Andrew Bettany and

Mike Halsey

Windows Virus and Malware Troubleshooting

Andrew BettanyMVP

Microsoft, York, North Yorkshire, UK

Mike HalseyMVP

Sheffield, South Yorkshire, UK

Any source code or other supplementary material referenced by the author in this book is available to readers on GitHub via the book’s product page, located at www.apress.com/9781484226063 . For more detailed information, please visit www.apress.com/source-code/ .

ISBN 978-1-4842-2606-3

e-ISBN 978-1-4842-2607-0

DOI 10.1007/978-1-4842-2607-0

Library of Congress Control Number: 2017934653

© Andrew Bettany and Mike Halsey 2017

This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.

Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, logo, or image, we use the names, logos, and images only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights.

While the advice and information in this book are believed to be true and accurate at the date of publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The publisher makes no warranty, express or implied, with respect to the material contained herein.

Printed on acid-free paper

Distributed to the book trade worldwide by Springer Science+Business Media New York, 233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax (201) 348-4505, e-mail [email protected], or visit www.springeronline.com. Apress Media, LLC is a California LLC and the sole member (owner) is Springer Science + Business Media Finance Inc (SSBM Finance Inc). SSBM Finance Inc is a Delaware corporation.

Thanks, Mike, for your vision in creating this troubleshooting series. I hope after reading this book, some readers will be saved from the pain otherwise incurred by malware. Stay safe.

—Andrew Bettany

With many thanks to Grzegorz Tworek and the security researchers at CQure.pl for providing a test virus, and for their help in making this book possible.

—Mike Halsey

Windows Troubleshooting Series

When something goes wrong with technology, it can seem impossible to diagnose and repair the problem and harder still to prevent a recurrence. In this series of books, we’ll take you inside the workings of your devices and software and teach you how to find and fix the problems, using a simple step-by-step approach that helps you understand the cause, the solution, and the tools required.

Series Editor

Mike Halsey, MVP

A417537_1_En_BookFrontmatter_Fige_HTML.jpg
A417537_1_En_BookFrontmatter_Figc_HTML.jpg

As a Microsoft MVP (Most Valuable Professional) awardee since 2011, the author of more than ten books on Microsoft Windows, and a teacher for many years, Mike Halsey understands the need to convey complex subjects in clear and non-intimidating ways.

He believes that the Windows Troubleshooting Series is a great example of how quality help, support, and tutorials can be delivered to individuals of all technical ability. He hopes you enjoy reading this and many other books in this series, both now and for years to come.

Contents

  1. Chapter 1:​ What Is Malware?​
    1. A Brief History of Malware
    2. The Psychology of Infection?​
    3. Different Types of Malware
      1. Viruses and Worms
      2. Spyware
      3. Adware
      4. Trojans
      5. Bots
      6. Rootkits/​Bootkits
      7. Backdoors
      8. Ransomware
      9. Spam and Phishing E-mails
    4. The Future of Malware
    5. Summary
  2. Chapter 2:​ Prevention and Defense
    1. Organizational-Level Security
    2. Core Microsoft Security Features
      1. Security Center/​Security and Maintenance
      2. User Account Control
      3. Windows Firewall/​Advanced Firewall
      4. Malicious Software Removal Tool
      5. Windows Update
    3. Windows Startup Security
      1. BitLocker Encryption
      2. Secure Boot
      3. Trusted Boot
      4. Early Launch Anti-Malware
    4. Anti-Malware Features
      1. Windows SmartScreen
      2. Windows Defender/​Security Essentials
      3. Windows Defender Offline
    5. Other Security Features
      1. App Containers
    6. 32-Bit (×86) and 64-Bit (×64) PCs
    7. Restricting Access to Files
    8. Summary
  3. Chapter 3:​ Malware Defense in Depth
    1. Firewalls
    2. Keylogging Software
    3. Software Firewalls
    4. Organizational Firewalls
    5. Blacklists and Whitelists
      1. The Rise of the Internet of Things
    6. The Windows Advanced Firewall
    7. Demilitarized Zone
    8. User Account Control
    9. Summary
  4. Chapter 4:​ Identifying Attacks
    1. How Malware Infects PCs
      1. Infector-Type Viruses
      2. Rootkits and Boot Sector Viruses
      3. Macro Viruses
      4. E-mail and the Internet
    2. How Malware Infects Networks
      1. Network-Based Security
    3. Identifying External Attacks
      1. Firewall Attacks and DDoS
      2. E-mail-Borne Viruses and Ransomware
      3. Spear Phishing
      4. Targeted Application Hacking
    4. Identifying Internal Attacks
    5. Summary
  5. Chapter 5:​ External Malware and Virus Resources
    1. Malware Protection Center
      1. Get Updates for Security Software
      2. Download Security Software
      3. Get Microsoft Support
    2. Microsoft Baseline Security Analyzer
    3. Windows Defender
    4. Third-Party Malware and Malware Removal Tools in Depth
      1. Malicious Software Removal Tool
      2. Windows Defender Offline
      3. Microsoft Safety Scanner
      4. Diagnostics and Recovery Toolset (DaRT)
    5. Windows Defender Advanced Threat Protection
    6. Summary
  6. Chapter 6:​ Manually Removing Malware
    1. Manually Removing Malware
      1. Step 1:​ Isolate the PC
      2. Step 2:​ Identify the Running Process(es)
      3. Step 3:​ Deactivate the Malware
      4. Step 4:​ Test the Results
      5. Step 5:​ Retest the PC
      6. Step 6:​ Remove the Malware
    2. Rootkit Removal
    3. Using BCDEdit
    4. Summary
  7. Index

About the Authors and About the Technical Reviewer

About the Authors

A417537_1_En_BookFrontmatter_Figb_HTML.jpg
A417537_1_En_BookFrontmatter_Fige_HTML.jpg

Andrew Bettany has been a Microsoft Most Valuable Professional (MVP) since 2012, in recognition for his Windows expertise.

As a Microsoft Certified Trainer, Andrew provides expertise and consultancy services to businesses in a number of technical areas, including Windows deployment and troubleshooting.

He cofounded and manages the IT Masterclasses series of short technical courses, available at www.itmasterclasses.com , and is passionate about learning and helping others. He is also a frequent speaker at conferences worldwide. In 2011 and 2013, he delivered a training boot camp in earthquake-hit Haiti to help the community rebuild its technology skills.

Active on social media, Andrew can be found on LinkedIn, Facebook, and Twitter. He lives in a village just outside the beautiful city of York, in Yorkshire, UK.

A417537_1_En_BookFrontmatter_Figc_HTML.jpg
A417537_1_En_BookFrontmatter_Fige_HTML.jpg

Mike Halsey was first recognized as a Microsoft MVP in 2011. He is the author of more than a dozen books on Windows, including Troubleshooting Windows 7: Inside Out , Troubleshoot and Optimize Windows 8: Inside Out , Beginning Windows 10 , and The Windows 10 Accessibility Handbook from Apress. He is also the author of other troubleshooting books related to Windows in this series. Based in Sheffield, UK, where he lives with his rescue border collies, Evan and Robbie, Mike gives many talks on Windows subjects, from productivity to security, and makes how-to and troubleshooting videos under the banners PCSupport.tv and Windows.do. You can follow him on Facebook and Twitter at @PCSupportTV .

About the Technical Reviewer

A417537_1_En_BookFrontmatter_Figd_HTML.jpg

Massimo Nardone has more than 22 years of experience in security, web/mobile development, cloud, and IT architecture. His true IT passions are security and Android.

Massimo has been programming and teaching how to program with Android, Perl, PHP, Java, VB, Python, C/C++, and MySQL for more than 20 years. He holds a master ofsScience degree in computer science from the University of Salerno, Italy.

He has worked as a project manager, software engineer, research engineer, chief security architect, information security manager, PCI/SCADA auditor, and senior lead IT security/cloud/SCADA architect for many years. His technical skills include security, Android, cloud, Java, MySQL, Drupal, Cobol, Perl, web and mobile development, MongoDB, D3, Joomla, Couchbase, C/C++, WebGL, Python, Pro Rails, Django CMS, Jekyll, Scratch, among others. He currently works as chief information security officer (CISO) for Cargotec Oyj.

He was a visiting lecturer and supervisor for exercises at the Networking Laboratory of the Helsinki University of Technology (Aalto University). He holds four international patents (PKI, SIP, SAML, and Proxy areas).

Massimo has reviewed more than 40 IT books for different publishing companies, and he is the coauthor of Pro Android Games (Apress, 2015).

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.14.253.152