[Prevent viruses]

[The ACLs I specified ...

With all due respect you didn't specify anything, you vaguely cited ACL's, temp folders, alternate credentials, sensitive areas of the system, services that do not actually require NT Authority\Local System or other unusual priveleges and GPO's.

I do like the approach , but it would be interesting if you could provide some examples, lists of the services, etc.

jaclaz

Touche

I did a rather involved writeup of the general concept a few years ago, I'll see if I can dig up a copy tonight. If I can't, I'll post it when I get back home tomorrow morning-ish. I listed out the various autorun locations, permission examples, and some general guidelines for this.

Unfortunately, this approach can sometimes require tailoring to specific environments; the concepts remain the same though.

[trying a new way of blocking virus's]

Until something comes in over SSL, Flash, Java, or any of the more common methods?

[Prevent viruses]

It's surprisingly very easy to avoid viruses. These are some good points to keep in mind:

1. Try to keep your operating system up to date as much as possible. You're just asking for trouble running a Windows OS that Microsoft no longer provides updates for. Windows XP and on does all of this for you if you remember to set to automatically download the updates.

Patches are great at fixing known vulnerabilities, unfortunately you need to consider 0day exploits and unknowns.

2. Run up to date viruse scanner from a reputable company. Leave it's real time shields enabled.

This is reactive, not security.

3. Dont use Internet Explorer. It never was secure and never will be. Besides, things work better in pretty much every other browser and your safer from viruses.

*If* you know what you're doing, IE is the most secure browser for Windows. I'm not a fanboy, but IE doesn't deserve most of the hatred.

4. Be careful what you install and if it seems very strange, dont use it.

Common sense. Unfortunately eveything seems strange at some point.

5. Be careful what you click on.

Why?

6. Avoid porn, and sites providing torrents or warez as much as possible.

Don't go on the Internet?

7. Facebook applications and games can be full of viruses, you should pretty much avoid most of those. They provide no value anyways.

I don't actually know anything about FaceBook apps. I guess this is correct.

Rather than relying on common and ineffective security theory, why not actually create an effective layered system? Use ACLs to deny execute permission on temp folders for the standard users, configure your browser(s) to run under alternate credentials without read/write access to sensitive areas of the system, and the same alternate credentials technique can be used to run services that do not actually require NT Authority\Local System or other unusual priveleges.You can also use GPO to limit application access to other areas of the system and/or user accounts.

The ACLs I specified to deny execute permission on temp folders can be applied to autorun/load locations in the registry. This I why I specify separate accounts; if by some miracle a malicious application exploits something, even with administrative priveleges write access to locations can be limited to specified accounts instead of groups.

Also remember that every realtime security application you add to a system increases the complexity and attack surface of the system.

[Is a boot scan better ?]

There is a tradeoff in detection capability.

Most active AV evasion techniques can be defeated with a boot time scan, but anything with a custom cryptor (or at least one without a signature) will not be detected. Heuristic detection is almost entirely useless at boot time, not that most AV offerings even have useful heuristic capabilities. Removal is easier, detection is not in most cases.

It's really academic at this point, with a boot time scan not being prevention or security of any sort, it's just another cleanup method.