Looking for infections in greater depth

[LAconsult]

I'm wondering what steps you would use to try and determine whether or not a virus/spyware/malware/keylog infection/infiltration exists that is not being detected by conventional antivirus/MBAM etc. Are there methods to quickly dive deeper that are not expensive, say with packet inspection, or forensics? What is your experience with this?
Thank you.

 

[Disposable_Me]

Always slave the drive and do the scan in a clean computer, if the computer has a rootkit you can't trust the results of the scan.

Other than that, I open up perfmon and make sure there's no suspicious spikes in cpu or network load. Turn off all the startup, scheduled tasks and unnecessary drivers.

Nirsoft's cports will let you see all open ports on the computer, and which application they're bound to. Wireshark will let you go deeper and inspect packet contents, resolve hostnames and filter easily. I run all comps on my work bench behind a pfsense box which has a built in IDS in Snort.

I don't really get to that stage though as I recommend a backup and format if a standard a/v scan and tuneup don't fix it, the chances are it's something way more serious.

 

[ComputerRepairTech]

Well I was told by a reliable source a while back that there were some rootkits that could hide from packet sniffers. Packet sniffer is still part of my toolkit...doesnt hurt to give it a try when I am having trouble figuring out whats happening. Keyloggers on the other hand you can usually catch with a packet sniffer and spam typing a bunch of letters......I like the ones that use non secure ftp its always fun to go in and wipe them out and leave them a picture.

 

[Disposable_Me]

Rootkits by definition are something that's hiding itself from being seen. They hook system calls (functions) and remove themselves from the results. And that's why at that point you need to assume everything the computer's telling you as incorrect and move to external measures.

As far as hiding things from a packet sniffer, most good ones install their own drivers, though those aren't uncorruptible. You can wireshark over a network connection doing a remote capture. Then again you might not find what you're looking for because the data's probably compressed, if not encrypted.

Which is why I bring up formatting the comp, it's usually the most cost, and time effective solution.

 

[othersteve]

The only way to truly know if a system is clean is to manually inspect its files from offline. I personally use OTL under the remote registry hive along with some other tools to pick out critical loading points and other items of interest. I then can also perform driver signature checks to ensure everything is legit.

I may be the only tech in the Louisville area who does disinfection completely manually. But I also have never, and I mean never had a situation where a customer has come back to me with a machine that was still infected when I was finished with it

 

[NYJimbo]

I may be the only tech in the Louisville area who does disinfection completely manually.

Are you saying that you do not use Mbam, combofix, tdsskiller, superantispyware or any of the popular scanners or detection tools as part of your process ?

Regardless of your method of killing active viruses you cant possibly be cleaning a system that has at least 100,000 files by doing it all manually.

 

[othersteve]

Are you saying that you do not use Mbam, combofix, tdsskiller, superantispyware or any of the popular scanners or detection tools as part of your process ?

Regardless of your method of killing active viruses you cant possibly be cleaning a system that has at least 100,000 files by doing it all manually.

That's exactly what I am saying. If you inspect all of the possible loading points from offline and verify the integrity of system drivers, the system can't possibly be infected.

See, you don't have to inspect 100,000 files when only a handful are referenced for boot-level loading. Once the resident memory infections are cleaned, any old AV can handle the rest in a cleanup scan.

Having said that, I DO use TDSSKiller to check the MBR and OTL to pick out the loading points and other items of interest. However, once I'm finished, the final step is always to reboot, maybe run a quick checkup for policy corruption or other leftovers with something like RogueKiller, and finally install an AV and perform a final cleanup scan.

In other words, apart from TDSSKiller/MBR checking, the only automated scanners I use are for cleanup after the system has been cleared of resident memory infections.

If it sounds like it doesn't work, believe me, it does. I have done it with literally thousands of machines to date, and I have a track record of never leaving anything behind. Much of it comes from looking through thousands of said logs and being able to pick out the stuff that doesn't belong. If I do happen to miss something on first pass (which is exceedingly rare), since it's normally just a single component of a generally multifaceted infection, it's typically possible to catch and clean it upon a single reboot. Even stuff like TCP/IP stack infections are easily identified and nullified when you inspect from offline.

I don't want to get into a terrible amount of detail about this on the public forums because I feel like it's one of the things that makes me so much more effective than most techs in my area. But I have discussed it before, and it really isn't that difficult to set up; the only hard part is getting used to/good at going through the logs effectively without breaking stuff.

 

[PCX]

I will be completely honest with you guys, I rarely if ever do virus removals manually anymore and I have never had a customer come back after a virus removal that was not done completely. The only exception was the one time that I forgot to run unhide. Other than completely hosed systems or systems with really bad rootkits, running a series of scanners and tools will usually do the job, followed by running chkdsk and sfc /scannow. One other thing that we do now is create a new account and transfer the data, as well as settings and preferences to the new account. This helps to ensure that any account specific issues are resolved and usually makes the computer run better overall.

 

[NYJimbo]

That's exactly what I am saying. If you inspect all of the possible loading points from offline and verify the integrity of system drivers, the system can't possibly be infected.

I'm not going to go into this point for point but if you are not doing multiple scans of well known cleaners you are likely leaving an infected machine behind.

There is a difference between and active infection and a dormant infection but they are infected all the same. If a customer downloads files or has something stored somewhere and it has an infection in it, the next time they run it they will become reinfected unless the A/V tools they have inplace stop it.

Sure, I do manual kills, but you cannot see everything that is out there. We find infected exe files all over the place on peoples computers, if we didnt scan for them they would be there today even if we kill the active viruses.

When you say "Once the resident memory infections are cleaned, any old AV can handle the rest in a cleanup scan" you obviously have never run multiple scanners only to find that one see this virus, the other sees that and a third sees even more.

I could never give back a computer to a customer without running at least SEVERAL of the best A/Vs in FULL scan mode AFTER I killed everything I found active or in known loading places.

 

[othersteve]

Well I guess we're just both doing things differently then. ;-)

Of course there is a chance that some dormant EXE still sits in wait in the Downloads folder or something of that nature. But my job isn't to kill a dormant file that isn't currently infecting the machine, especially if it's obscure enough to avoid the full scan of a capable AV. Naturally, no single AV can catch every existing threat, but with detection rates north of 97% for anything respectable (of known threats--the zero-day stuff is invariably dead once the resident memory/temp files/loading points are taken care of), it is highly unlikely that anything of any significant danger is left behind once this procedure is completed.

Like I said, it's been my course of action on literally thousands of machines to date, and to my knowledge I have not had even a single unhappy customer. I even take the time to personally place follow-up calls to ensure satisfaction, and I have the highest rating of any tech in the entire city on Google--39 perfect scores, in fact.

Not trying to brag, but the point is that this doesn't have to be a laborious procedure. If you take care of the truly dangerous stuff first (which includes a full traversal of files modified/created within 30 days if you use a tool such as OTL), then perform a cleanup scan with a couple of capable utilities thereafter (include at least one full system scan), you can be assured that the system is as safe as it's going to get.

I could, of course, scan using two, five, ten, or more AVs to ensure that I reach some number even above 97% for the dormant/old/downloaded stuff, but the diminishing returns (and the likelihood that the infection would be caught upon execution/unpacking) negates the incentive to do so.

Finally, I'd just like to point to many of the expert malware removal communities across the internet for further reinforcement of this approach. They do precisely the same thing (barring the frequent use of ComboFix due to the complications involving offline removal via internet forum posts) and it's been their modus operandi for nearly a decade at places like BleepingComputer, Tech Support Forum (the birthplace of ComboFix), and Geeks To Go. The general procedure is:

• System analysis/log generation (including MBR checks, etc)
• Cleanup script (repeat these last two steps as needed)
• Cleanup scan (usu. MB and an AV, same as I do)
• Updates/vulnerabilities patching
• AV recommendations/closing speech

CF is used here to simplify the procedure over the internet as time is not an issue and physical access to the machine is not possible. The only difference with my approach is that I depend on offline analysis for everything in the initial removal, which, when paired with a capable technician in the way of log analysis, means that nothing can possibly hide. This saves time as I have no need to run CF on most machines.

 

[NYJimbo]

"Naturally, no single AV can catch every existing threat, but with detection rates north of 97% for anything respectable"

Sorry, 97% sounds great until you run two A/V scanners and now see the ones the first scanner missed. All we need is for an A/V scanner to miss ONE out of ONE MILLION virus fingerprints and you are screwed. Whats the remainder on 97% of 1,000,000 ? See what I mean ?

I have been cleaning infected machines for decades and if you only use one scanner after manually killing active stuff you are not really cleaning the machine. Just killing the live stuff you see doesnt mean you really disinfected the machine.

I know you say you have never had a complaint, but are you saying they never got infected again ? I've never had a complaint either. I think most techs here also will tell you the same, but does that mean we ALL are really great at what we do or that the customer who gets reinfected two weeks later just doesnt think its your fault when they played that game they had downloaded last month ?

You might feel good about doing manual only cleans, but I think no matter how good you are you must be leaving more behind than you realize.

 

[PCX]

I do have to agree with Jimbo here. While I think it is fine to do it manually if you can do it efficiently, I also think that you should run one or two scanners as well. Maybe you will be surprised, maybe not, but at least you are doubly covering your butt.

 

[othersteve]

PCX, I do run one or two scanners. Generally Kaspersky Online + MB or similar. The disagreement appears to be over whether or not additional scanning is warranted.

Hey, I'm not saying that scanning with additional scanners is wrong. I'm just saying that it is overkill in nearly every case. You guys are obviously very thorough--and that's admirable. But hear me out here... I promise there is meat to this argument.

Consider this (admittedly rough) conceptual math:

1. Most every threat is either downloaded or is the result of a vulnerability.
2. Nearly every threat that is the result of a vulnerability drops files in either temp folders or system folders.
3. Nearly every file of any significant danger post-cleanup is likely to be under 30 days old, as older files are detected at rates very close to 100% by capable scanners.
4. Nearly every downloaded file is dropped into a subdirectory underneath the %USERPROFILE% folder, greatly limiting the number of files which are likely to be intentionally executed at a later date by the user. If dropped elsewhere, the directory is generally obvious via log generation. If not, a scanner will likely pick up the file anyway. Even if all methods fail, if the location is obscure, the customer is very unlikely to navigate to and execute the file before it is caught by a later scan.
5. Even if all else fails, and the initial removal methods miss the file:
   • Analyze MBR
   • Analyze all loading points
   • Verify integrity of system files and drivers
   • Clear temp files from all locations
   • Inspect all files created/modified under 30 days (whitelisted)
   • Inspect all files without a company name
   • Spot check with varying specialized utilities
   • Perform 1 - 2 cleanup scans (99%+ detection rate for old files, since all suspect files that remain are by definition older than 30 days at this point)
   • Patch vulnerabilities/apply updates
   • Install protection
   There is still a very good chance that IF the program is miraculously executed by the user thereafter, it will be caught upon unpacking and execution by either definitions-supplemented scanning of embedded components or heuristic scanning, especially since the file is older than 30 days at this point.

If you can mostly agree with these above five points, it becomes clear that the battle is over probably far less than 1% of remaining threats within, for the most part, the %USERPROFILE% folders only. If you are finding many (even any) leftover threats following your initial disinfection, I would respectfully argue that the initial cleanup methods are likely not targeting these same groups of threatening files that my above-listed approach does.

The best part about this is that it does not take a long time to implement or even execute once you get used to it. I don't want to go into exhaustive detail about my setup, but I might outline it in some greater depth in the private forum at some point if anyone is interested.

 

[PCX]

Othersteve, I personally would love to see your process as I do have to manually remove some infections myself from time to time.

 

[othersteve]

Othersteve, I personally would love to see your process as I do have to manually remove some infections myself from time to time.

I will type up a pretty good detailed recount in the private forum and see what everyone thinks of it next chance I get.

 

[othersteve]

Also, just to clarify, it looks like some of the initial confusion here came from my response to an earlier post by Jimbo regarding whether or not I use MBAM/CF/TDSSK/etc. as a part of my process. What I meant was during my cleaning of the active infection I DO NOT, with the exception of TDSSK for MBR analysis offline. For cleanup scanning I usually turn to an offline (by that I mean outside of the host OS) scan with ESET/Kaspersky online, which is free and very effective, and at that point we are only dealing with inconspicuous, dormant remnants of ages older than 30 days, making them easy to detect and kill.

I also check the usual ancillary stuff such as browser settings/hijacks, TCP/IP stack/LSPs, and the like.

 

[altrenda]

Sounds good. On average, how long does it take to clean a machine, start to finish? I mean screen/keyboard time?

 

[PCX]

Sounds good. On average, how long does it take to clean a machine, start to finish? I mean screen/keyboard time?

I can usually clean a screen in about 1 to 2 minutes depending on what we are using and how bad it is. Keyboards really depend on the person and what kind they are. If they are full of hair and food they can take quite a while. We use a stiff brush, a little alcohol and a datavac --so probably about 5 minutes or less . . .

As for virus removals, maybe a half hour or less of actual hands on time.

 

[othersteve]

I can usually clean a screen in about 1 to 2 minutes depending on what we are using and how bad it is. Keyboards really depend on the person and what kind they are. If they are full of hair and food they can take quite a while. We use a stiff brush, a little alcohol and a datavac --so probably about 5 minutes or less . . .

As for virus removals, maybe a half hour or less of actual hands on time.

LOL.

Probably around 30-45 here also. I'd say the initial log traversal/cleanup is probably around 20-25 minutes, then reboot, cleanup, fix any policies/outstanding browser issues, etc. This doesn't include the tune-up work however, and I do that with pretty much every virus removal... often without even asking, as I consider it to be largely part of the job. I quote ~2 hours for a virus removal ($152) and am often done earlier/cheaper. Everyone is always happy.

 

[altrenda]

Just to get an idea of the work flow
1. TDSS scan
2 OTL or similar scan
3 Analysis of data and removal/ replacement of offending items.
4 Offline scan with Kaspersky, Eset or similar program.
5 Patch, repair, optimize.

I know it's simplified and somethings may be in different order, but is it like this?
I have been trying to get better at manual removal and am interested in how others do it.