Windows sysinternals

Chapter 18 Malware 431
The culprit was easy to identify: it had no description or publisher, had the nondescriptive
name “eMpId08200”, launched from the HKCU RunOnce key, was installed under the
C:\ProgramData folder, and to top it all off it had the same icon that the fake anti- malware
displayed. Aaron deleted the ASEP in Autoruns and deleted its files in Cmd.exe. (See
Figure 18-6.) For good measure, he left the unnecessary file-sharing programs and Internet
Explorer extensions disabled. He restarted the computer, which ran without issue.
It is interesting to note that the malware in this case never appears to have used
administrative rights. It installed itself to a user-writable folder and ensured that it would run
again by hooking one of the user’s ASEPs instead of a global ASEP. In fact, the same malware
infected Aaron’s mother-in-law’s Windows XP computer a few weeks later. Because Aaron
had made sure that she always logged on with a standard user account, Aaron was able to
clean the infection easily by logging on to the administrative account, which the malware
had not been able to infect. From there, he ran Autoruns, selected the infected account from
the User menu, and deleted the offending ASEP entry. (Unfortunately, he failed to capture
any screen shots.) The two lessons here are that malware is increasingly able to cause harm
without requiring administrative rights, and that such malware is much easier to clean than
malware that is able to subvert the integrity of the operating system.
FIGURE 18-6 Deleting the malware from Cmd.exe in Safe Mode.
The Case of the Fake System Component
The next two cases were brought to me by Greg Cottingham, a Senior Support Escalation
Engineer at Microsoft. In September 2010, Greg’s team began receiving reports from several
companies of a new worm that was eventually called Win32/Visal.b. Greg was assigned
one such case and began his investigation of a suspected infected work station by pressing
Ctrl+Shift+Esc to start Task Manager. At first glance, none of the processes shown in Task
Manager in Figure 18-7 might appear suspicious to an untrained observer. However, when
Show Processes From All Users is not selected, there should be only one Csrss.exe listed, but
Task Manager showed two. (Task Manager’s Show Processes From All Users option actually
determines whether Task Manager shows processes only from the current terminal services
session or from all TS sessions. See Chapter 2 for more information about TS sessions.)
www.it-ebooks.info