Take the 2-minute tour ×

I see that a lot of computers in our company are getting infected with "Advanced Virus Remover". Teaching the end user is not an option. They will continue to click on all the links on Facebook and in their emails until they kill their mouse.

Is there another way to block this on the firewall? IDS?

share|improve this question
Many business disable website with a proxy. They block webmail and facebook, and many more. Much less trouble that way. –  Michael B. Sep 21 '09 at 16:30

6 Answers 6

up vote 1 down vote accepted

If the users are high company executives, all you can do is babysit their machines. Sad but true. Try to give them two computers if you can, so that company information can't be taken. If you can get them off Windows apps that don't run under Wine, see if you can install Ubuntu on their computers. Call it Windows Ubuntu or something. (Is my cynicism showing?)

Other than that, you've got people who have wide internet access who are doing stupid things and causing problems for the company. (Do they have admin access on their computers? Typically, people with a legitimate reason for admin access are educable.) There's got to be something management can do about this: mandate education, cut down on allowable sites, threaten to cut down on allowable sites, whatever.

share|improve this answer

make the use of virtualization a company policy (e.g. Sandboxie, DeepFreeze) and be done with it.

this way you can focus on your job as a sysadmin rather than being a babysitter and janitor. with that problem solved and your flock being deprived of the means to mess around with their workstations (which greatly contributes to your peace of mind), you start implementing decent web-filtering to keep them in line. :)

share|improve this answer
+1 for DeepFreeze –  alex Sep 21 '09 at 19:47
yep, DeepFreeze will be one tough nut for them crack :) –  Molly7244 Sep 21 '09 at 20:01

In your company, I would block Facebook and similar sites altogether. While it may not be popular with your employees, they should be working, not social networking anyway.

share|improve this answer
Social networking is a tool used, for example, by recruiters. –  harrymc Sep 21 '09 at 17:21
Really? If anyone sent me recruitment stuff over a social network, I'd assume it was spam. Surely recruiters have better methods. Besides, if you were using it as part of work, they would be trained on how not to ruin their PCs. –  Macha Sep 21 '09 at 17:23
@Macha: I know how to use these things, being a long-time software guy. Also, as a long-time software guy, my idea of a work-related social network site is something like SuperUser. People with genuine work-related uses for Facebook tend not to be computer geeks, and aren't going to be as savvy out there. –  David Thornley Sep 21 '09 at 19:33
@Macha: You treat social networking like email or chat. It's much more - it's about constructing a friendship network and using it to reach people. –  harrymc Sep 21 '09 at 20:48

The users at our company are not setup to be administrators on their computer. It is sort of stressful when you have to come out to install every piece of software they might need, but it also keeps things like this from happening as much.

Also as Livinloud stated, many companies (such as mine) block any and all websites that have non work related content or possibly harmful content from being viewable at work.

Those are two routes you can consider.

share|improve this answer

Blocking "Advanced Virus Remover" will not stop current or future attacks by other similar products and you will be constantly fighting a losing battle trying to block everything out there.

Users cannot install applications if they are not an administrator of the local machine. Remove all administrator privileges from all users.

share|improve this answer

Unfortunately, if your users want to install something, they'll probably manage to install it. This is called the Dancing Bunnies problem.

There's a product called Windows SteadyState which can be used in libraries / internet cafe's. This makes sure that the computer can easily be restored to a known configuration. Maybe this is something you could look at?

share|improve this answer
the dancing bunnies of the apocalypse :) –  Molly7244 Sep 21 '09 at 17:13
Hey! there are no dancing bunnies on that site. You cannot put a link to dancing bunnies, and then have no dancing bunnies. –  Tester101 Sep 21 '09 at 19:06

Your Answer


