1

One of the employees called me yesterday because he wasn't able to open any webpage. So I went to see the problem. I tried to load various urls with Google Chrome, but each time I did, the webpage was redirected to the reimageplus website, which was asking me to download software to repair Windows. I tried loading webpages with IE and there was no problem.

I deleted chrome and re-installed it. I also did a virus scan with Windows Defender.

I thought that this would never happen because the user does not have admin privileges.

What is the most likely cause of the infection and how can we prevent it in the future?

Improve this question

1 Answer 1

Reset to default
3

What is the most likely cause of the infection ...

When searching for reimageplus infection I get as the first hit Malware Tips: Remove Reimageplus.com pop-up ads (Virus Removal Guide). There the typical infection vector is described in the second sentence already.

The adware responsible for the Reimageplus.com ads is bundled with other free software that you download off of the Internet. Unfortunately, some free downloads do not adequately disclose that other software will also be installed and you may find that you have installed adware without your knowledge.

And as another early hit from the same search MyAntiSpyware: Remove reimageplus.com pop-up ads (Instructions) explains:

How does a computer get infected with reimageplus.com
... This adware is bundled within the installation packages from Softonic, Cnet, Soft32, Brothersoft or other similar web sites...


I thought that this would never happen because the user does not have admin privileges. ... how can we prevent it in the future?

Installation of software for a local user instead of a system wide installation does not need administrator privileges. You might need to educate your users about the dangers of downloading and running software they just found on the internet or got forwarded by mail. Depending on the security solutions you employ you might also prohibit software downloads.

Improve this answer
4
  • As far as I know the user is not able to run any executable without an administrative password, which they don't have. The user is a regular domain user with no privileges. This particular user also has very limited IT skills and likely would not be able to implement a hack such as an offline registry edit to access the local admin account.
    – Lumo5
    Commented Nov 15, 2016 at 8:47
  • 1
    "the user is not able to run any executable without an administrative password" - so the user is not able to use a browser, office etc without an administrative password? These are all executables too.
    – Steffen Ullrich
    Commented Nov 15, 2016 at 10:21
  • I meant to say that they cannot install a program on their machine without an Admin account.
    – Lumo5
    Commented Nov 15, 2016 at 13:38
  • @Tony: the might not be able to install a system wide application but you don't need an admin account to download an executable file from the internet and execute it. Also no admin privilege is needed to install local browser extensions, place a program into the users Autostart etc.
    – Steffen Ullrich
    Commented Nov 15, 2016 at 13:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .