Online Analysis Of Suspicious Files

Let's say you run any one of my favourite problem analysis or detection tools, such as:

• Autoruns.
• HijackFree.
• HijackThis
• Port Explorer.
• Process Explorer.
• TCPView.

and you find one or more mysterious entries. What do you do now? Kill, then delete the processes? It may not be quite that easy - or that safe. Please, research what you're deleting, and the possible consequences of deleting it, BEFORE you do so.

A lot of malware today will install itself in a package - creating 2 or more processes on your computer. Also, some security software, badly designed, may protect you, but may use names, or other identity elements, that may give it the appearance of malware.

It's relatively easy to identify a single, active process that steals your passwords, throws ads on the screen, or creates links to distant, mysterious computers.

Some malware, though, will package itself in 2 or more components. It will include protective components, that ensure that the other process(es) continue running on your computer, even if you try to delete or kill them. When the protective processes detect that the active processes were deleted or terminated, it will make new copies of the other processes, frequently using different names, and restart the bad active processes.

Delete or kill one program, and suddenly you'll have a second program (maybe with a different name), doing the work of the process that you just killed. You have to kill the background protective processes first. When you find a suspicious file or process, examine it, and ensure that there's no other process referencing or protecting it.

There are several web sites where you can upload any suspicious file found on your computer, which will submit your uploaded file to multiple scanning engines for intensive analysis. Just go to either website and upload the file using the web page. This takes maybe 30 seconds to upload a file, then wait 5 - 10 minutes for a free analysis.

• Jotti
• ThreatExpert
• UploadMalware
• VirusTotal

Examining the logs from any of the above utilities, do you see any malware identified? If so, don't panic - do some research. Note which scanning engines detected the malware, and cross-reference those to free, online system scanning services.

In order for a protective bad process to restart a protected bad process (one that's detected by HijackThis), the protective bad process has to contain some portion of, or reference to, the active bad process. Any individual scanning engine (called by Jotti and/or VirusTotal), that can find malware in an active bad process, should similarly be able to find the same malware in any other file on the computer, if additional bad files exist. Running a whole system scan, you look for other files that contain the detected malware.

Pick one or more of the scanning services which identified the malware, and do a complete system scan. Either a HijackFree, or a HijackThis, log is a good starting point; but both HJF and HJT are limited, in that they find malware using established patterns. Make sure the malware you are experiencing is not in other places too. Use all possible analytic tools.

In the case of very well written malware, it may be very difficult (if not impossible) for YOU to identify, and delete, all components of the malware simultaneously. Its protective processes may be written to detect your feeble human actions, and it can restart itself faster than you can kill or delete it.

But don't despair! Just identify all components of the malware at any time (without killing and / or deleting anything). Then use Pocket Killbox. You identify ALL of the bad files or processes to Pocket Killbox, and Pocket Killbox takes care of them for you. It's like having a team of well trained snipers, each aiming at a different bad guy. firing simultaneously, and killing all of the bad guys without warning any.

If you have any doubts about this technique, or if even Killbox can't get rid of the bad stuff, remember the Expert Help Forums. Any time Jotti or VirusTotal identifies a bad file, spend some time searching thru 2 or 3 of these forums. Find out what techniques and tools are currently being used to remove the identified malware. Again, Strength Thru Diversity.

Just don't guess at the problem. Use the power of the web, and work from the experience of those who have already dealt with your malware.

Now for the bad news. Some malware may protect itself, from being deleted or interrupted, by hiding itself. You cannot delete that which you cannot see.

As malware has evolved, the properly designed anti-malware protection will also scan each web page as you surf the Internet. In some cases, you should have access to an OnLine Web Site Analysis product.

>> Top

Computer Uniqueness

My personal theorem is that, outside of computers owned by large corporations that have a standard hardware and software configuration, and a very strict Corporate Security Policy, there are not any 2 computers in the world that are identical. Consider just a basic list of factors:

• Hardware configuration.
• Software configuration.
• Ownership policy (CSP, if one exists).
• Individual usage.
• Network usage / Internet connectivity.

Each of the above factors will cause some varying complement of files - configuration, data, software - to be placed on a given computer, or group of computers. This variance in files, and in computer use, affects what malware may or may not be found on an individual computer, or on any network.

That being the case, any set of computer problems (or symptoms) should also be regarded as unique. This is why I recommend diagnosing any computer problem as unique.

Take, for example, the "access denied" symptom. Look at how many possible causes there are for that simple message. Now consider how many different ways that message might be interpreted, by different people.

So, please don't assume any "one size fits all" application of a symptom, to a diagnosis. One of my pet peeves is someone who accepts advice in a forum, is given a very simple solution (following considerable diagnosis work, to find the specific cause) to what appears to be a common problem, and then tries to advise that simple solution to other folks later asking for advice, in that forum.

If you go to the doctor with a cough, he prescribes a certain medication to you, and you are cured, would you stand outside the pharmacy and recommend that medication to everybody approaching the door? I hope not. Please don't be that guy.

Also, I hope that you wouldn't go to the doctor and say

My neighbor had this cough, and you gave him x medicine. I have the same cough, and need the same medicine.

Nor should you go into a forum, and post your problem report at the end of somebody else's problem report. Solve one problem in one thread, please, and let the doctors do the diagnostic work.

Approach every problem with basic and methodical diagnosis. Whether the complaint is about lack of Internet service, about inability to share files, or about unknown programs running on your computer, diagnose each problem methodically, and from the bottom up. And protect your computers, using a layered security strategy.

Analyse every computer network, and its security needs, individually. To debate any one characteristic of an operating system, such as Linux vs Windows, as being inherently more secure or stable, while ignoring the infrastructure where it is used, is so much Hoya. The security of the operating system, on any computer, can only be assessed, and improved, based upon the total environment in which it operates.

>> Top

MAC Addresses

The MAC, or Media Access Control Address, is one of the most vital identity elements in computer networking.

Every addressable network device, be it a managed switch, modem, network card, or router, is assigned a unique address when it is manufactured. The MAC address has a format

xx-xx-xx-xx-xx-xx

where each "x" is a hexadecimal character. The string of 12 hexadecimal characters is assigned, intentionally, by the manufacturer, to prevent duplication by any other networked device, either now, or in the future.

Some misguided persons believe that changing the MAC address of their computer (network card) is a way to hide themselves, or to change their identity at will. This is an erroneous assumption, and can lead to worse problems.

• You absolutely must have a unique MAC address on all networked devices, in any connected network. If you go changing this identity element, and cause a conflict, you could cause yourself and other people grief.
  
• If you change your MAC address in an attempt to change your IP address on a public Internet service, you could cause pain for a few people, including another subscriber, and the ISP. Changing your IP address is yet another form of Security by Obscurity.
  
• Note the MAC addresses do not pass between routed network segments, they are only seen by other hosts on the same subnet. It's possible that, if you setup a network device on your computer with a phony MAC address, that's unique on your subnet, one day you may carry that computer to a network where that address is legitimately in use. Either your computer, or the legitimate owner of the address (and probably both) will suffer from your hijacking of that address.

There is one specific situation where your MAC address should be changed. In any other situation, changing the MAC address just isn't a valid solution.

If you need to associate a MAC address with its vendor, the IEEE OUI / Company_id Assignments database can be searched for this information.

Problems With WindowsUpdate

When it comes to keeping your computer stable and secure, one of the most necessary utilities available is WindowsUpdate. Whether you run WindowsUpdate manually, or let your computer download and update automatically as updates are offered by Microsoft, WindowsUpdate just has to run.

What do you do if it doesn't run successfully? Well, you don't have to accept its failings blindly; you can interrogate the Windowsupdate.log file. In (KB902093): How to read the Windowsupdate.log file, you can see how to diagnose problems with WindowsUpdate.

There is one immediately possible cause for a problem here. If you are the victim of a DNS problem, whether an actual DNS server issue, or a Hosts file problem, WindowsUpdate access can be blocked. This could be due to either your error in configuration, or a DNS hijack by malicious code (aka hacking).

Server Access Authorisation

Authorisation for network access, to shared data on any Windows server, requires you to make appropriate permissioning entries in two distinctly separate Access Control Lists. Both lists are accessed, as indicated, from Folder Properties.

• Share Permissions ("Sharing - Permissions").
  
• NTFS Permissions ("Security").
  

Note that the term Windows server can refer to a computer running any actual server Operating System, such as:

• Windows NT Server
  
• Windows 2000 Server
  
• Windows Server 2003
  

or it can refer to a computer running any desktop operating system, and working as a server. Any Windows desktop operating system will run as a server, unless otherwise configured.

• Windows NT Workstation
  
• Windows 2000 Professional
  
• Windows XP Home
  
• Windows XP Professional
  

Also note that, while XP Home uses ACLs, you cannot generally view or edit them without special procedures.

Share Permissions are explicitly for network access, and NTFS permissions are for local access. Network access requires the sum of the two. You need either Everyone, a relevant Local Group, or the specific account, setup with sufficient rights in BOTH lists.

A simple procedure is to grant Full rights to Everyone, on the share permissions, then grant restrictive rights to the individual accounts or groups, on the NTFS permissions. A more complex procedure is to set both share permissions, and NTFS permissions, precisely as required (and no higher than required) for each specific account or group.

The resulting network rights are the more restrictive of the two lists, if different.

• If Everyone has Full Control for Share Permissions, and an individual account has Read for NTFS Permissions, network access, for the individual account, will be Read. The owner of that account will have read-only access, whether accessing network shares, or when using the server from its desktop.
  
• If Everyone has Read Access for Share Permissions, and an individual account has Full Control for NTFS Permissions, network access, for the individual account, will still be Read. The owner of the account will have write access when using the server from its desktop, but like everybody else, will have read access when accessing network shares.
  

In cases where some files or folders are accessible, but not others, the NTFS permissions may be corrupt. You have various possible remedies here.

• Correct the problem from the Security tab.
  
• Correct the problem using the CACLS utility. CACLS is a simple solution, when you need all files and folders permissioned identically.
  
  
  
  • Open a command window.
    
  • Position yourself ("cd ...") in the folder corresponding to the share in question (maybe C:, for instance).
    
  • Identify the account or group to which you wish permissions be granted (In this example, the group Everyone), and the type of permission to be granted (in this example, Full permission).
    
  • Enter:
    

    
    cacls *.* /t /g Everyone:F
    

    
    Note carefully the words (sequence of non-blank characters), separated by spaces, in the example above. The spaces in the example are essential. There are 5 words in this example: "cacls", "*.*", "/t", "/g", and "Everyone:F". Don't omit the spaces between the words!
    
  
  This is a simple example; the CACLS command has many options. Read the article linked above, or enter "cacls /?" in the command window for details.
  
• Correct the problem using alternate techniques.
  

>> Top