Quote:
Originally Posted by FACE411
It's not just "personal security." In my shop I run across dozens weekly.
No software can stop the insertion of these rogue antivirus programs, since the user "willingly" installs it into their machine.
Click sense, or the lack thereof, is the largest contributor of this. A warning box (through IE or FF process) appears and most people do not even read it. A click anywhere in the window installs the software (click-jacking). The only way to prevent this from happening is to open task manager and kill all internet related tasks.
Where does it come from? Mainly p2p networking clients. Secondly, social networking sites, or any site where "code" or user input that accept redirects or html (or similar code) can be setup to hijack you. These hijacks are primarily designed to circumvent or disable most top marketed antivirus software and pretty much any software firewall.
Prevention is almost impossible, since most people do not understand "click sense," and others do not care to learn. I have preached to people, and they will come back to me with the same problem 2 weeks later.
Early detection is the key. I can remove these, if caught early enough, with Malwarebytes, Superantispyware, and Avast (boot time scan) in that order. If too many services are modified, and system files become too corrupt, it is best to backup the data and wipe the hdd's (all of them). I used to leave recovery partitions in tact, but those are no longer safe anymore either.
BOOM!
 |
Yes in a college environment, "click sense" is not there. That is what we do if we catch it, kill the task, even trying to close the pop-up is a no-no.
If we can't remove we also back up and image the drive, then restore settings.
We just had a meeting (I was not in attendance) and they settled on malewarebytes, and adaware. Buying full versions, so we have two to run.
Thinking about doing a write-up on click sense to pass out via bulk email to everyone in the school, and maybe posters to post up. That is one of our biggest issues is dang viruses. I have a pic on my iphone, if I can figure out how to upload it here, it is a computer with about 12 different "anti-spyware" programs on it. Someone got click happy! lol
Thanks again for the input guys. Now lets figure a way to catch the problem at the source
lol