Where does it come from?

[lweems]

Hey guys just wondering if anyone has any insight of where most of this Malware comes from? I have heard of possible exploits in Adobe Reader and Adobe Flash and Java, but have recently cleaned up a machine that got reinfected after all of the above programs were updated. I work in the school system and most of our machines are Windows XP Pro and Windows Vista Business. I would say that about 90% of the machines that get infected are running XP Pro SP3. The schools just purchased Sophos AV and so far that seems to be working, as we haven't seen a machine get infected that was running this AV software. Two of the last infections the teachers said they Googled free lesson plans. I opened the page on my Mac but didn't see anything out of the ordinary.

[Blaze]

What really can help is using WOT, or using (free) software like Spywareblaster.

This will also help prevent infections. Obviously, Malwarebytes protection module will be a very good help.

You can also use hpHosts file.

Googling anything innocent may always turn out to something unexpectedly, so:

- train the teachers some basics of security (don't click anything that pops up, eg)

- use layered security

- be sure to have the latest updates of both your operating system and antivirus-protection.

Hope this helps a bit

[mountaintree16]

Also no clicking sponsored links! http://forums.malwarebytes.org/index.php?s...st&p=139872

And being care of what is clicked on... look at URL's, take a look at what the description is in Google results... Google the name of the website that you are thinking of clicking on if it looks as though it may be suspicious & see if there are any hits and if so what is being said about that website.

[lweems]

Also no clicking sponsored links! http://forums.malwarebytes.org/index.php?s...st&p=139872

And being care of what is clicked on... look at URL's, take a look at what the description is in Google results... Google the name of the website that you are thinking of clicking on if it looks as though it may be suspicious & see if there are any hits and if so what is being said about that website.

Thanks for the advice guys, on some of the computers we have downloaded McAfee Site Adviser and told the teachers only to go to the "green" sites. So far we can't find a common ground other than Google searches that might attribute to them getting infected.

[Sartori]

You might check out this thread:

http://forums.malwarebytes.org/index.php?showtopic=38725

[exile360]

Unfortunately there are many tactics employed by the makers of malicious software. Google and other search engines are prime targets, or at least their search results are, because most people use a search engine to find information. It works on the principal known as SEO, or Search Engine Optimization. They'll use tactics such as spambots that post links to their malicious content on normal sites to increase their search ranking because of the way that webcrawlers work. This article shows how it was done by hacking legitimate websites.

[YoKenny1]

A more recent blog entry is interesting:

Ads poisoning