Fake-AV Malware infections

Hello TRL,

Like QC mentioned, some of the behavior that causes infections is also used with legit behavior. I too have championed this same issue in this post regarding issues like these, and the approach of the Tamper Protection feature.

/search?q= 10045

 In your case it sounds like it did not prevent the malware from "tampering", which was one of my points in my posts on that thread. Security these days it headed towards a layered approach. There are so many avenues of attack, and thousands of signature based attack variants are being produced daily. Sophos, and any other virus detection suite will not be able to catch them all.

One thing that I am always concerned about is malware like the Zeus botnet, which has been reported on millions of systems in which most variants go undetected by AV. A common tactic is to push out Fake AV malware to the bots and then perform priveledge escalation / rootkit attacks. Be very vigilant to this type of activity and do not assume that you are NOT affected. Some of the most secure companies have been affected by this type of malware. Check for hidden data streams, suspicious traffic, ports listening, etc. to make sure this isn't the case if you can't find a clear reason or sites where this malware could be coming from.

Preventing all attacks like this will be an uphill battle and something that is a continuous process, rather than a "set it and forget it" thing. This is what I would recommend:

• Layered approach. It's often said that even if you installed 3 different brands of AV on a machine, that it still wouldn't be able to detect over a third of viruses in existence. Take a look at application whitelisting solutions that can lock down kernel processes and memory space and run them along side Sophos which can detect suspicious behavior. Make sure to set good HIPS behavioral policies within Sophos to give you warning signs even when a detection signature may not be present. Sophos can only detect what it knows about, so running a solution like this is best practice.
• Consider using a Web Gateway Proxy device, which can pro-actively scan links which lead to malicious content and downloads based on behavior and signatures. A web content filter helps tremendously if it's also a proxy that can do on-the-fly analysis. Make sure that Sophos Web Intellegence is set to block malicious sites as well, and is sending the data back to Sophos.
• Consider locking down and hardening your web browsers. Microsoft just realeased this Tuesday a fix for a Zero-day in IE that has been active for months. Lock down the zones, active X, cookie security, and force TLS and make sure that ANY plugins dealing with Adobe Reader, or applets are kept up to date.

Hello TRL,

Like QC mentioned, some of the behavior that causes infections is also used with legit behavior. I too have championed this same issue in this post regarding issues like these, and the approach of the Tamper Protection feature.

/search?q= 10045

 In your case it sounds like it did not prevent the malware from "tampering", which was one of my points in my posts on that thread. Security these days it headed towards a layered approach. There are so many avenues of attack, and thousands of signature based attack variants are being produced daily. Sophos, and any other virus detection suite will not be able to catch them all.

One thing that I am always concerned about is malware like the Zeus botnet, which has been reported on millions of systems in which most variants go undetected by AV. A common tactic is to push out Fake AV malware to the bots and then perform priveledge escalation / rootkit attacks. Be very vigilant to this type of activity and do not assume that you are NOT affected. Some of the most secure companies have been affected by this type of malware. Check for hidden data streams, suspicious traffic, ports listening, etc. to make sure this isn't the case if you can't find a clear reason or sites where this malware could be coming from.

Preventing all attacks like this will be an uphill battle and something that is a continuous process, rather than a "set it and forget it" thing. This is what I would recommend:

• Layered approach. It's often said that even if you installed 3 different brands of AV on a machine, that it still wouldn't be able to detect over a third of viruses in existence. Take a look at application whitelisting solutions that can lock down kernel processes and memory space and run them along side Sophos which can detect suspicious behavior. Make sure to set good HIPS behavioral policies within Sophos to give you warning signs even when a detection signature may not be present. Sophos can only detect what it knows about, so running a solution like this is best practice.
• Consider using a Web Gateway Proxy device, which can pro-actively scan links which lead to malicious content and downloads based on behavior and signatures. A web content filter helps tremendously if it's also a proxy that can do on-the-fly analysis. Make sure that Sophos Web Intellegence is set to block malicious sites as well, and is sending the data back to Sophos.
• Consider locking down and hardening your web browsers. Microsoft just realeased this Tuesday a fix for a Zero-day in IE that has been active for months. Lock down the zones, active X, cookie security, and force TLS and make sure that ANY plugins dealing with Adobe Reader, or applets are kept up to date.