[26351] in resnet
Re: GPO and Fake Antivirus / drive by downloads
daemon@ATHENA.MIT.EDU (Brock, Adam)
Thu May 12 17:56:00 2011
Content-Language: en-US
Content-Type: text/plain; charset="Windows-1252"
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-ID: <316359542.3919965.1305237338219.JavaMail.rim@bda2409.bisx.prod.on.blackberry>
Date: Thu, 12 May 2011 16:55:36 -0500
Reply-To: "Brock, Adam" <Adam_Brock@baylor.edu>
From: "Brock, Adam" <Adam_Brock@baylor.edu>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <EC241569495CF547A4FC05C882C38F218987173905@ALPHA.ad.stetson.edu>
We ran a script that on login that deleted all EXE files from local settings (and subfolders), and also restored the reg keys for the program that was used to open exe, com, bat, and lnk files. When users got infected we just had them log out and back in. Since most of our users weren't administrators
Sent from my Brockberry
________________________________
From: Don Burrhus <dburrhus@STETSON.EDU>
Sender: Resnet Forum <RESNET-L@LISTSERV.ND.EDU>
Date: Thu, 12 May 2011 12:14:58 -0500
To: RESNET-L@LISTSERV.ND.EDU<RESNET-L@LISTSERV.ND.EDU>
ReplyTo: Resnet Forum <RESNET-L@LISTSERV.ND.EDU>
Subject: [RESNET-L] GPO and Fake Antivirus / drive by downloads
Is anyone successfully preventing the Fake Antivirus, drive by downloads, and assorted malware/scareware issues by using GPO?
Anyone got some pointers they’d be willing to share?
-Don Burrhus
___________________________________________________ You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives, go to http://LISTSERV.ND.EDU/archives/resnet-l.html ___________________________________________________
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
