Discussion question

The lab consist of using the AVG scan in the virtual machine to detect the different threats that were found which were moved to the virus vault. The window defender was used to verify the different infections and spyware that were found in the virtual machine. Malware and spyware are growing trends in the world of technology. It is good to know the steps to take just in case your system is infected with these nasty malicious malware and spyware.This is a screenshot of the number of threats that were identified by the scan.

Screen shot of the detailed view of the 1st infection “”;”C:HelixIRRAMwin32ddwin32dd.sys”;”Trojan horse Hider.JI”;”Moved to Virus Vault”

Screen shot of the detailed view of the 2nd infection “”;”C:HelixIRnirsoftLSASecretsView.exe”;”May be infected by unknown virus Win32/DH{HhMXFE8VGw}”;”Moved to Virus Vault”

Screen shot of the detailed view of the 3rd infection””;”C:HelixIRbinpwdump2.exe”;”May be infected by unknown virus Win32/DH{HhRPFRs}”;”Moved to Virus Vault”

Screen shot of the detailed view of the 4th infection “”;”C:HelixIRbinPsh.

This is a screenshot of the AVG’s Threat Detected alert window.

This is a screenshot of the productreview.pdf file displayed in the vault.

Remediation Steps

There are many steps that can be followed to remove malware and spyware.

There are several steps to remove infections such as a Trojan horse or a Trojan dropper from your computer system. 1. Reboot the system2. Make the system restore is turned off so that the system does restore the infected file. 3. Launch anti-virus software that is installed on the system. 4. Go to disk view and highlight your computer and then select scan/ repair to that the anti-virus can detect the Trojan and put it in the recycle bin. 5. Restart the system and make sure the recycle bin is emptied. 6. Make sure the Trojan was deleted successfully by running another scan.

The steps to remove spyware are different than the steps to remove an infection. The steps are as follows: 1. First, delete the temporary files.2. Make sure the system restore is turned off.3. Then install anti-virus/ anti-spyware program, an examples would be bit defender, or malwarebyte ant-malware. 4. Run a full scan and whatever is found, then delete it5. Restart computer to make sure the spyware is deleted.

This is a screenshot of the File Transfer file.

Lab Assessment Questions and Answers

1. Workstation and desktop devices are prone to viruses, malware, and malicious software, especially if the user surfs the Internet and World Wide Web. Given that users connect to the Internet and World Wide Web, what security countermeasures can organizations implement to help mitigate the risk from viruses, malware, and malicious software? Organizations can restrict certain sites, keywords like blogs, and mirror sites.

Organizations can block ingress of files that contain potentially dangerous content and also consider blocking all compressed executables from entry (Centre for the Protection of National Infrastructure, 2004). They can also make sure specific ports are shut down; this can prevent back doors when accessing a site. There are a lot of websites out there that do not need accessibility, especially for work environment.

2. Your employees e-mail file attachments to each other and externally through the organization’s firewall and Internet connection. What security countermeasures can you implement to help mitigate the risk of rogue e-mail attachments and URL Web links? Many business owners must examine what is at risk when they communicate sensitive data over email. The first thing is to make sure that a good virus protection software is install and updated on everyone computer place. Second it is good that all key departments within the organization, such as legal IT and H, understand the policies; require them to sign off on the email filtering, retention, retrieval and analysis policies (Small Business Computing Staff, 2011).

3. Why is it recommended to do an antivirus signature file update before performing an antivirus scan on your computer? Signature files contain the latest list and behavior of known viruses that why it’s important to update the antivirus signature file before performing a scan on your computer. Anti-virus programs release signature files updates regularly sometimes daily sometimes more often because new viruses are being identified on a daily basis (Loza, 1999). 4. Once a malicious file is found on your computer, what are the default settings for USB/removable device scanning?

What should organizations do regarding use of USB hard drives and slots on existing computers and devices? Many of the USB devices have serial numbers associated with them. Most of the scanning and tracking details would be use with most of the USB mass storage devices. Organizations should immediately disable the auto run on the system. The devices that are connected to the infected computer should be scan for malicious malware and spyware. 5. If you find a suspect executable and wish to perform “dynamic analysis,” what does that mean? Dynamic analysis is the testing and evaluation of a program by executing data in real-time (Rouse, 2006). The objective of the dynamic analysis is to find errors in a program while it is running rather than repeatedly examine the code offline. The codes are easily notice while the program is in use to help detected the error codes.

6. What is a malware and malicious code sandbox?

A sandbox is a virtual environment with its own its own guest operating system where intercepted incoming can be observed (Jackson, 2013). By observing the behavior in the sandbox, it should notice and blocked malware regardless of whether the code or the vulnerability it exploits is already known.

7. What are typical indicators that your computer system is compromised?

There are several indicators that your system may be compromised. The computer is extremely slowApplications won’t startCan’t connect to the InternetThe antivirus is turn offThere are entirely different browsers, and item are opening up and there are a lot of pop ups. 8. Where does AVG Business Edition 2012 place viruses, Trojans, worms, and other malicious software when it finds them? When going through the steps in the AVG Business Edition 2012 in the lab the viruses, Trojans, worms, and other malicious software were put in a vault. It was then deleted out of the virus vault. The viruses are quarantined and then isolated and deleted by the user. 9. What other viruses, Trojans, worms, or malicious software were identified and quarantined by AVG within the Virus Vault upon completion of the Whole Computer Scan? There were 4 infections that were found during the whole computer scans. The 4 infections are as follows: Trojan horse Hider.JI”

Win32/DH{HhMXFE8VGwWin32/DH{HhRPFRs}Trojan horse Dropper.Generic4.BVMAIn the scan was also 3 spyware that were found as wellLogger.IACTool.ITRemoteAdmin.IH

10. What elements are needed in a workstation domain policy regarding use of antivirus and malicious software prevention tools? It is important that the needed elements are included in the workstation policy to make sure that the antivirus and malicious software are used properly. Tech support must make sure that everyone is following the guidelines of keeping the system safe from malware and spyware. A policy should be in place to let the employees know the importance of using the antivirus and malicious tools properly.

ConclusionBy going through the steps in the lab, there were many infections and spyware that were detected and later moved to the virus vault. The different viruses were moved to the vault so that they would not infect the rest of the system. In assessment were steps that must be taken to make sure that the infections and spyware are completely deleted from the system. Therewere many techniques that were learned about infections and spyware and where they should be moved when they are detected by the AVG scan.

Reference

Centre for the Protection of National Infrastructure (2004). Mitigating the risk of Malicious Software. Retrieved from http://www.cpni.gov.uk/documents/publications/2004/2004002 advice_malicious_software.pdf Jackson, W (2013). Hackers’ new trick for slithering through sandboxes Retrieved from http://gcn.com/blogs/cybereye/2013/02/hackers-new-trick-outwitting-

sandboxes.aspx

Loza, C, (1999). Why Is It Important to Constantly Update Antivirus Software? Retrieved from http://www.ehow.com/facts_6850079_important-constantly-update-antivirus-software_.html

Rouse, M (2006). Dynamic Analysis Retrieved from http://searchsoftwarequality.techtarget.com/definition/dynamic-analysis Small Business for Computing Staff (2011). 5 Email Security Tips to Protect Your Small Business. Retrieved from http://www.smallbusinesscomputing.com/webmaster/article.php/3928231/5-Email-Security-Tips-to-Protect-Your-Small-Business.htm