Gladiator Research and Security

Part 1 – Recognizing an Infection
Part 2 – Incident Response Plans and Procedures

In the first part of our Gladiator guide on Malware Basics, we discussed different methods of determining whether a device or network has a malware infection.  Having discussed how to find these malicious infections, we will now review what to do when your phone begins ringing off the hook with users claiming that “the Internet is slow,” or that their workstations are exhibiting signs of a malware infection.  Administrators’ questions at that point usually include, “Where do we go from here?  Whom do we notify and what actions need to be performed to ‘clean up’ the device?”  The answer to all of these questions should be documented in a formal Malware Incident Response Plan.

Part 1 – Recognizing an Infection
Part 2 – Incident Response Plans and Procedures

Introduction

We’ve all been faced with the following situation at one time or another.  Imagine you’ve just walked in the door of your office, and one of your coworkers comes up to you complaining that his computer is running slowly.  You tell him that is normal in the morning, but then he says his web browser keeps popping up new windows and then crashing.  Of course, he forgets to mention that he was on a flash game website when it all started, until you get to his desk and discover this for yourself.  So, now what do you do?  You suspect this machine has a virus or some other type of malware, but you aren’t sure.  The computer has fully-updated virus definitions and a full system scan didn’t find any malware.  But is the machine safe?

In Part 1 of Malware Basics, we’re going to review some signs that a machine may have malware.  Then we will go over some useful tools for identifying suspicious files even if your antivirus suite does not detect anything.  Finally, we’ll talk about how to identify what type of malware you found.  Part 2 of this series will deal with Malware Incident Response.