0, but you should really consider starting to educate the higher ups about the benefits of having a more controlled computing environment... either through strict user controls, or proper software that takes care of problems when they pop up.

you can for example have the machines do a recovery point every night - and then if something goes wrong during the day you simply recover to the known good state (poor man's version of deep freeze basically)... and i'd definitely demote the users to something with less ability to fuck with the OS

if you can do the above on a demo machine, and then show your bosses that a bad infection can be taken care of quickly or avoided entirely, maybe they'll relent and let you roll out to your entire user base? effort spent here will save you 100x the effort of rescuing pwned machines every few days

just my $.02

Trentus

This certainly isn't a perfect solution, but you could use a filtering proxy to deny access to hosts that serve the malware (provided you have one of course). Alternatively, there's a bunch of community maintained hosts files around the web that remap bad hosts (malware, ad servers, probably shock sites and stuff) to the loopback. It wouldn't be too hard to push the file to each machine. Of course, a host not on the list will still be able to serve up some nasties, and there's always the chance of false positives, but it'd at least stop your users from downloading stupid shit.

oldsak

We have both tight user controls (though they do seem to get more lax every year) and make attempts at user training campaigns, but we still get these kind of things every so often.

I just delete the user profiles. I consider it a form of negative reinforcement.