Friends computer infected with Virus

[Modelworks]

Originally posted by: Gamingphreek


Is there a disassembler that is free or something that I can use on the .exe files to break it down to assembly code? (That is once I find the malicious file)?

I still use Softice but its no longer available , haven't tried it but heard good things about syser.
http://www.sysersoft.com/

Ida is also very good, but can be overwhelming if you are not use to debuggers.
http://www.hex-rays.com/idapro/

It may not be an exe, check dll files. Follow the files windows loads as it boots, a virus has to load somewhere along that process.

 

[Gamingphreek]

Originally posted by: Ken90630
I know you said you wanna figure out what got in and how to clean it for "the experience," but really, you should take the advice of mechBgon and the others who've recommended backing the files up, using DBAN to nuke the HD, and doing a fresh Windows installation.

And not to discourage your professional aspirations in the computer security field , but I don't think you quite have a handle on what's involved here. If this is a really complicated piece of malware, like a rootkit and God-knows-what-else bundled with it, you're not likely to figure it all out anyway. With certain kinds of malware, there can literally be > a thousand infected/altered system files and who-knows-how-many permanent registry changes (including hooks), an infected boot sector on the HD, an infected and unrepairable System Restore folder, etc. And rootkit revealing scanners can work in some instances (but certainly not all), but they're complicated and not likely to find and repair everything 100% the way it was before the infection. Do you really wanna spend dozens (if not hundreds) of hours going thru the Windows registry, item by item, fixing every altered entry (if you even can)? (Answer: No, you don't. :laugh: ) If anything is left behind, and it almost certainly will be with the kind of infection you're describing, you're gonna need to reformat and reinstall Windows anyway.

And I know of no anti-virus or anti-spyware app that will CLEAN every trace of a complex infection. You might get a list of a gazillion infected files, but after the repair process you'll likely end up with a list of files that "couldn't be repaired/cleaned." At that point, you need to jump on the Reformat Train anyway. I, too, am sometimes interested in the how and why of how some malware does what it does, but in the end, the solution is the same: Nowadys, most sophisticated malware infections warrant a reformat and fresh Windows installation.

Just my $.02. Good luck.

I completely understand. I just had an interview; however, where I talked of all the security and computer forensics that I had experience with. I have worked with Aircrack/Airodump, I have dealt with tracing IP's via E-Mail headers, and I have dealt with some limited hex views (Obviously I have programmed in opcode and assembly as well).

If I can say that I have worked with tracing virus's and looking through the assembly and cleaning the files manually, that would be a couple points in my favour when trying to get an internship.

I still use Softice but its no longer available , haven't tried it but heard good things about syser.
http://www.sysersoft.com/

Ida is also very good, but can be overwhelming if you are not use to debuggers.
http://www.hex-rays.com/idapro/

It may not be an exe, check dll files. Follow the files windows loads as it boots, a virus has to load somewhere along that process.

I was going to do that (With respect to tracking windows boot files); however, it got to the point where I didn't have time to work on it any more and I wanted to get his laptop back to him. I can make my peace that I found 4 of the files that were infected with a brand new virus and got experience in a lot of different areas.

I'll look into those disassemblers though - I'm interested to see what some of these programs look like back in x86(-64) assembly code.

Thanks,
-Kevin

 

[Ken90630]

I completely understand. I just had an interview; however, where I talked of all the security and computer forensics that I had experience with. I have worked with Aircrack/Airodump, I have dealt with tracing IP's via E-Mail headers, and I have dealt with some limited hex views (Obviously I have programmed in opcode and assembly as well).

If I can say that I have worked with tracing virus's and looking through the assembly and cleaning the files manually, that would be a couple points in my favour when trying to get an internship.

Ah, okay. Got it. I understand your efforts better now. My advice was tailored more around getting the machine at hand up & running, and prioritizing that over your curiosity about what makes this particular malware tick. And, of course, I wanted to make sure you knew what could be involved with manually fixing every damaged file and/or registry problem. Five-ten years ago that was sometimes a viable option, but most malware nowadays is beyond that (if its writer is sufficiently diabolical, anyway ).

Good luck in your career. :thumbsup: