1. Malware: Viruses, Worms, Trojan Horses, & Spyware What They Are & How to Deal with Them Jay Stamps, jstamps@stanford.edu, 723-0018jstamps@stanford.edu ITSS Help Desk Level 1 Training, November 18, 2004

2. Course Objectives  Understand what malware is, where it comes from, and what it does  Diagnose compromised or infected computers based on reported symptoms  Basic troubleshooting techniques for possibly compromised computers  Research & diagnostic tools  Prevention: Worth a pound of cure!

3. It’s Been a Rough Few Years for Windows PCs…

4. Sorry…  But that was the last picture you’re going to see in this presentation!  The good news is that your instructor loves questions, and you’re cordially invited to interrupt him at any time, or save your questions for later  It’s a clich é, but there are no “ dumb questions ” : The point is to learn  And if I don ’ t have a good answer, I ’ ll suggest that you make finding one part of your homework assignment!

5. What’s “Malware”?  Shortened form of “malicious software”  But it’s not always really malicious  So “malware” is a general term for:  Computer and macro viruses of any kind  Internet and mass-mailing worms  Trojan horses, backdoors and rootkits  Other computer exploits, bots, zombies  Spyware, adware, and other software installed on a computer without the user’s knowledge or informed consent  And then there are the “hoax viruses”…

6. Why Use the Word “Virus”?  The analogy with biological viruses  Computer viruses exist to self-replicate  They can often adapt (mutate) to survive  They might or might not harm the host  They “infect” by inserting themselves into a “healthy” system (be it a computer program or living organism)  The term “virus” is heavily overused  That’s why we’re talking about “malware”  But when someone’s PC is misbehaving…  They call 5-HELP and say, “I’ve got a virus!”

7. Are Only PCs Affected?  The answer is “No”  Are Macintoshes immune?  The answer is “yes and no” - sort of…  The first virus in 1982 infected Apple IIs  A great deal of malware - some of it not so malicious - existed for Mac OS “Classic”  Are there any Mac OS X malware programs? Well, not in the wild, not yet…  What about Unix and Linux OSes?  Lots of malware is in circulation for these platforms - lots!

8. Why Does Malware Exist?  When “viruses” first became common…  And “normal people” began to use personal computers…  If a “virus” struck, they were confused, alarmed, felt violated…  They’d ask, “Where do these things come from?” and “How did I get infected?”  Often they’d feel embarrassed, like they’d picked up an STD in a reckless moment…  When told, “People deliberately create viruses,” they’d properly ask, “Why?”  What do you think? Why does malware exist? (Possible homework assignment!)

9. Brief History of Malware  “Viruses” appeared in early 1980s  Very soon after first personal computers  They spread by floppy disks, later via “bootleg” & other software on “BBSes”  They often weren’t meant to be destructive  Internet “worms” arrived in late 1980s  “There may be a virus loose on the internet.” - Andy Sudduth of Harvard University, 34 minutes past midnight, November 3, 1988

10. Brief History Continued  First mass-mailing worm came in 1999  Usually called the “Melissa virus”  It was also a “macro virus”  Infected file had to be opened in MS Word  Spyware hits the scene around 2000  “Adware” claims to be legitimate, legal  “Browser hijacking” is common symptom  Other exploits, trojans, backdoors…  Have been around for a long time  Hackers target entities for malicious attack, or may want “free” computing resources

11. We’ll Stick to MS Windows  The majority of computer users at Stanford have Microsoft Windows PCs  The majority of malware “in the wild” today attacks only Windows PCs  Malware is very platform-dependent  Microsoft has only recently made computer security a priority  In the past…  MS tended to “enable everything by default”  Network-connected “services” running on a computer are an open invitation to hackers

12. Why So Much Malware?  Is malware becoming more common?  Yes!!! It is!!! (and harder to fight off)  Why might that be?  The Internet! Plus all the high-powered PCs in homes & offices connected to it  Why does that make a difference?  As with biological viruses, lots of people (or computers) are rubbing up against each other in a common space; and computers (like people) don’t always cover their mouths when they sneeze…

13. “Help! I’ve Got a Virus!”  A lot of people self-diagnose (wrongly)  “Doc, I think I’ve got the flu.” “How much did you drink last night?” “Uh, three six packs. I think. I don’t really remember…”  Only a few years ago…  Most folks who thought their PC had a viral infection were wrong!  When PCs behaved strangely, usually there was a problem with the OS or an application that was not at all virus-related  Today that’s still true, but…

14. Today That’s True, But…  Malware is more common, while OSes and applications are both more feature- laden and (often) more robust  More features mean more potential vulnerabilities for hackers to exploit  Greater robustness means strange behavior is somewhat likelier to be caused by malware  Plus more people use protective software  Few people these days are unaware of the necessity of running antivirus software  Some people even use it correctly!

15. You Answer a Call to 5-HELP  And the caller begins to explain…  “I think my PC has a virus”  Maybe it does, and maybe it doesn’t  We’ll look at diagnostic approaches presently  “I got an email from the Security Office…”  Get the details, but…  A referral to the Level 2 Help Desk, or local or contract support is probably the right move  If Networking or the Security Office has noticed a problem, the computer is almost certainly hacked  If the caller has self-diagnosed, or if you suspect malware is involved, you ask…

16. The Usual Questions 1  If a caller’s PC might have an infection, or otherwise be compromised:  Ask what version of Windows they’re using  Ask them if they’re keeping it patched  Ask them if they’re using antivirus software, and if it’s up-to-date  For Windows 2000 & XP, ask them if they have good passwords for all user accounts  Ask them if they use a firewall  The caller may not know the answers to some of these questions, of course…

17. The Usual Questions 2  So you may need to guide the caller to learn the answers to these questions  To check if Windows is properly updated, have the caller visit:  http://windowsupdate.microsoft.com http://windowsupdate.microsoft.com  Launch Symantec AntiVirus to check the date of the virus definitions file  To check password strength, use the Stanford Security Self-Help tool  Windows XP has a built-in firewall, as do many broadband routers

18. The Answers  If a user can’t access the network, that problem is likely not caused by malware  If a user can’t run, install or update SAV or other security software, that’s a clue that the PC has been infected by a worm  If Windows isn’t patched, and/or AV software is out of date, and/or user accounts have weak passwords, the PC is definitely vulnerable to compromise  If the web browser (especially IE) goes to unexpected sites, suspect spyware

19. More Symptoms  We’ve just looked at a couple of common symptoms of malware  Here are some other possible signs:  Sluggishness  One or more unexpected restarts  Frequent system crashes  Constant hard disk activity  Generalized “strange behavior”  Hackers try to hide their presence: If they’re good, they will succeed  Worms and some viruses do likewise

20. Steps to Recovery  Most symptoms of malware also have other, more mundane causes  If there’s any reason to suspect the presence of malware on a user’s PC, update virus definitions, disconnect the network cable, and run a full antivirus scan of all hard drives  Install and run SpySweeper  And always, always teach computer users how to protect themselves from malware! Prevention is key!

21. Mass-Mailing Worms  Mass-mailing worms are one of the most common vectors for malware  Most people know not to open “suspicious” email attachments  But the worm writers are getting a lot craftier, and the attachments often look less “suspicious” these days  Many people are still confused by sender address “spoofing”  Mass-mailing worms mail themselves out using randomly chosen sender addresses

22. I Got a “Suspicious” Email  A caller might say:  I got a strange email message from my bank (or a bank I don’t even use), etc.  I got a message from my “system administrator” telling me to do something  I got a message from a friend telling me there’s some file I’m supposed to delete  Such messages are usually “phishing” attacks, or “hoax viruses”  Delete the email message; don’t do what it says; never give out private information

23. Top 6 PC Security Must-Dos  Patch Windows automatically  New patches 2nd Tuesday of each month  Use BigFix & Windows Automatic Updates  Use strong passwords (even better, pass phrases) for all user accounts  Use a firewall, such as Windows XP’s built-in software firewall  Use and properly maintain good antivirus software  Don’t open suspicious email attachments  Disable Windows File & Printer Sharing

24. Tools for Prevention  Essential Stanford Software  http://ess.stanford.edu http://ess.stanford.edu  Symantec AntiVirus  BigFix client  SpySweeper  Security Self-Help Tool  Use the Firefox web browser (not IE)  Stanford Secure Computing web site  http://securecomputing.stanford.edu http://securecomputing.stanford.edu  Microsoft Baseline Security Analyzer  http://support.microsoft.com/kb/320454 http://support.microsoft.com/kb/320454

25. Questions? Research Tools  If you’ve been saving up questions, now’s your chance!  Tools for research & troubleshooting:  http://support.microsoft.com/kb/129972 http://support.microsoft.com/kb/129972  http://www.google.com http://www.google.com  http://www.sarc.com http://www.sarc.com  http://www.mcafeesecurity.com/us/security/home.asp http://www.mcafeesecurity.com/us/security/home.asp  http://housecall.trendmicro.com/ http://housecall.trendmicro.com/  http://en.wikipedia.org/wiki/Computer_virus http://en.wikipedia.org/wiki/Computer_virus  http://www.spywareinfo.com/ http://www.spywareinfo.com/  http://support.microsoft.com http://support.microsoft.com  http://www.microsoft.com/technet http://www.microsoft.com/technet  http://www.cert.org/ http://www.cert.org/  http://www.cisecurity.org/ http://www.cisecurity.org/