Rare to see an anti-virus/malware protector not having automatic updates

It is extremely rare to find an anti-virus/malware protector not having an automatic update facility to its engine and database. Windows Defender running in Windows 8.x is one such rare species.

This happens if the user chooses the option in Windows Update not to use automatic updates, a choice giving the user better control which upgrades should be applied.

In that case, Microsoft acknowledges that it is a design decision that the user is not given the normal Windows Update notification, except in the log in screen. While I accept, only reluctantly, that there is a shred of logic in this, albeit very draconian one, why does that affect the important updates to a protection software which depends on timely update of its database/engine?

I have used a variety of AV and this has to be the first one that fails to update automatically or tell me an update pending when I choose not to use automatic Windows update option. Most of them has automatic update by default and is not under the influence of Windows Update.

This situation is a good example of Golden-Hamer anti-pattern resulting in leaving its Windows user vulnerable to attacks. So if you want more controls on your Windows' updates, don't use Windows Defender. Furthermore, another case of don't believe everything you read (on Microsoft product) and here is one taken from the Windows Defender's Update page for Win8.1:

It only updates automatically if Windows update is set to automatic. That "Did you know" message needs to be clearly qualified to avoid misunderstanding.

Windows has all sorts of detections and options, surely in the Windows update control panel applet Microsoft can add a check box there to let the user to choose if one wants to receive notification, including Windows Defender update notification. Or in Windows Defender to have a check box to remove automatic updates if the update notification is so distractive; it could and should update silently. Cutting that out altogether is just plainly a bad design decision. I suspect that is other sinister motive than what has been revealed.

I am wondering if this draconian approach will be addressed in the upcoming Windows 10?

If you persist to support Windows Defender with your choice of Windows updates option, the other option is to use a Task Scheduler to register the Defender updates periodically. It is a choice to ditch Windows Update or to use the Task Scheduler.

I will now experiment with some of the Windows Update Notification tools to address the Windows 8.x deficiency.

Experience in installing PDFCreator 2.0.x

I have been a long term, though slow to update, user of PDFCreator and recently I have decided to upgrade it to 2.0.0 from 1.7.3.

The installation experience left me with a sense of unease as it triggers the resident shield of my AVG 2015 flagging some files as being a Malware/Trojan/Adware. I will come back to this.

As a result of this alarm, I revisited my trust old friend CutePDF Writer, which has fewer feature than PDFCreator. The installation of CutePDF Writer 3.0 went without tripping my AVG but one has to be on the wit about its attempt to slip in some PUP and toolbars. It is nice to see the installation script offering a feature to skip all the PUP.

Since PDFCreator's installation script trips my AVG, I have decided to investigate this further in a controlled environment. First of all, I went to PDF Forge site to obtain the MD5 of the installation package to make sure I was not using a tainted package.

My investigation used 2.0.1, the latest release to determine what's going on. I use two installation scenarios - with network access and without network access and they have different behavior causing AVG to report different alerts. My experiments with installing PDFCreator do not install Image2PDF and PDFArchitect.

With network access

When the installation package, PDFCreator-2_0_1.exe (MD5:1464dab853dfac75097e6f81fa060c9a), is invoked, the first thing it does is to spawn a process called DownloadUpdateInfo.exe and this runs its twin DownloadUpdateInfo.tmp for a brief moment and then closed down.

After soliciting inputs from the user, it then invokes CBStub.exe which controls the invocation of the process InstallManager.exe. It is at this point that the resident shield of AVG 2015 alerts the user of the presence of a Malware ladden file. It alleges that it is infected with MalSign.Generic.5E6.

This file, together with its companion file, inetc.dll, which appears to be doing the HTML get, put, post, and head operations, are deposited in the %Temp%\. is a randomly generated temporary directory name. They disappear after successful installation and one needs some trickery to capture them.

According to VirusTotal, there are 10 out of 56 Anti-virus tools reporting this file as infected.

What this file does is to offer user a chance to install Ad-Aware Web Companion:

Strange, asking user to install an Ad-Aware component results in being classified as a Malware! What this does is to then invoke the Mntz_Installer.exe, which seems odd as most people on the Internet identifies this as the Opera Network Installer. Whatever this file is, it installs two services, namedly, LavasoftTcpService.exe and Lavasoft.SearchProtect.WinService.exe, which are part of the Web Companion software.


In all fairness, one can safely consider the alert from AVG for InstallManager.exe as a false-positive and can ignore it. If you are running AVG and feel uncomfortable when it raises the alert, it will not harm the operation of PDFCreator if you ask AVG to protect you. In this case, AVG will destroy InstallManager.exe and its subsequent operations.

Without network access

Often, it is advisable to install downloaded software with network disconnected to see if it calls home.

When the PDFCreator installation package is invoked with network disconnected, it does not invoke the DownloadUpdateInfo.exe.

Instead it extracted a bunch of files into a temporary directory %Temp%\ which happens to contain the OCSetupHlp.dll. The presence of this file triggers the AVG 2015's resident shield identifying it as an Adware AdLoad.OpenCandy.

According the VirusTotal, there are 12 out of 56 AV tools identifying it as infected with OpenCandy. Exactly what this being used is unsure but it does not appear to hamper the installation if one asks AVG to remove this offending DLL.

When installing without network access, the installation package will not prompt you about the installing the Ad-Aware Web Companion using the InstallManager.exe and hence it will not trip the AVG's resident shield.

If you examine this DLL's version information and its export functions, it is unambiguously associated with OpenCandy and hence it is fair to say that PDFCreator installation is tainted by OpenCandy but PDFCreator does not seem to have infected with OpenCandy after installation and during its operations.

In view of this, it is fair to say this is also a false-positive even though it is part of OpenCandy system.

The experiments show that while PDFCreator installation package causes AVG to raise alarms during the installation, they are safe and one can safely ask AVG to protect yourself against these files without jeopardising the operations of PDFCreator. PDFCreator runtime does not cause any resident shield alarm.

Apple users, welcome to the real world!

If you have not be told Apple has virus, you should read this excellent piece of report on "Mac Defender" malware. As a realist, I have always laughed when Apple users naively believing the sales hype that it does not virus!

I have been following this Mac Defender for a long time, way before the popular media outlets picked up the story. When I first heard of this, I realized that apple users' age of innocence had just been shattered. My warning to my friends and view on the vulnerability of these unrealistically complacent apple users would be like pack of drunken sheep to the wolf. Surprisingly this same sentiment is echoed by Molly Wood in CNet. As a developer, software bounds to have vulnerability as it is crafted by human. Besides, Apple OS is just a Unix and Unix/Linux is always known to be malware/virus.

I believe it will become a lot worse before it gets some form of relief because these attackers have sharpened its modi operandi in the Windows world and that Windows users are conditioned to become more alert about Virus/Trojan/Malware. To these attackers, Apple users are trusting lot!

I am not surprised to learn of the recommended "unhelpful" customer service directive of Apple as reported. Molly has outlined several notable exemplars of Apple's unhelpfulness. The "silence-then-solution pattern" will definitely put their users at great risk through Apple's generosity of giving attackers a wide windows of attack opportunity. Does Apple care? I doubt it. The old "Poison DNS attack" and Apple's slowness in addressing this is just another shiny example of a company cares more about a facade than what's behind and its users well beings.

My view on the effectiveness of antivirus software is vindicated

I have always formed the opinion that antivirus is a very ineffective and blunt device in protecting one from being attacked. This is not to say that I am flirting carelessly with danger on the Internet. What I am saying is that there are far better and efficient way to protect oneself than to rely on antivirus software.

Recent attack on Google in China invoked a number of comments and postmortem analysis and one of them has vindicated my view,

nCircle's Storms believes that one "lesson from this breach is that antivirus software really is dead. For quite a while it's been the least effective tool in the IT enterprise security toolset because it's only effective against known malware. It only takes one piece of customized malware to infiltrate your network."

In my e-mails with Kurtz he wasn't as bold about declaring the death of antivirus tools, but he did suggest a new approach as well. "There are technologies like whitelisting--McAfee Application Control, that would have prevented successful exploitation of this zero day and many others--without signatures. Companies really need to start augmenting their blacklisting with whitelisting protection technologies."

Antivirus is often like looking in the rear vision mirror. It is totally useless until its database has been updated.

Annoying-ware from Microsoft's MSDN

Lately, Microsoft's MSDN web site has adopted similar tactic used by those inconsiderate Adware sites demanding you take some action or else it continues to annoy the hell out of you.

Here is what I mean:

You can see this is if you navigate to the MSDN library site. The 'Switch View' pop up is so annoying, anti-social, inconsiderate and so intrusive that is actually worse than many adware sites.

Look at how inconsiderate Microsoft has placed that pop up.It covers up the down button of the scroll bar. It is designed purely to annoy the user in much the same way as they designed the Vista UAC.

The idea of that pop up is to annoy you until you give in to switch to "Script Free". Hardly a good tactic to encourage feedback from user; you definitely get some negative ones from me. The following picture shows that even Microsoft cannot handle a machine running with 120DPI:

 

The 'Script free' option is half disappeared. Is this another annoying strategy employed by Microsoft?

Well done, Microsoft, you have succeeded in annoying your users and earn the same dubious title of that bestowed on Malware/Adware sites.

Hunting Trojan/Virus experience

Several days ago, I was asked to deal with a Virus/Trojan infection situation.

The machine has AVG8 installed but seemed to be unable to protect the Trojan attack. I know with the right kind of anti-Trojan/Malware programs in hand one can make light works in eliminating them. Or could it?

This blog message is not so much about which Anti-Virus program is better than the other but is a collection of experience gained from hunting down a number of Trojans. It also contains description on how best to protect oneself from being infected and secured practices that were actually put to test in slaying the Trojan.

It is most unfortunate that different anti-virus program uses different name for the same Trojan and Virus. I am using Avira and it has identified the Trojans I am confronting as TR/Dldr.FraudLoad.fmb and TR/Crypt.ZPack.Gen. Others like AVG8 calls them SHeurs.BDEF. These are classified as downloader and in particular the FraudLoad is a fake anti-virus often called Scareware that causes the infection.

Below are some of records of my experience and lessons learned.

Always use offline Anti-Virus download link instead

Many Anti-virus program has now switched over to downloading a small stub download program and with which then downloads the remaining components. Do not use this stub program if you want to inoculate the infected machine offering it some protection because this kind of program requires a connection to the Internet, see the attack description below.

Thankfully AVG8 has offer a offline download link which allows one to download the full version.

TR/Crypt.ZPACK.Gen spreading infection mechanism

This trojan utilises the Microsoft's provided AutoRun mechanism to spread the infections to other machine. This is how it is done:

• A process located in C:\Recycler\<SID>\WmiPrvse.exe launched and attached to Explorer.exe is responsible for spreading, where <SID> represents the SID of the user.
• The Trojan creates an entry in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon!Taskman=C:\Recycler\<SID>\WmiPrvse.exe and the trojan causes Explorer.exe to query this registry entry periodically. You should remove this as Taskman is not a valid Microsoft Windows entry.
  
• When Windows senses a new USB device is plugged into the machine, this evil process will create a fake \Recycler on the USB drive even when it is formatted with FAT/FAT3 partition.
  
• It is also structurally incorrect designed to hide the malicious code using a well known folder name and to fool people.
• It then copies the malicious code called Explorer.exe to the fake recycler folder.
• It creates an autorun.inf file on the root directory that contains instruction to launch the malicious code with the help of Microsoft's Autorun support when it is inserted into another machine, thus completing the spread.
• No doubt this Explorer.exe will contain code to load it into some less obvious location to burrow into that machine to infect it.
  

I have always thought of disabling autorun permanently is sufficient to protect oneself. This is proven to be half correct.

Disabling autorun on a machine only disabling the launching mechanism that was used by malicious code to infect the machine. It does not prevent the malicious code already entrenched in an infected machine from infecting a USB drive making it the unwitting carrier of the malicious spreading code. Therefore it is so important not to plug a USB drive into any machine that

1. You do not know if it has autorun enabled
   
2. If the USB Drive carries the attacking code.
   

If you do not know, hold down the shift key while inserting the USB Drive into the machine and maintain holding it for a minute or two. This is will stop Windows from executing the instructions in the autorun.inf file.

Afterward make sure you scan it on a machine that has autorun disabled to ensure that it is not a carrier.

After seeing this and examining the content of the autorun.inf, it is certainly dicing with danger in leaving autorun enabled on all drives; it must therefore be disabled.

This is the content of the fake Recycler folder captured on the USB drive I was using it (a different USB drive from the tools carrier) to retrieve data from the infected machine.

Volume in drive K has no label.
Volume Serial Number is AE6B-BD53

Directory of k:\recycler

11/09/2009  06:05 PM    <DIR>          .
11/09/2009  06:05 PM    <DIR>          ..
12/09/2009  11:55 AM                64 Desktop.ini
12/09/2009  11:56 AM           106,496 explorer.exe
       2 File(s)        106,560 bytes
       2 Dir(s)     112,531,456 bytes free

Use a write-protected medium to carry tools

My practice is always to use a USB Drive that has hardware write-protection mechanism to transport tools to analyze the infected machine preventing malicious code from subverting the tools. When that is not available, I frequently use a SD-Card which always has the hardware lock mechanism to protect my tools and hosted it in a SD-Card reader like this.

The above observation proves that a write-protected USB drive is a must have device in carrying out investigation.

Furthermore, it is highly desirable to have tools that

• do not have to installed into the target machine.
• runs from a write-protected device
• run as command-line utility as they can then be chained into one submission.
• Do not need the access of the Internet during installation.
  

Sadly not one anti-virus scanner meeting the above stringent requirement. The Panda Command line scanner one comes near, except that it needs to write to the device. Avira also has one but to get the full benefit one needs to supply the licence key to it.

What does TR/Dldr.FraudLoad.fmb do?

The purpose of this trojan is to download malicious payload and is believe to belong to a class of software called Scareware to allow it to gain a foothold of the machine. It monitors if the machine is connected to the Internet and if not it becomes dormant. Hence I exploited this behavior to study this program and to defeat it. This is a record of its evil doings:

• Downloads the payload, called windows_update[1].exe into the temporary internet file directory. The numeral inside the bracket may be different.
• It creates a copy of itself in the %Temp% directory with a file name of this format [0-9][0-9][0-9]\.exe, e.g. 126.exe, and these numbers are randomly generated.
  
• It then launches this program, say the 126.exe, to begin the attack.
  
• The program then checks to see if system set up is in progress by examining the HKLM\System\SystemSetipInProgress registry value.
• It also seems to have scan of which IE patches have been applied.
• It also check for the presence of other fake anti-Virus programs such as AntiVirusXP, RealAV, AVR.
• It also disable the ability for the user to launch the Task Manager from the task bar by setting this HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableTaskMgr=1. Hence to study this trojan you have to launch the TaskManager before connecting the machine to the Internet.
• It creates the following named values NoSetActiveDesktop, NoChangingWallpaper, NoActiveDesktopChange intending on controlling the desktop in this registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer.
• It copies itself as winupdate.exe to C:\Windows\System32. I have managed to disrupt this trojan's progress by using a custom built program that hold a file of this name opened with deny share access attribute before the machine is connected to the Internet and maintaining that hold during the attack. It failed to copy the attacking code to this directory.
  
• It then creates the following registry entry intended on launching this malicious code when the machine is restarted: HKLM\Software\Microsoft\Windows\CurrentVersion\Run!WinUpdate.exe=C:\Windows\System32\WinUpdate.exe.
• The program with the 3-digit name, like 126.exe, then launches winupdate.exe and drops out of the scene. The Trojan do not attempt to delete the instance of this file with a 3-digit name in the %Temp% directory, not very smart.
  
• Winupdate.exe then register the malicious COM component called C:\Windows\System32\WinHelper.dll by calling Regsvr32 /s.
• It also looks for C:\Windows\System32\AdvancedVirusRemover\PAVRM.EXE, a well known fake anti-virus program that is in fact a virus.
  
• Winupdate.exe, then launches fake warning of malicious code detected and advising user to press the balloon to download protection code, which is nothing more than a ploy.
• It also attempts to shut down CMD instances but failed to take care of Command.com instance, which I exploited this mistake to regain control.
• It also attempts to block launching of other GUI applications until this winupdate.exe is terminated.
• It also then creates a file with 2-digit name, like 41.exe, of 0 byte in C:\Windows\System32 whose purpose remains unknown.
• Winupdate.exe remains running to disrupt the desktop and one can only regain control of it by terminating this process. PsKill is the ideal tool to do this.

Are these two Trojans related?

On the infected machine, AVG8 did not seem to offer any protection at all. There are even signs that they subverted Spybot Search & Destroy because their scanning and TeaTimer.exe offering only token protection. My observations of the operations of these Trojan were made while they were in operations showing little effect in detecting these key files containing malicious code.

I suspect these trojans are either related or utilizing one single malicious process to attack the machine. They seemed to be using C:\Recycler\<SID>\WmiPrvse.exe as a main source of maintaining control and attack. Because it is controlled and held opened by Explorer.exe it cannot be terminated easily.

The way I eliminated this process is to use DOS command chaining technique as follows:

pushd C:\Recycler\<SID> & j:\PsKill Explorer & del /A:S wmiprvse.exe

where <SID> represents the SID of the user. This sequence of commands does the following:

• Change the directory to where wmiprvse.exe is located
• Terminate the Explorer process that is holding onto the wmiprvse.exe process
• Delete the malicious code which is marked as a system file called WmiPrvse.exe.
  

Bear in mind that when I submitted these command, the process WinUpdate.exe was not running and it was not connected to the Internet.

Once this malicious code is removed and terminated, the system becomes normal and reinstallation of AV is possible allowing them to do the job to get rid of files such as WinHelper.dll and other relatively less stubborn malware lurking around.

Dangerous & foolish not using LUA

My experience in this involvement further vindicates my view that people not using LUA is really asking for trouble. It also reinforces my view that it is dangerous leaving Autorun enabled.

Sure one can rely on Anti-Virus to protect oneself but can it be all that effective? What about the window of opportunity available to exploit code that is not yet protected by Anti-Virus when your machine's operating system's security defense shield is turned off?

As reported above, all those exploits they used are so simply and effectively blocked by not running in administrator's account. That's the defense shield, if allowed to operate, will block the above exploit without even the aid of anti-virus program.

Sure, it can still disable the task manager from being invoked but it could not succeed in planting anything more malicious in system folders and registry keys. All it can do is to inconvenient you that dirty deed could easily be removed.

It is impossible to determine if the ACLs of the system files and registry areas have been tempered with prior to the infection or as a result of the attack. A detail scan using AccessChk of the vital areas show that it is impossible to switch the just rescued machine to operate effectively in LUA mode without a full reinstallation. That part of security appears to have been irreversibly damaged.

What can you do to make it harder for Conflicker?

A very good article mentioning what Conflicker attempts to do and how one could make life harder for Conflicker. Good advice:

First and foremost, if the user of the desktop that is being attacked is NOT a member of the local Administrators group, the worm will have a tough time infecting the computer

Even in Vista. Many advice in this article is for the Vista. To turn off Autoplay please refer to this support article.

Next time you find a USB drive lying around beware...

This experiment reported here shows that there is no free lunch:

....Steve Stasiukonis of Secure Network Technologies during a penetration test for a customer. He seeded the customer's parking lot with USB flash drives, each of which had a Trojan horse installed on it. When the employees arrived for work in the morning, they were quite excited to find the free gadgets laying around the parking lot. Employees eagerly collected the USB drives and plugged them into the first computers they came across: their own workstations.

Maybe some employees were wise enough to ignore these USB drives, and perhaps some of the USB drives were discarded, but it really only took one user with one drive to infect his own system and provide a gateway into the network. Stasiukonis did this exercise as a test, of course, but this technique has been used by real criminals to infiltrate large corporate networks.

Updates on disabling Autorun

With the report of the spreading of Conficker virus/Trojans and that one of the techniques for spreading this is helped by Microsoft's support in the form of Autorun, if you have not disable this dumb feature you should follow the instructions on this Microsoft support article.

I cannot see one good reason for this feature, which incidentally is enabled by default. Would it be better to disable it by default and right mouse click to launch?

Let's hope Windows 7 has this Trojan assistance taken out.

This is a very good in-depth article on this kind of attack using autorun/autoplay.

The concluding remarks from this article is worth quoting here:

Ignoring the DMA scenario for a moment, the success of the attacks I have discussed, as well as the success of the countermeasures, will depend on the privileges of the user using the computer. If the user is a standard user, the amount of damage the exploit can do is limited. It can still steal that user's data and anything that user has access to. However, the attack will likely not impact the network at large.

However, if the user being exploited is an administrator, the consequences can be a whole lot worse.

Who needs any other spyware?

With one big malware that's the browser, called Chrome, who needs any other one!

Portable devices preinstalled with Malware from manufacturers

Today, I was shown two portable devices - one was a Toshiba 4G memory drive and the other one was a portable ruggerdized hard drive made by I-O Data. On the surface, none of them is found offensive until you insert them into your machine. I was asked to get rid of the programs spawned by these device upon insertion.

This request was a warning to me of potential attack using autorun and so I examined it using my machine that has autorun permanently disabled for security reason, particular since Sony used this technique to infect user's machine before the user had any chance to decline installation of any software.

After inserting the Toshiba into my machine, it took up 2 drives letters. I was asked to eliminate the annoying programs that started automatically when they are inserted.

This is a good reason why you should disabled autorun permanently on all drives because none of these annoying malware runs up on my machine.

The Disk Manager gave this away. One drive letter was consumed by CDFS and the materials on this drive gave this away as being from U3.

The second partition was just an ordinary FAT partition. It is not U3 that I have found offensive.

The second device was a Japanese made 12G rugged portable hard drive. Once again it behaved like that of the Toshiba, except that it did not have English instructions with this devices. They are all in Japanese. Once again one partition containing their software was packaged in a CDFS.

What I have found offensive with this kind of device is their manufacturers' arrogance and dictatorial attitude in not asking their user if they want to configure the devices in that manner.

Their behavior is identical to that used by Sony Rootkit attack in not seeking user' consent in loading up all these software, no matter how useful the manufacturers believe in. Thankfully the U3 had provided a program to eliminate the u3 partition on the device and I quickly used it to get rid of that rubbish. But it did not come with that CDFS partition. I had to download from their site. The I-O Data was less friendly.

The only way to treat that kind of device is to send it back to the manufacturer for a refund. Don't touch it and consider them as being malware infected.

Anyone considering buying any portable device should examine the product description to determine if they are infected with this kind of anti-customer malware. If I buy a drive, a hard drive or memory drive, I want to format and partition it in any manner I want. Not forced upon by the manufacturer.

Sony is another company caught recently with this kind of stupid acts with their Microvault.

Because I turned off the Autorun, I minimized the attack to only losing a drive letter to that partition that was loaded as a CDFS. None of the Malware was started.

For those that has the default settings on allowing Autorun, the U3 will be automatically loaded on the Toshiba device because the CDFS has the autrun.inf.

On the I-O Data Portable device, it can be more damaging had I allowed it run the Autorun.inf. It would have loaded 3 programs: AutoCRD.exe, and two others as well as some DLL. All without seeking users consent.

Since these companies are so rude to their customers, people should avoid buying this kind of rubbish until they treat their users with respect. In the mean time turn off Autorun permanently.

If anyone knows of any general software to delete CDFS on portable devices, please let me know.