Real Time Spyware/Malware Programs

M

marley1

Supreme [H]ardness
Joined
Jul 18, 2000
Messages
5,447
So I am getting tired of cleaning up spyware for clients, I have loaded MBAM for clients to run but they still get stuff and then can't run it because of the program being blocked. On business networks mostly just running NOD with OPENDNS, with home users running NOD or MSE or whatever AV they had and have installed MBAM for them to run.

What is the best real time program to install? MBAM realtime isn't suppose to be all that effective but gives automatic updates and scheduled nightly scans. Is there any good programs to run real time? Don't care if its free, or paid for. Would like it to also have a corporate based version.

Thanks,
Dan
 
I think you are running into a more fundamental problem. Users who use an administrator account for general use. Doesn't matter how good your scanners are. If you have employees running as admin, you will always have this problem.

What you need to do is try and enforce good practices. Demote their primary account and setup a new admin account which they will only use when they need to install programs. While you will get complaints, if you tell them why this needs to happen in a respectable manner most will follow. For the ones that say no, and can actually say no, just have your 'I told you so' ready when they call you in a month or two.

Sorry for not answering your question directly, but this is your solution if people do infact have admin access.
 
dont want to change there habits just want something else to maybe prevent.
 
marley1 said:
dont want to change there habits just want something else to maybe prevent.
Click to expand...

If these are business network and every file they need is on a network server why not use something like driveshield?

With a program like driveshield every time you reboot it restore itself to the original image that you setup when you first installed the operating system(whatever else bells and whistles)

Never used any ofthese programs or driveshield, this is just the first one that came to mind.
 
For home users its tough because the best way to prevent getting malware is some type of HIPS program to go along with the AV/Antimalware real time program. But with HIPS they will get popups for allow deny which either will get annoying or they wont know what they are doing.

That said, Id recommend them not to use IE and use something like Firefox with Web of Trust addon which will help them avoid sights with malware and lessen their chances of getting infected. Along with Avast or MSE for AV/Antimalware program. Then once a week scan with malwarebytes. Or go with a full suite like Kaspesky Internet Suite or Norton Internet Suite which basically combine firewall, hips, and av all in one. Those you have to pay for though.

Id recommend also something like Sandboxie which if they do run something from the web browser all they have to do is close the program and clear the sandbox and its like they were never infected. Its virtual machine but just for the program running sandboxed. Has a slight learning curve so you would have to teach them a bit how to use it. Depending if you want to or not.
 
SuperAntiSpyware is one that comes to mind, as does Defensewall. If you head on over to wilderssecurity.com, the programmer for defensewall is on there, I'm sure he'd give you a bulk discount for multiple licenses.
 
entropism said:
SuperAntiSpyware is one that comes to mind, as does Defensewall. If you head on over to wilderssecurity.com, the programmer for defensewall is on there, I'm sure he'd give you a bulk discount for multiple licenses.
Click to expand...

SuperAntiSpyware sucks for real time. It doesn't catch anything. Only their on demand scanner is good. Defensewall is a great program that I think might be too complicated for the average user.
 
On the outside, I've found a very noticeable drop in malware infections at clients I put Untangle at. The Spyware Blocker module does seem to help. And for cases where one seems to still hit a machine...the Spyware Blocker seems to get in the way of the rest of the downloads of the malware, so it's barely a desktop icon and maybe just the setup of the malware program directory. Makes for quick 'n easy cleanup.

Also since upgrading to Internet Explorer 8, which seems to be more secure.

Windows Updates.

Keep Java and Flash and Acrobat updated at clients...since much of the malware uses vulnerabilities in that too.

You already do the OpenDNS....I set that on the servers DNS forwarding, as well as the routers DNS settings on the WAN interface. That helps add another layer of blocking of malware sites.

Due to small business networks being my norm...local users are members of the local admin group. I know that's less secure, and for medium to enterprise networks that have their own full time local IT group it's easier for them to have end users not be local admins, as they can manage their own software. But for small business networks..it's really difficult for them to do that, due to line of business apps program upgrades and other things, it's too difficult for them unless local users are members of the local admin group. So probably over 90% of my setups are like that.

To answer your thread question...I've not tried business versions of antispyware...I've seen screenies of a product that Webroot makes...Corporate Antispyware Protection Edition
http://www.webroot.com/En_US/business-antispyware-ce.html

I wouldn't mind seeing how well that works.
 
You must log in or register to reply here.
Back
Top