Unknown malware, how to report it and whom to report it to?

Question

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 SP1); it must be a very recent one and/or of a rootkit kind, because no antivirus/antimalware/antitrojian/antianything seems to be able to find it, and I've tried quite some of them (and I have quite some experience using them).

It went in two days ago via Internet Explorer 8, which was fully patched, so this is worrying on its own because it clearly exploited some still-unpatched hole (I didn't download or run anything, just opened some web page); it then did some obvious malware-y things like hiding files and icons, flashing system error popups and rebooting the system, and then I found the main executable and removed it... but it left something behind; something that managed to hide so deeply in the system that no tool was able to find it, from popular antivirus programs to highly specific malware detection tools. Of course, I've also checked all the common malware hiding spots (Registry, services, hosts file, browser add-ons, etc.).

How do I know it's there? Google searches (on the Google site, not through the search bar) get sometimes redirected to completely unrelated ad sites, and I have two iexplore.exe processes constantly running in the background (and automatically respawning if I kill them), being launched by nobody else than svchost.exe (as Process Explorer dutily documented) and connecting to obviously fake search sites.

Apart from the obvious question "how do I get rid of it?", what I'm more interested in is how to get some expert to analyze my system in order to find what kind of beast it is, so that it may be stopped before it goes out in the wild... if it already hasn't.

---

Edit: looks like it actually was a rootkit; I finally got rid of it by rewriting the MBR and boot sector of the system drive. Don't know yet what the boot code was actually loading, some executable must still be lingering around... but at least it's inactive now.

Answer 1

If you can find the offending executable or dll, one thing you can do is to upload it at https://www.virustotal.com. Try even the svchost file if you feel it's suspicious.

It will show you how many antivirus engines detect it out of a huge list, and will also forward your sample, if it fails to be detected, to antivirus companies for further processing and signature development.

Answer 2

Many antivirus vendors will more than happily examine a file - as an example, this is Comodo's upload link. Microsoft will also take a look.

I've never actually submitted malware to an antivirus vendor, but I'm pretty certain if it is new malware you won't get analysis done there and then if you see what I mean - you'll probably get an "in database, does this" or "not in database, we'll take a look" type result, since automatically analysing malware is quite hard except for trivial code. I'm not sure even if it was a new piece of malware that you would get feedback, but the result would be an added detection signature and potentially patched exploits if they are unknown, so it is absolutely worth doing to be part of the solution, if you like.

In terms of exploring what it does in greater detail, windbg and process monitor are great companion tools to process explorer and autoruns is an excellent tool for examining startup entry points for changes.

The standard advice with rootkits is a clean install from trusted media since it is pretty hard to know, for certain, you've got rid of it, so if it comes back, that is my advice, along with quarantining the system from others on the network to be sure it doesn't begin exploiting those.

If it is a rootkit and a well written one it may be able to evade certain detection tools. Often, variants of malware are released after the exploit mechanism they used is patched, so you could be in that window and that may explain why a given malware detector doesn't work for the malware it is supposed to detect.

Answer 3

how to get some expert to analyze my system in order to find what kind of beast it is, so that it may be stopped before it goes out in the wild... if it already hasn't.

---

If you have it on your home system then by definition it is in the wild. So, too late for that. Unfortunatly for analyzing, you may have destroyed an important component in the MBR.

In my opinion the best way to analyze the malware on your system would be to disconnect it from the network. Use a cold boot technique to image the RAM. Power it down, remove the hard drive, and then image the hard drive drive. Image any flash on the motherboard, PCI cards, or anything else the provides persistant writable storage. Then analysis begins! Of course you would need to keep the system hardware available in an unused state in case the researcher wants to verify a theory.

Or you could do as @Ninefingers suggests, seems a lot simpler that way.

Answer 4

My advice is to follow these steps:

1. Perform an online scan from ESET website

2. You can create a rescue disk from Kaspersky's website. I have never tried myself but if it should contain a command-line scanner. Sometimes a malware or rootkit remains undetected on Windows but can be easily removed from the shell. Completely turn-off your PC and boot from the bootable rescue disk and perform a complete system scan using command-line scanner.

3. You can try a small tool known as well. It is called Malware Bytes. Even though it is not a full-fledged Anti-Virus, but it does detects few nasty malwares and fake tools that other branded Anti-Virus products are unable to detect.

4. Through VirusTotal, a suspicious file is automatically transferred to many Anti-Virus vendors. But if you suspect a malware behavior and don't have any suspicious file, I recommend to follow the above given steps. Also consult Kaspersky forum.