Malware Defense History

by Dr. Nikolai Bezroukov.

Copyright: Dr. Nikolai Bezroukov 1994-2013. Unpublished notes. Version 0.80.October, 2013

Contents : Foreword : Ch01 : Ch02 : Ch03  : Ch04 : Ch05 : Ch06 : Ch07 : Ch08 : Ch09 : Ch10 : Ch11 : Ch12 : Ch13

Chapter 2: Social Aspects of Malware

Help Desk Level Virus Incidents Troubleshooting with Login-Time Scanning package

(Attention: this is fragments of unfinished work)

Contents

1. Introduction

Determination_2

1.1 Determination of the type of the incident
1.2 Typical errors of helpdesk analysts
    1.2.1. Panic reaction on infections by already known macro viruses
    1.2.2. Failure to recommend upgrade older version  of the AV package to the current one.
             Upgrading problem to the Level 3 for a site that is running an old version of the AV package
    1.2.3. Failure to send the LAN Admin and/or the user updated documentation
    1.2.4. Failure of the helpdesk analyst to recognize well-know hoaxes
    1.2.5. Incorrect description of the problem
1.3 Important Tips

2. Most frequent cases of macro virus related calls

AV_2

2.1. The AV package is unable to disinfect the document
2.2. User is unable to save file, or file can be saved only into the TEMPLATE directory
2.3. After disinfection file became false positive and produce error messages on login
2.4. File that has extension RTF (in RTF format) is infected

Typical_1a

3. Typical calls about boot viruses

After_2b

3.1. After disinfection virus appears again.
3.2. Computer cannot boot from the hard drive.

Typical_1b

4. Typical problems with AV package.

AV_2

4.1. AV package does not start execution. Errors during login LIke "Cannot execute external program..." "Out of environment space..."
4.2. Insufficient memory problem on NetWare 3.xx.

User_1

5. User asks for additional info

6. Procedure of upgrading the problem to the Level 3 support (the Data Security Analyst level)

1. Introduction

In a corporate environment the cost of a virus incident consists mainly of the cost of user downtime. So it is best to resolve the incident at the lowest level of technical support. There are several general recommendations when dealing with computer virus infections:

• Don't overreact, it can be just false positive or a known email virus or spyware. Most infections, including practically all email, spyware and macro virus infections should now be considered as routine cases and should not be upgraded to Level 3. Very few such infections present a real threat to the user data. Unless the server was not configured properly, there are almost no chances for a file virus to propagate from one workstation to another without explicit "help" of the user. For most virus infections, the chance of losing information is really small. Asking to disconnect the server from the net or reload OS on a workstation that has an already known email worm or some spyware is an overreaction.
   
• The first thing to do is to check what version of the antivirus/antispyware package is installed, if at all.  You need the most uptoday version of signature files. This is more important for spyware cases than for email viruses cases.
   
• There is a greater chance of a data loss by improper spyware/email virus removal techniques, then from the worm or spyware itself.  The main danger here is too much zeal ;-). I know a lot of cases when personnel trying to remove spyware that keeps reinstalling itself removed vital windows files and made PC able to book only in safe mode if at all.
   
• Try do not contribute to panic yourself.  If you computer communicates with some god forgotten spyware site or is sending crappy emails to all recipients from your email address book this not the end of the world. Like in human society viruses/worms strike the most weak and defenceless. In corporate worls it often means "sites with administrators.".  Panic reaction by the user or worse barely competent LAN administrator usually lead to data losses. In extreme cases in panic mode one can decide to reformat the hard drive to get rid of work/spyware (usually a very stupid idea indeed) or accidentally delete important executables or documents as "infected" or destroy them by overwriting.
   
• Helpdesk should perform more active role that simple registrar of use cases. for examplle if several new cases of the same type are uncovered a letter from helpdesk, informing all users about the problem should be send.
   
• In rare case when a hard drive was infected with a boot virus (they are now almost extinct) the user needs to scan all floppies, as they are usually infected also.

1.1 Determination of the type of incident

First the HELPDESK analyst needs to determine the type of incident. If a virus was detected by the AV Package at login, then there may be two possibilities:

• The user was able to log in.
• The user was blocked from logging on to his/her computer.
• The user was blocked from accessing Internet (this is most typical case with spyware)

Attention: The typical mistake here is to start filling the ticket beginning from the "problem" field. The problem field should be filled as the last field after all information is collected.

Generally, there are four main categories of virus related incidents:

• Infection by macro viruses. In this case the user was able to login.  See MACROVIR.HTM for details. The recommended code name for the "problem" field in the CustQ is macro virus <name> infection
• Infection by boot viruses. In this case user was blocked on login. See BOOTVIR.HTM for details. The recommended code name for the "problem" field in the CustQ is  boot virus <name> infection
• False positives (see AVJARGON.HTM for the definition of the term). there are 3 cases of false positives:
• false positives documents;
• false positive executables (McAfee Virus Scan is the main source of false alarms);
• false positive detection of virus in memory (rare cases with F-prot, very rare for McAfee).

Recommended code name for the "problem" field in the CustQ: False positive for virus <name>

• Hoaxes (see HOAXES.HTM for details). Recommended code name for the "problem" field in the CustQ: Virus hoax <name>

Also there are two  very rare categories:

• Infection by file viruses (Hydra, Sunday, Jerusalem, Yankee Doodle etc.). The recommended code name for the "problem" field in the CustQ is  file virus infection
• Infection by file-boot (multipartite) viruses (for example One_half). The recommended code name for the "problem" field in the CustQ is multipartite virus infection

1.2 Typical errors of helpdesk analysts

1.2.1. Panic reaction on infections by already known viruses/worms/spyware or hoaxes

This was already discusses and needs no repetition. Please read the document Anti Virus Defense Secrets/Hoaxes for details on how to distinguish a hoax from a real warning.

1.2.2. Failure to check if the user has the latest and greates signature file or version of antisirus/antispyware/antiwhatever tool that is used in a particualr environment.

I would like to repeat that like natural infections often strike weaker humans. Often the problem with disinfection is as simple as inability to find and download the latest version of software or signature file.

1.2.3. Failure to maintain documentation

Cases repeat and only if the case is documented properly it can help other analysts, LAN administrators in researching the problem. You Documents about worm/spyware protection should be probably one of the most dynamic documents that helpdesk deals with.

1.2.5. Incorrect description of the problem

Correct description of the problem greatly simplifies dealing with the problem. It is recommended to use the terminology suggested above in a problem field.

• Please do not invent new names for existing viruses
   

2. Most frequent cases of the macro virus related calls

The first task of the HELPDESK is to educate the users.  For macro viruses the HELPDESK analyst should send documents MACROVIR.HTM and DOC2RTF.HTM. to all users?.

Cases of macro infections are usually simple and 99% of them involve already known viruses like Concept, WAZZU, Nop, Npad. Such an incident can usually be resolved at the helpdesk level or LAN support personnel level. Please do not upgrade calls to the Data Security Analyst without necessity. The following cases are the most frequent ones: 

• CAP.A virus infection
• Package fails to disinfect documents ( can be a real macro virus or false positive; conversion to .RTF in most cases will solve the problem). In this case the helpdesk analyst or LAN support person should get the files _PROBLEM.LOG and <user>.LOG and see if they contain any unusual error messages. Usually the file <user>.LOG  contains the names of the infected files and the name of the virus. An exact name of the virus needs to be written down in the help desk ticket.  Usually a macro virus infection starts when a user receives an attachment that contains an infected document in native MS Word format.
• User is unable to save file, or file can be saved only into TEMPLATE directory( this usually means that file is infected with a macro virus)
• After disinfection the file became false positive and produces error messages on login (conversion to RTF usually resolve this problem)
• The AV package seems not to operate properly. For example package hangs in the middle of scanning Z: or C: drive. The first measure in this case is to determine what version of the package the user is running. The simplest way to do this is to ask the user to run the command:
      FMACRO /?
  or
      FPROT /?

2.4. File that has extension RTF (in RTF format) is infected

There are two different reasons: First, the file extension .RTF and text format RTF (Rich Text Format) in MS Word are quite independent of each other J. Documents with extension .RTF are immune to macro viruses only if they are really in RTF format. If they are just renamed documents in native MS Word format they can be infected and often are. So extensions themselves does NOT guarantee absence of macro virus. Correct conversion to RTF format DO guarantee absence of macro viruses in the document.

For additional information see MACROVIR.HTM

3. Typical problems with boot viruses

The most common boot virus is Form. The boot virus infection in most cases can be disinfected using the AV-Rescue Disk by the user or the LAN support person.

3.1. After disinfection virus appears again.

Check what version of AV Rescue Disk was used for resolving the problem. If not the latest one, then AV package on this particular server needs to be upgraded. Image of latest version of AV Rescue Disk is available from Netware95_US or IS_US. The name of the file is 03BAV27B.IMG. This file can be sent by e-mail. After receiving the file use needs to save it on the local hard drive (for example in C:\TEMP directory). Then to create new AV Rescue Disk by running the command wimage c:\temp\03bav27a.img a:

If the latest version of AV Rescue Disk is used then one possible reason is that the user has made the Rescue Disk on a infected computer or (more often) just forget to open the write protect tab on the floppy after creation of the disk. In the latter case the AV Rescue Disk may became infected after user inserts it into his/her workstation. After AV Rescue Disk becomes infected it will reinfect the workstation instead of disinfecting it.

3.2. Computer cannot boot from the hard drive.

Usually that means that the computer is infected with the Monkey virus. AV Rescue Disk could disinfect this virus. Please recommend using option B after booting from the AV Rescue Disk.

4. Typical problems with AV package.

Important: For any problem with the AV package the first thing is to determine if the latest version is used. If the side does not have the latest version installed, they need to upgrade. Non current version is NOT supported and problems with it should NOT be upgraded to the level 3 support. The Site can still use the old version at their own risk. Recommended code name for "problem" field in CustQ: AV package problem.

4.1. AV package does not start execution. Errors during login   "Cannot execute external program..." "Out of environment space..."

Usually that can be a problem with the login script, not a problem with the AV package. Calls about the login script problems should be addressed to local LAN support. They should compare fragment of login script that calls AV package with installation specs and correct all errors. Help of a local LAN support person with a strong knowledge of login scripts is highly recommended.

Only if they cannot resolve the problem locally, additional info needs to be collected (see below) and problem can be upgraded to the Level 3

4.2. Error "Abort, Retry, Ignore" during the creation of AV Rescue disk in a DOS session of Windows 95

Reason is still unknown. This is most likely a bug or incompatibility error in Windows 95. Solution: Answer "Abort". Rescue disk created is perfectly usable...

4.3. Disinfection fail on computers with Windows 95 and Norton Utilities installed:

If NPROTECT is enabled, then all deleted files will be moved to NPROTECT directory. That means that deleted infected files will be found by F-prot in this directory during control check that is performed after disinfection in this directory and computer will be blocked.

5. User request additional information or needs additional checks

HELPDESK should send relevant document(s) to the user via e-mail or address the Intranet Website with relevant information. Several typical examples:

• User is confused and need assistance with particular tool; Recommended code name for "problem" field: Antivirus information request.
• User asks what is the best tool for particular problem; Recommended code name for "problem" field: Antivirus information request.
• User asks about particular virus (for example Monkey).  Recommended code name for "problem" field: AV information request.
• User suspects that his/her problem is virus related. Typical example is that user sees some strange message and attributes them to a virus. For instance, the message "Smile. Your computer has been blessed by virus-free gremlins" appear periodically on the screen during boot up. Recommended code name for the "problem" field: Additional Virus Test Required .

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March 12, 2019