Stop browser hijackers on windows 2003 terminal server

Posted on 2009-05-12
Last Modified: 2013-11-16
I am currently running Symantec Antivirus Corp Edition version 10 on a Windows 2003R2 Terminal Server.  no other spyware / defender running.  Twice now I have had a users session on the terminal server get infected with one of those "Personal Virus Protection look alikes that wants you to purchase their software to remove their malware.
What would be a good, low resource usage program that I can purchase that will stop these malware's / hijackers from getting on the terminal server from a terminal server session.
Question by:BFanguy
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Expert Comment

ID: 24368361
well your best possible way to do this is dont allow IE to access the internet but only your local network on the terminal server.

but if you cant do this for some reason. you can get either or Spybot S&D (Opensource).
they both have a plugin that will real-time scan the registry for any suspicious thing happening.

personally i would suggest using spywareterminator, cause there the realtime scanner is more simple to understand and handle.
LVL 13

Expert Comment

ID: 24368404
I prefer adaware from lavasoft or spysweeper from webroot

Expert Comment

ID: 24368450
detection rate of lavasoft is not as good as it was once anymore.

 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

LVL 17

Expert Comment

by:Andres Perales
ID: 24368638
Get a web filter...websense is expensive, but OpenDNS is free...give that a try... it will also provide you with stats and the easy as point your clients dns to their servers.

Author Comment

ID: 24368644
Thanks for the comments, but how do these work with Terminal Servers.  i.e. does it load into memory for each different user (sometime i have up to 50 users on one terminal server) or does it load once and monitor as each user accesses the internet.

Author Comment

ID: 24368657
peralesa,  i have cyblock as a proxy / web filter and they still get hijacked...

Expert Comment

ID: 24368765
well, realy, I would not suggest on using the tools on your termianl sever, cause this has some disadvantages:

1. most of them will be loaded into memory per user
2. users might make a wrong decision on a question of those tools and then a service that you need gets dissallowed.

dont do this

is it realy no possibility for you to turn off INTERNET access on the terminal server?
why would they need it anyway? accessing the INTRANET should be enough, cause they can access the internet on their local machine.

Author Comment

ID: 24368846
no local machine access - thin clients.

Accepted Solution

gilget earned 500 total points
ID: 24368917
well then this is gona hurt, believe me.

hmm, you wil need the full package.

get yourself a firewall with a trendmicro module or something similar. this will scan for threads in the code but you also have blacklists etc.... this helps a lot.
also get yourself an antivirus that includes spyware detection.

but realy mate, you will always run into trouble like this- for sure.


Author Closing Comment

ID: 31580690
Thanks for the help

Expert Comment

ID: 24369114
no offence.
i would realy realy suggest you to turn of INTERNET access. or to limit it to only websites that are realy needed.
if you just open the websites you know and that are trusted, then you should be fine too (not 100% but lets say 99.9%).

all the best

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

An introduction to the wonderful sport of Scam Baiting.  Learn how to help fight scammers by beating them at their own game. This great pass time helps the world, while providing an endless source of entertainment. Enjoy!
Curious about the latest ransomware attack? Check out our timeline of events surrounding the spread of this new virus along with tips on how to mitigate the damage.
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

626 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question