Problem Determination: Is it Malware, or something else? Presented by Ken Dwight The Virus Doctor

Transcription

1 Problem Determination: Is it Malware, or something else? Presented by Ken Dwight The Virus Doctor (281)

2 Your Presenter, Ken Dwight Computer professional since 1966 Working in PC environment since 1982, Windows since 1986 Specializing in viruses and malware since 2002 Trained thousands of computer technicians in 48 states, 2 U.S. territories, and 5 foreign countries Based in Houston, Texas

3 Ken s Book Author of best-selling, IPPY Awardwinning book Written for end-user audience, mostly non-technical Copyright 2005, second printing in 2006 Was once available on websites in 11 foreign countries Currently out of print

4 Intended audience today IT Support technicians Outsourced IT Support organizations In-house IT Support departments Computer sales and repair shops Computer consultants

5 Objectives of today s presentation Help you determine whether a problem is being caused by malware or something else Sometimes it s not obvious Sometimes the symptoms are misleading Sometimes you make the wrong guess/assumption Could waste a lot of time in resolving problem

6 Three categories of malware Rogues Traditional malware (viruses, worms, Trojan horses) Rootkits 4 types: o Infected Boot Sector or MBR (Bootkit) o Infected Windows components o TDL3 / TDL4 o Poweliks

7 Sometimes it s easy:

8 Even easier:

9 Sometimes it s not:

10 Wrong Guess #1 Symptom: Message Rogue DHCP Server detected Environment: Windows Server 2003, 8 Windows 7 clients, 2 wireless routers In-house IT Support Tech had spent 2 weeks troubleshooting, manually assigned static IP addresses In < 30 minutes I outlined a troubleshooting procedure Problem resolved 30 minutes later One router had been reset to default configuration (DHCP)

11 Wrong Guess #2 Symptom: Multiple browser windows kept opening Tech had been on-site 5+ hours, running multiple scans with different anti-malware programs Was about to take computer to his shop, continue tests and scans on bench In disconnecting cables, tech saw a wireless keyboard/mouse receiver in USB socket Wireless keyboard in drawer, phone book against it

12 Wrong Guess #3 Symptom: Windows 7 client, more than 100 duplicate processes running o Cmd.exe o Conhost.exe o Schtask.exe Tech had run multiple scans with different antimalware programs Problem caused by running CryptoPrevent and HitmanPro.Alert at same time

13 So, how do you know? Possible symptoms: o Unexpected error messages (MS or not) o Excessive disk activity and/or high CPU utilization when system is idle o Unexplained network activity o Sluggish performance, slow load times

14 Tools of the Trade Task Manager Process Explorer CMD.exe Netstat no Knowledge of Private and Reserved IP Addresses Browser,

15 Task Manager Stage 1 Fresh boot, normal startup On Performance tab, CPU utilization should stabilize at < 10% On Processes tab, Show processes from all users Ensure that only one User is logged on Check total number of processes running o Should be < 100 in most cases for Win 7 or later

16 Task Manager:

17 Task Manager Stage 2 On Networking tab, look for unexpected activity Using Netstat no (from Command Prompt), look for any active connections that are not Private or Reserved IP addresses Tie each PID to Processes and verify legitimacy If unsure, search Whois database to determine owner of IP address (

18 Lookup in

19 Results from

20 Task Manager Stage 3 On Processes tab, add columns to default view o PID, Command Line Sort by Name Look for known malware processes or patterns Look for missing Description Check consistency of entries across columns

21 Process Explorer Based on same information in Task Manager, but with more details Add columns to default view o Autostart Location, VirusTotal Check VirusTotal column for entries in Red Check Autostart Location column for suspicious processes (pink background only)

22 Process Explorer:

23 Symptoms of a rootkit infection Usually no obvious symptoms May cause Google redirects May block ability to manually install Windows Updates May claim that downloaded file was infected, so was deleted May play radio station with no browser open

24 Drilling Deeper Virus Remediation Training One-day (or two half-day) workshop of intense, hands-on training that includes three elements: o Education o Tools o Methodology This presentation is excerpted from that full day of training

25 Training options Public training scheduled in Houston offices of The Virus Doctor May be presented at your facility, on your schedule Some dates offered remotely, so that you can attend from your home, office, or shop Contact for schedule and pricing of on-site training

26 Cost of training Tuition is $495 per attendee ISACA special -- $295 per attendee if 10 or more register for a workshop (or) Discount for multiple attendees from same organization Fee also includes membership in Continuing Malware Education program ROI typically measured in weeks, if not days

27 No-Risk Guarantee Over 95% Success Rate in malware removal Less than 5% Reinfection Rate Less than 2 hours to complete repair/remediation One-on-one assistance by The Virus Doctor with any malware that doesn t respond to this methodology

28 More Information Click here for additional details and upcoming dates for Virus Remediation Training workshops: o Contact Ken Dwight directly for further details or to reserve your seat(s): o kdwight@thevirusdoc.com o Phone (281)

29 Thank you for your attention! Ken Dwight The Virus Doctor