1. Malware 101 “Basics” Berman Enconado

2. Malware 101 Malware is malicious software How to identify? Stealing information Unauthorized access Exploits Fooling the unsuspecting user

3. Malware 101 en.wikipedia.org/wiki/Malware

4. Malware 101 Classification of Malware

5. Malware 101 Viruses

6. Malware 101 Exploited WinAmp Playlist (m3u file) Exploits

7. Malware 101 Trojan / Backdoor

8. Malware 101 Dropped files –Usually in %windows% or %system% directories Autostart –HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run –HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Once –HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Winlogon –%USERPROFILE%\Start Menu\Programs\Startup Trojan / Backdoor

9. Malware 101 Rootkit

10. Malware 101 The famous “Love Bug” aka ”I love you” worm. Not a virus but a worm. (Filipino-made) Worms

11. Malware 101 Theories for self- replicating programs are created First Apple virus found “in the wild” - Spreads through pirated games Macro Virus Java infectors Chernobyl Polymorphic Virus -Annoying and destructive viruses starts to became rampant ILoveYou “virus” Sends via email Melissa -Email spammer - uses MS Word documents Conficker Worm - Most number of computers infected since Slammer in 2003 Slammer Worm - fastest spreading worm to date; infecting 75,000 computers in approximately ten minutes TDL Stuxnet Rustock Rootkits Mobile Brief History of Malware

12. Malware 101 A malware installs itself in the system without any notification or dialogs A legit application gets installed by a setup with a sequence of notifications or dialogs Malware Researcher Notes

13. Malware 101 Tools anyone can use to determine system infection.

14. Malware 101 Process Explorer

15. Malware 101 Installrite

16. Malware 101 Wireshark 4sysops.com

17. Malware 101 Autoruns

18. Malware 101 GMER Lavasoft.com

19. Malware 101 “Clean-up” Reginald Wong

20. Malware 101 Installation Setup Legit AppMalware Installs using a dialogNo dialog. May show fake error or image such as porn Usually installs its components in Program Files folder Usually installs itself in the Windows folder(s) Can be manually run from Start Programs Menu It is already running and triggered at a system event such as startup. versus

21. Malware 101 Comparison: Process BeforeAfter

22. Malware 101 Comparison: File BeforeAfter

23. Malware 101 Comparison: Registry Before After

24. Malware 101 Comparison: Registry Before After

25. Malware 101 Comparison: Registry Before After

26. Malware 101

27. Assuming we do not have any third-party tools, and we only have our plain old Windows NT-based OS….

28. Malware 101 Common Malware File Locations Located in –Windows folder or subfolders like System32. i.e. C:\Windows\System32 –Recycle(r) folders –Desktop And can be found set to run at startup

29. Malware 101 Looking for Suspicious Files Click on Start->Run Then type, MSCONFIG And hit ENTER

30. Malware 101 Looking for Suspicious Files Click on Start->Run Then type, TASKMGR And hit ENTER Or Press CTRL- SHIFT-ESC

31. Malware 101 Suspicious Files: File Properties Version Information –Google is your very best friend File version Company Name Copyright Icon –Trying to mimic a folder, explorer, or any legit application. Check out the path. –No icon

32. Malware 101 Suspicious Files: File Properties

33. Malware 101 Suspicious Files: File Properties

34. Malware 101 Looking for Suspicious Files

35. Malware 101 Looking for Suspicious Files

36. Malware 101 Looking for Suspicious Files Still not showing up?!?

37. Malware 101 Looking for Suspicious Files Unhide using ATTRIB (command line app)

38. Malware 101 Looking for Suspicious Files

39. Malware 101 Looking for Suspicious Files

40. Malware 101 Removal: Attempt to Delete File

41. Malware 101 Removal: Attempt to Terminate Process Unfortunately Fails to Terminate

42. Malware 101 Removal: Attempt to Delete File HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager Click on Start->Run Type REGEDIT Hit ENTER

43. Malware 101 Removal: Attempt to Delete File

44. Malware 101 Removal: Attempt to Delete File

45. Malware 101 Removal: Attempt to Delete File Pad 2 0x00 bytes which means Renaming the file to nothing. In other words, delete.

46. Malware 101 Removal: Attempt to Delete File

47. Malware 101 Removal: Attempt to Delete File

48. Malware 101 Removal: Attempt to Delete File Verify that the file was deleted. Do the same process when looking for the malware file.

49. Malware 101 Removal: Attempt to Delete File Also check that the malware file is not in the process list.

50. Malware 101 Removal

51. Malware 101 Removal: Clean up Remnants

52. Malware 101 Removal: Clean up Remnants Click on Start->Run Type REGEDIT Then hit ENTER Click on “My Computer” Click on Edit->Find/Search In the search box, type the name of the malware file then click on Find

53. Malware 101 Removal: Clean up Remnants

54. Malware 101 Warning! Do NOT delete registry entries that contains the malware file name. Do NOT delete file names similar to that of the malware file name. It could have mimicked a system file name. Research about it first. If you think handling the malware is still difficult, send the file to your favorite Antivirus vendor.

55. https://www.facebook.com/gfisoftware https://www.facebook.com/GFILabsPH https://twitter.com/gfisoftware https://twitter.com/gfilabsph