ErnieSiteList and ErnieUserList

Hi,

There are many different malware detection and cleaning applications, including Microsoft’s own Malicious Software Removal Tool (MSRT), which is a free download here. The problem with most anti-malware tools is that they rely on malware signatures also known as malware definition updates to detect the malicious code. Whenever a new piece of malware is discovered, the vendor of any Antivirus software has to update the database that is the algorithm to recognize the new malware. Malware authors are prolific, though, and new malware is discovered on a daily basis, so the anti-malware vendors are always one step behind.

That means users are left unprotected against the new threats for some amount of time, depending on how rapidly the vendors can create, test and deploy updates. This is the reason why often one tool will find malware that another misses, and when a threat is brand new, none of the tools may find it. That’s the basis of the “Zero Day” concept – a threat that’s so new there are no protections against it yet in place.

Thus the need for manual malware cleaning methods. Although it’s much more convenient to just run an anti-malware application and hope for the best, if you notice suspicious behavior occurring on your system and those programs can’t find anything wrong, you can delve deeper to find it yourself instead of waiting for the vendors to get the tools updated. You can do that with Sysinternals utilities such as Process Monitor,

Manually Identifying and Cleaning Malware

The steps involved in the manual malware detection and cleaning process, as follows:

1. Disconnect the machine from the network.
2. Identify the malicious processes and drivers.
3. Suspend and terminate the identified processes.
4. Identify and delete any malware autostarts.
5. Delete the malware files.
6. Reboot and repeat.

This can be a multi-step process because malware writers often create very robust software. It’s designed to withstand your efforts to kill it or even morph itself in to something entire different(Like a polymorphic virus that changes its virus signature i.e., its binary pattern every time it replicates and infects a new file in order to keep from being detected by an antivirus program.)

Step one is a precautionary one. Disconnecting from the network prevents your infected machine from infecting others on the network, being disconnected from the network will also enable you to fully observing the malware’s normal actions and completely understanding how it works and all that it does.

How do you identify processes that are suspicious? Look for those processes that have no icon, have no descriptive or company name, or that are unsigned Microsoft images. Also focus on those processes that live in the Windows directory, that include strange URLs in their strings, that have open TCP/IP endpoints or that host suspicious DLLs or services (hiding as a DLL instead of a process). Many are packed – compressed or encrypted – and many malware authors write their own packers so you don’t find the common packer signatures. Most malicious software will have some or all of these characteristics.

So how do you go about examining the processes in the first place? Many IT pros would start with the obvious: Task Manager’s Processes tab. Task Manager has been improved in Vista and Windows 7, in comparison to Windows XP. The Description column, which gives you information about what application is using each process, is a welcome feature that’s shown in Figure 1.

Figure 1

You can get additional information in Task Manager by going to the View menu and clicking Select Columns, then checking the boxes you want, as shown in Figure 2.

Figure 2

For example, you can display the image path name to show the full path to the file that’s connected to the process. Or you can check the Command Line box to show the command, with any parameters or switches that was used to launch the process (malware often has strange looking command lines). You can see this additional information in Figure 3.

Figure 3

Another way to get more info about a process in Task Manager is to right click it and select Properties, which will open its Properties dialog box. Here you can see information regarding its file type, location and size, digital signature, copyright information, versioning (most malware doesn’t have version information), permissions, etc. All of this is a good start, but Task Manager still doesn’t give you quite the in-depth look at a process that you can get with a tool such as the Sysinternals Process Explorer.

Using Process Explorer to Identify Malware

Process Explorer is a free 1.47 MB download from the Windows Sysinternals web page on the TechNet site. It runs on Windows XP and above. Current version is 14.1 and you can get it here. You can also run it from this link 

As you can see in Figure 4, it gives you a different view of your processes than what you get with Task Manager.

Figure 4

You’ll notice that in Process Explorer, the process tree in the left column shows parent-child relationships. If one process looks suspicious, related processes may also be. An extremely handy feature is the ability to right click a process and select “Search online” to do a web search for information about the process, as shown in Figure 5.

Figure 5

One thing to keep in mind, though, is that some malware will use pseudo random generated process names, in order to prevent you from finding any information in a search.

To know more about Process Monitor and how to use it sniff out malwares I suggest you follow this link:

http://blogs.technet.com/b/askperf/archive/2007/06/01/troubleshooting-with-process-monitor.aspx

Remember, though, that malware authors can also get digital certificates for their software, so the existence of a valid certificate does not guarantee that the process isn’t malicious.