Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A Microsoft Security Essentials virus scan just finished on one of our computers and it shows two potential threats in Internet Explorer's temporary internet files:

  1. Web page with Black Hole Exploit Kit
  2. Specially crafted PDF file (part of Black Hole Exploit Kit)

The two items were downloaded on the same date about a year ago, so I think it's safe to assume a user visited a malicious site (item #1) which downloaded the PDF (item #2). The user account is an unprivileged non-administrative account.

According to Microsoft, the PDF was meant to exploit a bug in an old version of Adobe Reader which had been fixed long before the PDF was downloaded. We keep our software up-to-date here, so it looks like this exploit failed. The virus scan didn't detect any other problems.

My main concern is that the malicious site tried to use several exploits and Security Essentials didn't detect all of them. Should I nuke from orbit just in case, or trust the antivirus and let it just delete the files?

share|improve this question
    
Personally I won't use MS Security Essentials. I would rather go with Kaspersky or Norton. While it's true that they may be power consuming and slower down your PC, I have found that they really protect you (more) from threats than other AV. Of course, this is a personal opinion. –  HamZa Jun 20 '13 at 22:12

2 Answers 2

up vote 5 down vote accepted

What you have there is evidence of an infection attempt, not a successful infection. It's not uncommon to have these types of files in the temp internet folder if they were not blocked by malware protection.

However, you do need more evidence that the machine is clean before you consider NOT nuking it from orbit. Scans from a LiveCD (or boot-time scan), or evidence that the attempt was blocked would be required.

If you are unsure, or cannot confirm that the infection did not occur, then you should re-image. You DO have a rapid re-imaging strategy, right??

My other concern is that these files were not seen until now, which raises more questions for which the answers are likely to be to reimage anyway.

On a side note about anti-virus: "trust, but confirm". My rule of thumb is that AV blocks 80% of possible threats. I confirm clean machines instead of trusting a 'dirt preventor'.

share|improve this answer
1  
How do you confirm that a machine is clean, especially when you know that antivirus doesn't catch 20% of the infections? –  Phil Jun 19 '13 at 20:28
    
+1 for general policy of requiring evidence to not nuke a given machine from orbit... –  Michael Jun 20 '13 at 18:23

To be safe, I would run a boot-time scan with heuristics set to the max. Microsoft Security Essentials is a nice Anti-Virus but it runs a little light and I always couple it with something heavier at least once a month, such as Avast!. The boot-time scan will go through the hard drive with none of the drivers turned on, which is where some real mean viruses/trojans/worms tend to hide so the "in operating system" Anit-Virus programs won't scan them. This method of scanning has saved many machines in my time in IT. Going forward, I would highly recommend developing a solid and routine backup schedule. Like the old saying goes, save and save often. There are some nice third-party Backup solutions out there, such as Acronis, with which you can create and recover Images in just minutes. I hope this helps and good luck.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.