Technomagic

Tricks of some Rogue/Fake Antivirus

David — Tue, 21 Jun 2011 20:40:08 +0000

Haven’t had a chance to update in while like I have wanted to, but felt that I needed to make an effort to share some of the tricks I have had to fight lately. I see a lot of articles out there about Rogue AVs and Fake Security warnings, but unless you search specifically for the one that has grabbed you by the short hairs and not let go, you don’t see a lot of information on fighting them or even what you should watch out for when trying to fix the damage they have wrought on a machine. So I’m going to pass on a few words of wisdom, and while this may read like a general how to, bear with me, you will be rewarded with some insight that can make your fight easier. First things first, DON’T reboot the machine multiple times letting the infection dig deeper and deeper. DO disconnect it from the network, and any USB drives etc. immediately. Power the machine off, not by clicking through the Start Button in Windows, but by holding the power button in until the machine turns off. Boot up off of a recovery CD/DVD of some kind, I like to use UBCD4WIN myself, though Hiren’s BOOT CD works well too.

Since most of the Rogue AVs out there are good at hiding from anti-virus programs, you’re going to need to do a few things to make the system usable again, including scanning the system from the bootable disk. However, you first need to look in the Documents and Settings Folder, both under the All Users folder and the folder for the main user, these are hidden folders so make sure you have the ability to see hidden folders turned on. Alot of the things out there have gotten smarter and started putting files in the All Users/App Data folder to be started with Windows on boot up! This can make it a real pain when you are looking for the exe and dll files in the main user profile and not seeing anything thinking MAYBE you caught the infection before it got in, only to get sucker punched later. Some of the ones I have seen put the files in most of the user directories so that no matter who you logon as you launch the nasty little bugger again. Standard clean up procedures apply, as I have described in one of my earlier posts, making sure to fix all the registry entries.

The nastiest new trick I have seen is the changing of ALL the folder and file permissions to be Hidden/System files. This means that Windows will boot but all the data seems to be missing from the system, and most programs will not run. There is no easy way that I know of to completely reset all the permissions, the best solution I have found is to remove the infected files, then do a System Restore from a few days previous to reset alot of the permissions. The problem with this method is that it doesn’t always reset the User Profile folders to be not hidden. Also depending on when you picked up your unwanted guest, you may have just restored it along with the folder permissions. Another nasty little trick is to change the registry entry that controls how Windows handles exe files. This means when you click on Adobe Reader on your desktop for example, it won’t launch because it is looking for your unwanted guest so it can launch IT then either launch or prevent the launching of the program you actually tried to run. I use the following to change it back, usually loaded from a USB thumb drive:

[HKEY_CLASSES_ROOT\.exe]
@=”exefile”
“Content Type”=”application/x-msdownload”

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@=”{098f2470-bae0-11cd-b579-08002b30bfeb}”

[HKEY_CLASSES_ROOT\exefile]
@=”Application”
“EditFlags”=hex:38,07,00,00
“TileInfo”=”prop:FileDescription;Company;FileVersion”
“InfoTip”=”prop:FileDescription;Company;FileVersion;Create;Size”

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@=”%1″

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
“EditFlags”=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@=”\”%1\” %*”

[HKEY_CLASSES_ROOT\exefile\shell\runas]

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@=”\”%1\” %*”

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@=”{86C86720-42A0-1069-A2E8-08002B30309D}”

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PEAnalyser]
@=”{09A63660-16F9-11d0-B1DF-004F56001CA7}”

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@=”{86F19A00-42A0-1069-A2E9-08002B30309D}”

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@=”{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}”

This has worked (so far) every time for me in restoring the normal ability for exe’s to run. I have gotten into the habit of running this reg entry after every time I have cleaned a Rouge AV from a machine, just as a precaution as they are getting trickier to deal with. As always, you should be sure to clean out the temporary Internet files, and check for anything that may have been added to the hosts file, and run multiple scans with different updated anti-virus and anti-spyware programs before you consider a machine healthy enough to be used again. But hopefully this will give you a better insight into what you should be looking for when trying to clean these kind of infections up.

A minor update

David — Tue, 11 Jan 2011 21:29:56 +0000

It’s been awhile since I posted anything, and I do have an article or two I am working on that will hopefully be finished soon to help start off the new year. But for now here is just a quick bit of information or two that can help some others out there.

Lately, I’ve had more and more fake/rogue AV programs popping up and some have taken a new twist. Usually malware installs itself into the currently logged in user’s Documents and Settings directory. But I have a had quite a few that have put themselves into the All users or Default User directories. Fortunately I tend to check those anyway to make sure nothing is lurking in there but it would be very easy to overlook something set to run at start-up in those other user directories. One of the files, as an example; is hotfix dot exe which is a pain as it installs, runs at start-up and prevents Windows from even finishing loading!

As a person who has to support a lot of users and remote locations, it can sometimes be a hassle to get remote process information from a machine. While I know that the command line tools are out there to do it, I am a firm believer in GUI tools. (Show me a command line tool that is more powerful than a point and click GUI version, and you’ve just shown me a GUI version that had a lazy developer who didn’t put all power of the command line version as he should have. But that’s my personal opinion, your milage may vary.) Anyway, a new tool that I found that works really well for accessing and killing remote processes is Remote Process Explorer. It’s free for personal use, around $90 for a corporate license and does an excellent job of letting you connect remotely to machine and see what processes are running, and to kill them. Very much like a task manager for remote machines, I have used it several times to help me kill fake AV programs that are trying to take over a user’s computer and then been able to remove the offending exe and run local anti spyware and anti-virus software to eliminate any thing left behind by the fake AV.

Annual Report ranks Celebrities by chance of Malware infection

David — Fri, 20 Aug 2010 13:21:36 +0000

This dovetails rather nicely with my post on why Porn gets a bad name in the Security industry. McAfee has released a report that shows what the chances of getting an infection by searching for pictures and/or screen savers of popular celebrities. Apparently Cameron Diaz is the most dangerous on the list, meaning that you have a good chance of searching for pictures etc. of her on the internet and getting directed to web sites that have malware on them or hand out infected files. The list is of the top 10, and is also used as a chance to tout why you should buy their product, but it does give you an idea of just how people are being infected simply by looking for screen savers or pictures of their favorite celebrities, and heck the people on the list aren’t even in the Porn industry, just famous in their respective fields. I would be interested in seeing what a report on major Adult Entertainment stars would show in comparison.

Why Porn gets a bad name in Security, and how it’s just like most SMBs….

David — Fri, 30 Jul 2010 18:20:22 +0000

Before I start, let me just say that this is not a post to condemn or condone Porn on the net; this is a post to answer some questions that come up regularly from users. Also, it is a discussion between myself and some of my IT colleagues comparing porn sites to SMBs. Almost every time I get a request to take care of malware or virus infections on a machine, I get the inevitable comments about the user not going to porn sites, never looking at those kind of things, etc. And of course, that usually means they think that you only get infections from porn sites. I will then explain some of the different ways you can get an infection. The conversation usually goes to “Well, why is it that they always talk about getting infections from porn sites?” That’s because they get the most press good or bad, and just about everyone knows that porn is available on the Internet. I thought I would post my two cents to try and clear some of the misconceptions. Since many porn sites are basically Small/Medium Businesses, a lot of what applies to them in this article applies to the clients I have had in the non-Adult Entertainment world.

The following is my view of things, your mileage may vary……

Many of the malware and viruses out there are looking to spread in the best and most wide spread way possible. Since sex, porn, naked pictures of ‘Insert Celebrity name here’ are some of THE most widely searched terms on the net, this is one of the oldest and most popular ways to spread your infection around to unknowing users. Before pop-up ads, banners, phishing, click jacking and the like became the big way to spread malware around, a lot of people would get online and search for pornography, esp the young teenage crowd. And since you could setup a website with almost anything on it, what better way to get yourself a large amount of victims? And, of course once you infect a machine, setting up a few pop-ups on the machine that talk about ‘Hot Girls’ and the like will allow more infections to get in (like any distraction, it’s not what you’re looking at that is the issue, it’s what you don’t see in the background that is the problem) and while it may eventually make the user seek help in getting the machine fixed, the embarrassment and humiliation of having to show those pop-ups to a stranger (or worse, someone you know) can delay the fixing of the PC long enough to enable personal information gathering, use of the machine for storage of pirated files, or use of the resources of the machine to attack other machines to happen. Why use porn? Well because you’ll get more hits from “LIVE! NAKED! GIRLS!” “Click here to see Insert Celebrity name here” “HOT SINGLE MEN/WOMEN/GOATS WAITING JUST FOR YOU!!!!” than you will if you say “LIVE! NAKED! SPYWARE!” “Click here to see how fast your machine can get a computer virus!” “HOT IDENTITY THEFT WAITING JUST FOR YOU!!!!”. Now which is more likely to generate traffic and get viruses etc. spread out farther?

With the ease of the setting up a website on the internet, many people now have a site, from small businesses to people who believe they are the greatest thing to hit the adult entertainment industry since high speed internet connections enabled the downloading of videos. The problem is that many of the adult sites that get setup have a lot in common (when it comes to a lack of security) with small businesses, they just get more press. If a small business gets compromised, you really don’t hear about it. But if an Adult entertainment site (which sells videos, pictures what have you) gets compromised and starts handing out viruses and malware, or worse their customer information, it becomes news on the Internet. The trouble is no matter what the small business site or Adult site are selling, they suffer from the same thing… not enough informative decision making when creating their site. A lot of sites out there are using Apache, PHP, MySQL, and Linux servers but have no idea that after they set them up, they need to lock them down. Sure you can get a site setup and running with an out of the box setup, but you leave yourself wide open to compromise by hacker wannabes, up and comings and veteran hackers alike. And even if you do lock down the server and the software (PHP and Apache seem to be favorite targets as they are so popular) when you update the server, you have to go back over it and make sure it is locked down again. If you’re a web master and have the time to stay on top of the server, this shouldn’t be too bad. But if you’re a small business owner/porn site owner, you most likely are doing the work yourself in between trying to create new content, shoot pictures, create products, manage the business etc. This means that you do not have the time or the knowledge to secure the system and keep on top of the patches etc. Many places have cousin Ralphie’s college bound son/friend of a friend, or a third party company who does the site management for them and again, they may know how to make a web page but not how to secure it properly. Many of of them do not want to spend the money to hire a professional to help them either setup or secure the site because it could cut too deeply into their profit margins. While that may be true, it also may not be true. And it’s better to get help sooner rather than later. I’ve dealt with small businesses (non porn) that have been hacked, and waited until after the fact to ask for help, and generally the damage to the business and cost of recovery outweighs what the initial cost of getting the site secured to begin with would have been. There are always IT professionals who are willing to be reasonable on price and advice that small business owners can turn to. Not asking around, either before or after the fact is foolish in my personal opinion, but it does happen. As I have told many of my SMB clients, do some research on the web, make a few phone calls, find out what some of your peers are doing and see if they have any helpful suggestions about securing your online presence.

Ask the questions first, esp. the simple ones….

David — Tue, 20 Jul 2010 20:49:46 +0000

Honestly, it’s better to ask what you think is a stupid question, then to not ask and suffer the consequences. As an example: one of the clients I work with recently needed to get a piece of expensive software. Instead of asking IT to order it for them, they went online found a really cheap price and ordered it themselves. Now the company does ALOT of business with a reputable vendor, and gets a discount on this particular package through them. Granted they do not get to order the software for $70 instead of $1,300, but if it seems too good to be true you should always question it. So of course when this software came in, (it was from somewhere in Thailand) it had high quality printed labels, no instructions or serial numbers. When inserted into a stand alone sandbox machine (no way were we giving it access to a live machine on the network) it had nothing that set off any malware or anti-virus alarms, but did have a crack directory with a keygen in it. Not something corporate IT wants to see in the building. So of course it had to go up the food chain to some of the upper management, and wrists were slapped, reprimands and apologies made. Now one question could have avoided all of this. The question that should have been asked, was “Can we order this through IT?” Sometimes asking a simple question can save lots of headaches and time.

Password Cards

David — Tue, 13 Jul 2010 19:21:38 +0000

While some people are against writing down your passwords, I for one support and encourage it, WITH the understanding that you aren’t writing it down and putting it on the monitor, under the keyboard or mouse mat etc. I encourage people to write down their passwords and then lock them up, keep them in their purse or wallet etc. Recently I came across this site http://www.passwordcard.org/ which lets you generate a unique password card that you can carry around, use for any site, and even if someone sees it, they won’t know what your password could possibly be! My new favorite thing to tell users about from now on.

Is it lack of understanding? Or a form of denial?

David — Thu, 29 Apr 2010 20:21:28 +0000

I have several clients that I have dealt with over the past few years that run various types of businesses, from Credit Collection to small completely web-based store fronts. And a lot of them don’t seem to get what the big deal about Security is. They search the web or talk to their peers and hear or read about the headaches that Security implementations can cause, then decide that, “No they don’t really need that.” And of course when I try to talk to any of my clients about Security, I make sure that I’m trying to talk to them in a language they can understand, not too technical, but also not talking down to them either. Sometimes I get through, and sometimes I don’t. But I think some of the reason there is so much confusion out there is it has not been explained in a plain enough language for some people to understand why they need it and what they can do to get it. Some seem to think it will cost them a fortune, or be a huge hassle or headache. And some people wait until after something happens to go “Oh! I guess we need to have some kind of security thing now.” I’ll do my best to take a stab at explaining why you need to have security, with examples over the course of a few posts and see if it will be of help to anyone out there.

Where has all the common sense gone?

David — Mon, 05 Apr 2010 18:25:28 +0000

I don’t expect people to know how to do the things I do, but I do expect a bit of common sense to be employed. Case in point, NOT waiting until the beyond the last minute to call in to the IT department and say “I lost the instructions you gave me in both hard copy and as a local file, and I’m in a hotel, can you teach me how to get connected to the hotel’s wireless and how to use VPN for the first time?” Why wouldn’t you ask the IT department for help BEFORE hand? Do you wait to get your inoculations until AFTER you arrive?
Or today’s winner so far “I need my broadband card updated so I can use it while I travel to the Czech Republic. Well no, I can’t connect through VPN or Webex, I’m at the airport now, and I can’t connect that’s why I need the software updated.”
(Of all the days to forget my magic wand! I could just wave it and make it all work!)

Not an April Fool’s Joke

David — Thu, 01 Apr 2010 18:28:30 +0000

This isn’t an April Fool’s joke, I figure there are enough of them out there today, so here is another serious post. Are you giving away wayyy too much personal info on line? A lot of people are without even realizing it. As an example, I have a friend (who shall remain nameless) who posts her current travel bookings through one of the social networking sites. What’s the big deal you ask? Well for one, she is posting when she will not be home, providing someone who knows where her apartment is good times to break in. Also, if she has an ex or someone else who is stalking her, this gives them lots of ways to track her down.
My friend is not alone in this. Many people are learning the hard way that too much information can be a bad thing to pass out. I have another friend who had pictures posted to Flicker, showing off the cats in various poses around the house. Well one of those poses was on the table with the mail, with nice clear digital shots of the name and address on the front of the magazines and envelopes (after I mentioned that, the picture was re cropped to remove that detail). Many people are posting info that they probably shouldn’t through Twitter, Facebook, Linkedin etc. And as the one article below states, these sites don’t just hand out this information to anyone, you have to post it. I know, I’m sounding a bit paranoid, but in this day and age, a little paranoia isn’t a terrible thing. Take the following examples as proof:

Couple believes their house was ransacked by Facebook “friend”

Crooks using Foursquare and Twitter to rob houses

So think about what information you’re handing out on the World Wide Net these days, you might be telling just a bit too much.

Best password explaination I have seen yet..

David — Wed, 31 Mar 2010 18:13:06 +0000

John P. over at One Man’s Blog did a really great article on passwords, how to avoid weak ones and why you should be concerned with the strength of all of them. The only thing I would change would be putting the following parts of the article at the top, not towards the bottom, because I think this will make people want to read it:

“Another thing to keep in mind is that some of the passwords you think matter least actually matter most. For example, some people think that the password to their e-mail box isn’t important because “I don’t get anything sensitive there.” Well, that e-mail box is probably connected to your online banking account. If I can compromise it then I can log into the Bank’s Web site and tell it I’ve forgotten my password to have it e-mailed to me. Now, what were you saying about it not being important?

Often times people also reason that all of their passwords and logins are stored on their computer at home, which is save behind a router or firewall device. Of course, they’ve never bothered to change the default password on that device, so someone could drive up and park near the house, use a laptop to breach the wireless network and then try passwords from this list until they gain control of your network – after which time they will own you!

Now I realize that every day we encounter people who over-exaggerate points in order to move us to action, but trust me this is not one of those times. There are 50 other ways you can be compromised and punished for using weak passwords that I haven’t even mentioned.

I also realize that most people just don’t care about all this until it’s too late and they’ve learned a very hard lesson.”

Head on over to One Man’s Blog and check the article out for yourself, it is well worth the read.