[26347] in resnet
Re: GPO and Fake Antivirus / drive by downloads
daemon@ATHENA.MIT.EDU (Doughty, Marc)
Thu May 12 15:19:51 2011
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=20cf302d4cdcc18ed704a31911fd
Message-ID: <BANLkTikj5yJ5XQA4+9f0coXXr0dR4nnffw@mail.gmail.com>
Date: Thu, 12 May 2011 15:19:34 -0400
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: "Doughty, Marc" <marc_doughty@BROWN.EDU>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <EC241569495CF547A4FC05C882C38F218987173905@ALPHA.ad.stetson.edu>
--20cf302d4cdcc18ed704a31911fd
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable
Greetings,
We're not using this in a GPO, but it could certainly be applied that
way... Just keep a public, read-only share with the latest installers for
Quicktime (quicktime.msi is inside the .exe in the download), Java JRE
(offline installation), and Flash player (google for "Flash Player MSI", ge=
t
the plugin and activex). Then write a startup script that checks for some
sort of 'receipt' for the last update (e.g.
'c:\windows\receipts\plugin-update-20110512.txt'), if the receipt isn't
there, trigger silent installs of all the packages from the share, and leav=
e
a receipt.
- Marc Doughty
"If you aren't sure who is the give-way vessel, you are the give-way
vessel."
On Thu, May 12, 2011 at 1:14 PM, Don Burrhus <dburrhus@stetson.edu> wrote:
> Is anyone successfully preventing the Fake Antivirus, drive by downloads,
> and assorted malware/scareware issues by using GPO?
>
>
>
> Anyone got some pointers they=92d be willing to share?
>
>
>
> -Don Burrhus
> ___________________________________________________ You are subscribed to
> the ResNet-L mailing list.
>
> To subscribe, unsubscribe or search the archives, go to
> http://LISTSERV.ND.EDU/archives/resnet-l.html____________________________=
_______________________
>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--20cf302d4cdcc18ed704a31911fd
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: quoted-printable
Greetings,<br>=A0=A0=A0=A0 We're not using this in a GPO, but it could =
certainly be applied that way... Just keep a public, read-only share with t=
he latest installers for Quicktime (quicktime.msi is inside the .exe in the=
download), Java JRE (offline installation), and Flash player (google for &=
quot;Flash Player MSI", get the plugin and activex). Then write a star=
tup script that checks for some sort of 'receipt' for the last upda=
te (e.g. 'c:\windows\receipts\plugin-update-20110512.txt'), if the =
receipt isn't there, trigger silent installs of all the packages from t=
he share, and leave a receipt.<br clear=3D"all">
<br>- Marc Doughty<br>"If you aren't sure who is the give-way vess=
el, you are the give-way vessel."<br>
<br><br><div class=3D"gmail_quote">On Thu, May 12, 2011 at 1:14 PM, Don Bur=
rhus <span dir=3D"ltr"><<a href=3D"mailto:dburrhus@stetson.edu" target=
=3D"_blank">dburrhus@stetson.edu</a>></span> wrote:<br><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex">
<div link=3D"blue" vlink=3D"purple" lang=3D"EN-US"><div><p class=3D"MsoNorm=
al">Is anyone successfully preventing the Fake Antivirus, drive by download=
s, and assorted malware/scareware issues by using GPO?</p><p class=3D"MsoNo=
rmal">
=A0</p><p class=3D"MsoNormal">Anyone got some pointers they=92d be willing =
to share?</p><p class=3D"MsoNormal">=A0</p><p class=3D"MsoNormal">-Don Burr=
hus</p></div></div>___________________________________________________
You are subscribed to the ResNet-L mailing list.
<p>
To subscribe, unsubscribe or search the archives,
go to <a href=3D"http://LISTSERV.ND.EDU/archives/resnet-l.html" target=3D"_=
blank">http://LISTSERV.ND.EDU/archives/resnet-l.html</a>
___________________________________________________
</p></blockquote></div><br>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
<p>
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--20cf302d4cdcc18ed704a31911fd--
