Vista - Infection Resolving Team

Wow thanks Norm, . I didn't think any security software would be as bad as to quarantine the explorer...

I second A-Squared to be a "low proformance" program.
Dont like it and wont use it or recommend it.

Some have done FAR worse than that over the years my friend..
I've seen poorly written scanners corrupt the entire kernel, many times. Before XP & Vista, especially Vista, most AV and security programs had to use kernel patching to interact with the lower system functions and this was always a big problem and HUGE security risk in itself.
Vista originally did not allow ANY kernel patching and that's why the security companies were so slow to release Vista compatible products. Many of them lobbied MS to allow kernel patching again since it was the only way they knew how (at the time I guess) to integrate and update the scanners, but MS stood firm on the side of OS security.
In the end MS had to find a way to allow a certain level of patching while still maintaining the kernel integrity.

But I digress...I have seen scanners delete the WINDOWS folder as "infected"...the Entire folder and not just a possibly infected file within it. I've seen scanners delete every executable file on the system due to a single infected exe...I've seen some that couldn't catch a virus if one fell in the developer lap and screamed "I'M A VIRUS!!!".
I've seen some really poor scanner coding in my day and I'm sure we'll see lots more in the future.

Do you mean the AV scanner Ben, or the way to scan an unknown file to see if it's infected?

The scanner is a complex piece of coding and that's why so many are not very well done and why it's hard to do it right the first times. That's well out of my league.
But the files I decompiled personally were all sent to me by AV companies to test for unwanted behaviors. Back in the late 90's early 00's, many AV companies used independent testers because they still weren't big enough to employ full time testers yet. When a new unknown variant was picked up by their scanners and sent in for analysis, they would farm these out to us for decompiling and testing. Basically I had a sandboxed system, triple boot (95, 98, W2K, later early XP) and I would monitor what system changes these files did to the OS upon execution. I had specifically built programs for this, mostly supplied by the AV company but other tools as well, many Linux based but with Windows GUI's.

After finding out what the file did to the system I would sandbox it on my main system and decompile the file to see what function calls and other things it did like port opening, listeners, dialers, keyloggers, smtp server...etc. Then I would compile a report about the file and it's functions and if possible I would recommend the type of signature base I would use against it. Back then AV's used sig files to combat malware since that was about all there was but some companies like Eset were working on their heuristics engines which really work well on unknown malware behaviors.

All the AV companies stopped using independents by around 2004 and I quit in late 02. I found it hard to keep up with the complexity (and sheer volume) of new variants as they started using professional software engineers to write malware and it left the realm of the simple hacker types and skript kiddies. I tell you..much of the malware is better written than most legal programs out there lately and it takes real professional engineers to do that work now.
It was fun while it lasted tho and I met allot of cool and very smart people and learned allot of what went on behind the doors.

Thanks Chappie, welcome back.

Norm

Hey Chappy,

Scanning files is easy
Using this example, it scans the entire directory specified by the "SysPath" attribute where I can then input each file into the FileSigCheck function for processing of each file found

Its the way they pass file parameters and check file signatures thats the huge problem with nearly all AV scanners...

To give you a better picture of my code in action, I used the system Directory (DarkGreen entries are files protected by Windows built-in System File Check)

Each file is passed into FileSigCheck() then it checks a predetermined set of heuristics and signature checks to specify color depending on the files identified (currently 3000 different results)




I have been working on an huge update to my System File Check Utility found in the Tutorial Section if anyone is interested in giving this new scanning engine a try? (pictured above)

Steven

[quote=dmex;923144]
Hi Steven, Of course it's easy. I could do that, piece of cake. Of course I'd have a wee problem understanding it. Not that 'y

I have however used your System File Check Utility, a magic little utility and one I thoroughly recommend to all. An upgrade would be the icing on the cake for what is already a great tool.

Norm

Hi Dmex

Well done my friend!
Did you develop the heuristics engine yourself? If so, how did you incorporate the 1000's of behaviors that current malware can exploit, or did you use access calls to system files or stacks as a main read on malware behavior?

I'd be very interested to know a bit more...my coding is rusty to the point of being seized up solid, so I'm not much help that way, but I can test things if you need. I'll d'load your utility tonite and have a look see. Of course I would not think of trying to decompile your work but if you have a code sample I can look at I would appreciate that.

Thanx Norm, it's good to be back!

Edit - After a re-read on your utility dmex, is it strictly a system file check utility, or does it have the capability to recognize other parameters? I would love to know more if that's cool by you.

I use SUPERAntispyware.

Hi Norm ,

That's strange, I have scanned my pc with a squared free many times without a problem . Maybe they have improved it since that review.

SIW2

Hey everyone its been a while!
I had a rockin christman(got the new blackberry storm) and was off to drivers ed the next day. I dont even have time to breath anymore haha.
So i was catching up on the posts here.

SIW2,
i think it misses some things though. More then a scanner should. If it works for you though, you should deffinatly. That was just my personal opinion.

Norm+Chappy,
Great posts as always. Such an honor to have you two on the team here. Huge heps and great info.

And dmex,
Amazing stuff man. I wouldnt know how to do that at all! Care to shine in a little on how you did that?

Thansk ya'll and im glad to finally be back,
B-E-N

(haha new way to put my nam, haha, i know im four haha)