Let's examine another example the is for this example are universally applicable and are not limited
to global outbreaks only the above picture is a good overview of the virus propagation methods.
The first vector is the security hole we've mentioned.
The next method includes spreading using removable media.
We'll focus on this in a minute.
Local Area Network is the third vector the creators of the virus attempted to save the malicious code
in all badly protected network shares.
The fourth technique used user password cracking to propagate the virus.
The first vector was quite smart.
It involved a degree of social engineering a manipulation method we've discussed before.
The windows above are well known and don't raise suspicions.
We've gotten used to them being displayed as soon as it USPO drive is plugged into the computer but
there's a piece of information in these windows that is duplicated
configure has modified the auto run file.
You can see on the left hand side a typical auto run file.
The right side shows a file that's been altered by Conficker.
The virus referred to a system library to display the window shown before the language version an operating
system version always match selecting the first default option did not cause the U.S. directories to
open.
What it did was launched a virus file hit on the USP stick
a portion of the virus code can be seen on the picture above.
After it was launched the virus created a new system service with a random name system services are
unique in that they run automatically even when the user who has launched them has logged out.
As a result after restarting the computer the virus was already running in the system
the virus propagated also in another way through passwords.
The virus codes stored in most common passwords configure use the list to determine the password of
a targeted user it tried to submit passwords like root test or password but also check the name of the
authenticated user
using this value.
It submitted a potentially matching password for the user name John.
It tried passwords like John 1 2 3 or 1 John
this resulted in massive user account Lockett's a single copy of the virus was able to block as many
as a thousand accounts.
This is a hint that can help us gauge the scope of the infection.
It would be enough to determine which computers are responsible for locking user accounts.
If we locate them we'll know which computers have been infected.
A free optional tool for Windows administrators is a package called Account lockout and management tools.
Event common tea is a component of this package the empty abbreviation in the applications name indicates
that it's a multi-threaded edition of the tool event come MT enables users to read security logs for
multiple computer and aggressive security logs from many computers from your network.
When all this data is put into a single repository you can run log parser.
That's all we've shown before.
To identify the IP addresses of host they came up in the User Account lock out event record below you
can see a log parser query that return IP addresses of these computers performing these actions results
in documenting the territory of the attack at the same time you should take measures to reduce the risk
of infecting other computers.
The first thing to do is block TCAP port for 4 or 5.
This port is used in Microsoft Windows networks to access remote network shares.
The second step is to modify access privileges to the registry key according to the strategies outlined
in a knowledge base article.
It's necessary to do this in a way that prevents the virus from launching in a pseudo randomly named
web service.
Thirdly you need to block the automatic launch of auto run.
The file is stored in removable disks.
By doing this because all the known doors that would have let the virus in.
Now it's time to remove the virus from the infected computers.
To do this you specialist dedicated tools Microsoft software or third person software.
You can also try to remove the virus manually.
We can analyze remove viruses using tsis internals tools.
We'll talk about doing this in one of the next modules.
The last step is making sure that the results of the attack are removed from the system.
The easiest case requires restarting infected computers after a restart check whether the unwanted service
appears again the case study we've presented him to show you how an administrator should properly react
under unknown and stressful circumstances.
These circumstances are a situation where an anomaly has been detected in the behavior of a system especially
if this is a security related event.
We've prepared a plan of action and need to stick to it step by step.
First identify attack territory.
Secondly document the attack and take measures to keep the infection from spreading on to other computers.
This doesn't always mean shutting down the computer or unplugging the power cord.
Understanding vectors of infection and the detected attack is vital.
Next we need to eliminate the consequences of the attack and make sure that all traces of the attack
are completely removed from the system.
Thank you for your attention.