How do you stop Sony's rootkit at the office?

TalkBack 1 of 25:

Next »

• Thread View
• Flat View

Alternative Method.....

You can use software restriction policies, to;

a. block the Name of the installer executable ( assuming its not something generic like setup.exe or somthing), and possibly the runtime (this may take care of the computers already "infected", although i am not sure of the potential for this to cause stability issues)

b. import the hash value of both the setup file and the executable and restrict access that way.

as always test test test.

disinfection could easily be carried out via wmi filtered computer startup script policy.

enumerate the services and if the DRM service is found run script X.vbs.

Windows 2003 kicks ass.

- Sam

- Sam

Posted by: JoeMama_z   Posted on: 11/15/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now