Anatomy of a blended threat

Trojan.Ascetic.C

This is the first virus I have had to deal with at a Scheduled Support client.

It is a good example of a blended threat--that is, it's not a hacker, not a worm but a little of both. Here's how I think it worked at my client:

Part 1: Vulnerability is created.

1. Hard drive crashes on PC.
2. Office manager replaces hard drive and reinstalls Windows along with any needed applications--except for antivirus software.

Part 2: Security incident occurs.

1. Some time later user receives spam-type message, possibly innocuous-looking, possibly purporting to be from a friend.
2. User clicks through to the Web site linked from the email. Web site exploits a vulnerability in IE to install a trojan horse spam engine on her PC.
3. Constituents, board members, staff, receive tons of spam messages from PC. Complaints flood in.

Part 3: Response to security incident.

1. Office manager spot-checks computers and discovers this one does not have anti-virus software.
2. She tries to install the anti-virus software from the installer located on the server, but could not because she was confused by the options in the installer menu.
3. She uses the free online Trend Micro online virus scan, which consistently mis-identifies the infection and declares each time that it has been removed.
4. Upon installing SAVCE and running a scan, no virus is found. But we're still suspicious.
5. Using Autoruns from Sysinternals we check the programs that are set to start up automatically and find one that looks legit but is not. The process cannot be killed from the Task Manager.
6. Removing the autorun from the list and restarting kills the process (pskill.exe from Sysinternals would also do it).
7. Now running the scan with SAVCE locates and quarantines the virus.
8. Now that we know what the virus really is we're able to get more information from the Symantec Web site.
9. We discover that the trojan normally would have made some changes to the HKEY_LOCAL_MACHINE portion of the registry, but since this user (like most of the people on networks I administer) did not have admin rights on her computer, those entries were not created. For all the good that did. But it still is a good example of why I recommend users run with reduced rights.

Part 4: Remediation of security measures

There are a few things that could be done to prevent a recurrence of an incident like this.

1. Regular audit of anti-virus installations to ensure complete coverage.
2. Implementing a filtering web proxy (such as Websense) to prohibit visits to malicious sites.
3. Improving the security of Internet Explorer through Group Policy, or moving to a less-targeted browser such as Firefox.
4. Behavior modification and training for end users to reduce liklihood of clicking through to malicious Web sites.

We'll try to implement the first one. Whether the other steps are taken or not is up to the client.