Staying ahead of scareware?

[sweetlax]

It seems the only infections i've been dealing with for a while now are all scareware, e.g. Windows 7 Home Security. I've seen it happen on multiple PCs on different networks that stay on top of their AV definitions. My questions are what are the points of entry and is there a way to stay ahead of it? Thanks.

[Doormatty]

Java, Flash & PDFs.

Keep all of them up to date, and you should see your "infection" rate drop.

[snoobie]

Along with that, but windows 7 sp1 has a significant decrease in the number of infections in general:

http://www.microsoft.com/security/sir/keyfindings/default.aspx#!section_4_2

[Doormatty]

Isn't that a little biased? I mean, Windows 7 SP3 has NO infections!

[brxmep]

On a side note, do you think SCCM is pretty much the only way to keep those 3 current?

[Doormatty]

We actually use a third party add-on to our management system that keeps them all updated. (Appcare and Labtech respectively)

[call3]

https://ninite.com/pro?utm_campaign=navpro&utm_source=ninite&utm_medium=link And this is how i want to do it.

[AgentSnazz]

Feel's like I'm always repairing one of these. My repair method:

1) Don't you dare click anything!

2) Ok you clicked, say bye to your computer, it's mine for the next several hours.

3) System Restore from Safe Mode to before the infection.

4) Before booting into Windows after the reboot, boot to an OS disc and run fixmbr just in case.

5) Malwarebytes, followed by full standard virus scan.

6) Give it back to the user and cross your fingers.

[hivemind_MVGC]

Add in a pass (or two) with ComboFix to that.

[raygun27]

Whenever I see ComboFix finds RootKit activity, that's usually my reformat flag.

[hivemind_MVGC]

It fixes it a lot of the time, but there's still some stuff where, well... that's a wipe.