A member on my staff recently had their work computer compromised while on their home network. The following is the information regarding their computer

  • Windows XP SP3 - fully patched at the time of compromise
  • User runs under the "user" privilege and as such should not be able to modify system files
  • Users computer had on-access virus scan enabled and the definitions were up-to-date
  • Flash is updated in regular intervals through Group Policy

The user told me that the AV caught something a day previous to them discovering their personal bank account had been drained. They stated that computer was the only computer they've ever used to do online banking. They are not sure whether or not they logged into their web banking after the virus alert, but they did tell me they used the "auto-complete" feature of IE8 to save their credentials for the online banking.

My question is what else could we have done to secure this work machine? We don't have the staff power to effectively implement Software Restrictions and working without Java is not an option either as a lot of their online browsing requires them to use Java. As you can imagine I would like to ensure this never happens again and am open to whatever suggestions you all may have.


3 Answers 3


Follow a proven hardening standard like NIST for example: http://csrc.nist.gov/itsec/SP800-68r1.pdf

Implement user awareness security training. http://www.sans.org/reading_room/whitepapers/awareness/importance-security-awareness-training_33013

Upgrade OS and applications. Although supported until 2014, it is unlikely that there will be another major service pack and several vulnerabilities currently exist that will likely go unpatched.


The most effective way to prevent any keyloggers would be the use of virtual machines.

Setting up a virtual machine that reverts to a clean state after every use should effectively prevent any malicious software from recording user activities.

Upgrade to a more current operating system. Windows XP, even fully patched has far too many vulnerabilities.

  • Thank you for your suggestion - Window XPs will be supported until April 2014 actually SOURCE : support.microsoft.com/lifecycle/?ln=en-gb&c2=1173
    Commented Jul 21, 2012 at 3:00
  • @DKNUCKLES Oh, i must have missed that. Edited it out from my answer, but i still suggest switching to a more modern OS.
    – user10211
    Commented Jul 21, 2012 at 3:10

You can download one of the free browsers that delete cookies and erase history. Cookies cyber attacks are famous and this is not the first time it happends

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .