Windows sysinternals

Chapter 18 Malware 433
FIGURE 18-9 Strings revealing malware in the fake Csrss.exe.
Greg has also diagnosed malware files with Strings by discovering text such as “UPX0”
( indicating that the file was packed) or references to “non-professional” PDB symbol file
paths such as “d:\hack.86” or “c:\mystuff”.
Having confirmed that this fake Windows component was indeed malicious, Greg and his
team worked with the Microsoft Malware Protection Center to document its behaviors and
recovery steps and to provide an anti-malware solution.
The Case of the Mysterious ASEP
Greg was assigned a case from a customer representing a large US hospital network that
reported it had been hit with an infestation of the Marioforever virus. The customer had discovered
the virus when its printers started getting barraged with giant print jobs of garbage
text, causing its network to slow and the printers to run out of paper. Their antivirus software
identified a file named Marioforever.exe in the %SystemRoot% folder of one of the machines
spewing files to the printers as suspicious, but deleting the file just resulted in it reappearing
at the subsequent reboot. Other antivirus programs failed to flag the file at all.
Greg started looking for clues by seeing if there were additional suspicious files in the
%SystemRoot% directory of one of the infected systems. One file, a DLL named Nvrsma.dll,
had a recent time stamp, and although it was named similarly to Nvidia display driver components,
the computer in question didn’t have an Nvidia display adapter. When he tried to
www.it-ebooks.info