The following is a first-hand story from one of our business partners. I thought it was worth sharing as we often feel that certain “types” of software programs and utilities are safe because of their nature or purpose. Let the Downloader Beware!
Proactive PC User
This is a personal experience with the home office PC of a partner of ours. It taught her a lesson to take the same precaution with her own personal computer at home as she does at work. The story refers to a computer virus and having to deal with this unfortunate occurrence. Her home PC was running slower than usual. There were pop-ops; she could not load certain websites; and there were many more operational issues. It took this person two days to figure out what they had done differently. Then she remembered downloading a free eReader application. All of a sudden, she went into panic mode and started reacting instead of being proactive. The “cybercriminals who publish and distribute malware devote significant effort to convincing or tricking Internet users into clicking links that lead to malware, or that download malicious attachments or applications”(Microsoft, 2013, p. 3).
What is a computer virus?
They are unwanted, sometimes destructive software programs that often times have the ability to spread from one computer to another. Their objective is interfering with the computer’s intended operation. Viruses often have the ability to corrupt, delete, or copy and send “home” important information on your computer.
Important Terminology
- Adware -Advertising-supported software that plays, displays, or downloads advertising content on your computer. Adware may or may not be destructive, and may or may not jeopardize sensitive or regulated data.
- Companion Virus – Replicate by exploiting the precedence hierarchy according to which the operating system executes program files based on their filename extensions. A good example of a companion virus is a search order to exploit the DLL files. If the malware replicated itself as a DLL application directory, it would take precedence over the DLL with the same name in the system directory.
- Exploits – Malicious code that takes advantage of vulnerabilities specific to software. Exploits can infect, disrupt, and even take control of your computer without your knowledge. The usual focus is on the operating system, web browsers, applications, or software components installed on the computer.
- PUAs- Potentially unwanted applications that contain a broad category of software that has a less threatening intention. It is also referred to as grayware. It still has the capabilities of potentially altering the behavior of your computer. An example would be adware, spyware, various browser toolbars, bundleware, trackware, etc.
- Ransomware – Type of malware that is specifically designed to render files unusable until the user pays a fee to the attacker via electronic money transfer. The message will have an official look similar to the U.S. Federal Bureau of Investigation (FBI) and Scotland Yard. When the ransom has been paid, a password is then provided or access to the computer is restored. The ransom is usually demanded in untraceable Internet currency.
- Rogue security software – Common method that attackers implements to make money, also called scareware. The software makes it seem like you are at risk, or that it would be helpful to have to have a secured computer, but in reality there is no real security provided! In fact they are misleading alerts to temp users to spend their hard earned dollar. The software mimics legitimate security software with the scare tactics of non-existent threats and urging the user to pay for the full version to assist with the removal of the threats.
Some samples of those that don’t hurt a PC, but are only an annoyance
Win32 Adware was frustrating, but with the help of SMEs, it can be removed.
Win32/adware.virtumonde virus is an adware that is designed for delivery of unsolicited advertisement and usually comes in a grouping of other malware.
Win32/AdWare.MultiPlug.N is the threat name and it is categorized under riskware. According to eset their detection it was created December 23, 2013. Prevalence map indicated the highest percentage in Asia such as Laos at 2.22 % and one of the lowest in the United States at 0.28%. The world activity peaked at 2.71% in December 23, 2013. Now in March of 2014, a declining trend is showing to about 0.46% on an average.
Research Examples
DLL files (message will pop up relating to DLL files):
According to Microsoft, DLL is the acronym for Dynamic Link Libraries. A DLL is a library that contains code and data that can be used by more than one program at the same time. For example, in Windows operating systems, the Comdlg32 DLL performs common dialog box related functions. Each program can use the functionality that is contained in this DLL to implement an Open diaglog box. This helps promote code reuse and efficient memory usage. “The use of DLLs helps promote modularization of code, code reuse, efficient memory usage, and reduced disk space. Therefore, the operating system and the programs load faster, run faster, and take less disk space on the computer”
The following list describes some of the files that are implemented as DLLs in Windows operating systems:
- ActiveX Controls (.ocx) files
An example of an ActiveX control is a calendar control that lets you select a date from a calendar.
- Control Panel (.cpl) files
An example of a .cpl file is an item that is located in Control Panel. Each item is a specialized DLL.
- Device driver (.drv) files
An example of a device driver is a printer driver that controls the printing to a printer.
DLL advantages
The following list describes some of the advantages that are provided when a program uses a DLL:
- Uses fewer resources
When multiple programs use the same library of functions, a DLL can reduce the duplication of code that is loaded on the disk and in physical memory. This can greatly influence the performance of not just the program that is running in the foreground, but also other programs that are running on the Windows operating system.
- Promotes modular architecture
A DLL helps promote developing modular programs. This helps you develop large programs that require multiple language versions or a program that requires modular architecture. An example of a modular program is an accounting program that has many modules that can be dynamically loaded at run time.
- Eases deployment and installation
When a function within a DLL needs an update or a fix, the deployment and installation of the DLL does not require the program to be relinked with the DLL. Additionally, if multiple programs use the same DLL, the multiple programs will all benefit from the update or the fix. This issue may more frequently occur when you use a third-party DLL that is regularly updated or fixed.
DLL dependencies
When a program or a DLL uses a DLL function in another DLL, a dependency is created. Therefore, the program is no longer self-contained, and the program may experience problems if the dependency is broken. For example, the program may not run if one of the following actions occurs:
- A dependent DLL is upgraded to a new version.
- A dependent DLL is fixed.
- A dependent DLL is overwritten with an earlier version.
- A dependent DLL is removed from the computer.
Signs and Symptoms
- Onslaught of pop-up advertisements
- Alerts stating your PC has been compromised
- Alerts will usually include message to help you remove the threats by downloading an additional program or purchasing something
- You PC is running slower than normal
- Unable to play a favorite game, or, in their words, “It was acting weird!”
- Inability to not load certain websites
Real World Example that is beneficial to both the work environment and at home
Scenario X – Work
“A company in a heavily regulated industry (such as banking or health care) may restrict its employees’ use of instant messaging (IM) due to regulatory concerns. To bypass this restriction, a new employee who wishes to chat with friends while at work brings in a USB flash drive with a portable instant messaging (IM) program on it. While free, the program is supported by advertising. It turns out that a criminal bought space on the advertising network used by the program, and uses a maliciously crafted advertisement to inject malware into the new employee’s computer, which then acts as a springboard for stealing the company’s intellectual property.” (Goretsky, 2011, p. 3)
Scenario Y- Home
“Potentially unwanted applications are not limited to the office. Imagine the following scenario: A child using a family computer downloads a “utility” program in order to add additional features to his or her instant messaging program or Minecraft account. The child clicks through the program’s installation process, ignoring the end user license agreement (EULA), and thus doesn’t realize that installing the program will also install adware that monitors user behavior and displays targeted advertising, and that replaces standard search recommendations with paid search results. The adware may then go on to redirect search results to sites from which additional malicious software can be deployed” (Goretsky, 2011, p. 3).
To remove this annoyance
- She upgraded her antivirus to the latest version (worth the money) to locate and remove the potential threats.
- The installed and upgraded antivirus actually found a variant of WIN32/AdWare.MultiPlug.N application, where a message informed the User that it was cleaned by deleting or quarantined.
- Several others were identified but not recorded, these would be available in the AV log.
- Performed several rounds of full system scanning.
- Reconfiguration of the anti-virus software to update itself regularly.
- The User had to modify behavior and occasionally check that the anti-virus software was the latest version, receiving regular updates, and that they added the license validation/renewal date in their calendar alert to renew my license prior to expiration.
Where it went wrong
The User had forgotten to update her anti-virus because she was too busy at work. She figured it was only her home PC and there’s nothing she needed to keep confidential or safe from prying eyes…Wrong! There were photos of her family, letters, their family’s home addresses and birth dates, copies of their own school work that was as yet unpublished, and more.
To Date
The User actively checks that their anti-virus is up to date. Behavior was modified to include understanding that “installing security software is the first step toward cybersecurity.” Their extensive research for the best anti-virus product they could afford for their home computer involved several steps. They (family) used several sources online such as PC Mag digital edition, 10 Best Online, and reading AV Comparative’s tests results. AV-Comparatives is an independent not-for profit organization where they test security software and determine if they live up to their promises. Thirdly they educated themselves with how to navigate the Internet with safety in mind. ESET Smart Security 7 provided the User with a training module complete with real life scenarios and tips for protecting their computer. ESET received high marks according to independent testing laboratories or an AAA rating, which is the highest possible from Dennis Technology Labs for example (Rubenking, 2013). However, ESET was not perfect either because in one test of blocking malicious URLs, ESET only blocked 41% of the over 100% URLs tried (Rubenking, 2013). Avast Internet Security 2014 received a better score which blocked 79% in the same category (Rubenking, 2013). The User enjoyed reading the 10 Best Online review because it was easy to see the comparison due to the visual details. They use the popular “5 Star Rating” (10 Best Online, 2014).
However, the bottom line is to find what is more important to you as a User and prioritize your needs.
The User expressed regret and misses playing a video game that their children had introduced to them as it, “Had simply disappeared!” It was probably due to a deleted or corrupted DLL file, or a dependent DLL was upgraded to a new version.
Either way, the User reported learning their lesson to continue to implement controls similar to their work environment on their home PC. In addition, they reported protecting all of their digital devices including their smartphone, tablet, desktop computer and laptop, even when used only in the home environment.
A few free tips:
In addition, protect your personal email, only use secure and private connections, don’t submit vital information such as your social security number online, check a link’s authenticity, creating a strong password for online accounts, change your password at least every three to six months, enable strict privacy settings on my networking sites, don’t link with anyone you do not know, think twice prior to sharing information or at least limit the details such as not providing your GPS location which will tell others that you are not home and become a target for physical theft for criminals, don’t clink on links in email, even if they are from known individuals, instead re-type important URLs into a fresh browser window after ensuring Real Time Protection is enabled on your PC, and be extremely wary of joke and humor sites, online surveys, and other questionable websites.
For your own organization’s Privacy and Security Training contact RISC Management and Consulting, LLC at Sales@RISCsecurity.com or visit our website http://www.riscsecurity.com/
References
ESET. (2014). ESET: Virus radar. Retrieved from http://www.virusradar.com/en/Win32_Adware.MultiPlug/detail
Microsoft.(2014). Microsoft support: What is a DLL. Retrieved from http://support.microsoft.com/kb/815065
Goretsky, A. (2011). Problematic, unloved and argumentative: What is a potentially unwanted application. Retrieved from http://go.eset.com/us/resources/white-papers/Problematic-Unloved-Argumentative.pdf
Rubenking, N. (2013). PC Mag: ESET Smart Security 7. Retrieved from http://www.pcmag.com/article2/0,2817,2428165,00.asp
Ten Best Online. (2014). 10 Best antivirus software comparison for 2014. Retrieved from http://www.10bestonline.com/top_10_best_antivirus_reviews/top_10_best_antivirus_comparison/
RISC Management and Consulting 
You must be logged in to post a comment.