We're gonna be talking about the symptoms
and sources of malware infection
with the one and only Wes Brian at the bench.
- So, Wes… - Yes, sir.
I’m gonna begin this conversation on a high note, alright?
Malware infections.
Well, man, that's a low note.
How do we know if we have malware infections?
What are some of the symptom sources of that?
Sometimes you don't know,
sometimes it manifests itself in, you know,
just random things happening on your computer.
If you have applications
that all of a sudden you don't remember downloading,
but they're on your computer somewhere
and some for some reason they're running.
Other things too.
Like for instance, when you open up your web browsers,
you get what's known as a browser redirection,
or you have a hijacked homepage.
And what I mean is like, for instance,
I set my homepage to Google
because I'm always using the Google search engine,
you know, just find information.
And all of a sudden, I go in there and I've got this,
no longer have that as my homepage.
I've got this, “Hey, buy our anti-malware software.”
And that's the only thing I can view.
Chances are, you've got some kind of virus or some kind of…
and I'm using the term malware more as the like...
Blanket term. The true blanket term.
Some people might say, “Hey, I've got a virus.”
Virus is just one form of malware.
But there's a lot of different types of malware out there.
You know, things like we hear a lot today
about ransom-ware right?
It's a big thing.
Botnets, Trojan, if you will,
the you know, worms is another one too.
So, just really all-encompassing when I say malware, it's…
That's actually happened to me
where I've gone to my homepage
and all of a sudden it said, “You are infected.”
Yes.
You have to go here right now;
otherwise, your whole system could crash.
And we know of course, it’s mal.
That's yeah, that's what I call scare-ware.
They're just trying to scare you.
In fact, a lot of times they're the ones
that seeded that in the first place, you know,
because really just malware comes down
to any kind of code that gets onto your computer
or any software that causes an undesired outcome,
you know, output, if you will.
So, alright, we can identify that, but what causes that?
I mean, how does that happen exactly?
Well, through lack of user awareness,
I will say is probably one of the big things you know.
In security training,
that's one of the things they talk about right away, is that.
And users just need to be aware that this happens.
Sometimes it could be just clicking on something
that they believe is a legitimate web page,
when it's really been a spoof web page, and you know,
it just starts to download stuff to your computer.
That could be one thing.
Downloading from untrusted location.
I was just gonna say that.
Yeah, and if untrusted locations,
there's two ways to think of that.
If we say untrusted, be untrusted by the operating system.
And that means that a lot of times
when you see things like secure websites,
you have little digital information on your computer.
That when you go to that website,
your computer can verify and validate,
“Hey, I know who that is.”
Let's say it's a you know, very reputable company.
Let's say it's like security software like Kaspersky, right?
Well, Kaspersky’s website
is stamped with this digital information
that Windows can check and can confirm.
Certificate is what they’re called.
Yeah, that's what they're called.
They're called certificates.
Just a little digital identity,
if you can think about it, and it could say,
“Hey, I know who Kaspersky is,
and I trust them rather than you just got hacked.com.”
I'm just making something up out there, you know.
It goes to its back that...
That just happened to me.
That's right. So, untrusted locations.
Sometimes if people…
you know, maybe you have an application
that's not communicating over the network,
and I've seen this before
where people will disable their Firewall.
And what that says is that,
“Hey, it's a wild wild west.
Anything can come in anything can go out.”
And when that happens,
unfortunately, you know, it can lead to malware.
Other things can be not running anti-malware software,
anti-virus software if you want more generically.
The other thing to update,
and I'm guilty of this, I'll raise my hand,
is that I am running anti-malware software,
but I haven't done my Windows updates.
And part of those Windows updates are key security updates
that actually fix these vulnerabilities
and some of the known vulnerabilities and bugs
within the operating system.
And another thing is signature updates, right?
A signature in your anti-malware program defines
what a virus looks like and think about a signature, right?
I've seen your signature before, Zach.
And I could say, “Hey, I know that one.”
Same here, you're not the only one but I can say,
“Yeah, I can recognize that, that’s Zach,” right?
I know some of the attributes of you, you know,
I recognize your signature.
It defines who you are.
Your signature doesn't really but that's how they do it.
You know, signature define what the code looks like,
and unfortunately if the anti-malware software,
virus software doesn't have up-to-date definitions,
then as malware gets released into the wild,
it doesn't know exactly what it's looking at.
So, these are some of the common causes.
So, that being the case, Oh, Dr. West, how do we fix this?
What’s the answer to all this?
Well, I'm not a doctor, I just play one on TV.
That's right, you do.
That’s right.
So, one of the first places in Windows
that I would always say start out
is something called the Windows Security Center.
And really, I could show you right here how to get here.
So, if we just right-click on our Start button here,
if you will, Windows tile, and choose Settings.
You're going to go into the Windows Settings Interface.
And I can see that updates are actually in progress right here.
So, this is giving me a heads up,
but this is really contingent
on the version of Windows 10 you have.
But what we want to see is we want to go down here
to the Windows Update and Security, right?
Alright.
And when we go to Windows Update and Security
one of the first things I would probably do is check for updates.
I'm gonna go ahead and run that real quick.
And it says it's updating progress
and we'll come back and see what it finds for us.
But then I'm gonna go to Windows Security here.
And Windows Security,
there is a good what I call a hood heads up display on here
and it shows you some of the things
that you need to worry about.
Notice it says Virus and threat protection,
Actions recommended.
That would be a tell-tale sign to me that I need something.
There's something I need to do here.
And my guess is given the Windows 10 platform interface,
they probably want me to log in with a Microsoft account
and they probably want me to enable OneDrive.
I'm not too worried about those
but that would be my thought.
Account protection, Actions recommended.
Again, Account protection, one of those things is probably
logging in with a Microsoft account
so that if anything happens on your computer,
and you have to reformat it maybe say because of malware,
you can log back into your Microsoft account
and pull all those settings and all those files back down
to the freshly installed copy of Windows.
Okay.
Remember I said the Firewall itself can be a problem.
People might disable the Firewall.
Notice it tells me no action is needed.
But let's look at the Firewall here real quick
in the Windows Security Center.
This brings up the main security interface,
or excuse me, Windows Security Interface.
It's kind of like a door in front of a door that leads to a door.
Doors are good.
Doors are good. Yeah.
So, what this does is, it looks at your Firewall and it says,
“Hey, is there anything that you need to do?”
Notice it says who and what can access your networks?
And you've got a few different profiles
depending on where you're connected to,
what network you're connected to.
If I'm connected to my home network where I trust it,
Firewall settings are a little bit less restrictive.
However, if you're on a public network,
you always want to make sure.
Maybe you're sitting in a coffee shop, you know,
maybe your favorite place to grab a cup of coffee,
you know, and you’re on a wireless network.
Exactly.
You're running their wireless network,
then you're not going to be wanting
to run these other profiles.
And the domain profile only applies to a system
that is connected to a Windows Active Directory domain
inside of a business-based network.
I'm not connected to that.
And I'm not connected honestly to a private network.
I'm kind of technically connected to the ITProTV network,
but I treat it as a public network.
And what that does is versus the private network is that
make sure that not every machine
on my network can see me.
When you're on a private network,
if you think about it, Zach,
I know you're like me you have kids at the house, right?
You know you got your kid, they’re on your home network, right?
Their computers are there.
You obviously trust their computers
and you don't really care if they see your computer
and you can see their computer, but on a hotspot,
I don't want other people seeing my computer,
potentially connected to my, it's called network discovery.
They can potentially discover my computer
and then maybe launch into an attack after that.
So, if we can see here that the Firewall is on.
Well, the Firewall is on.
Right, one of the things that you can see right away
is if I choose Off,
notice it's going to require the administrator to do this.
But I want to show you what would happen
if you would identify that the Firewall is Off
versus it being On.
I think if we go back to the Home location…
oh no, you know what,
it's letting me know, see here?
It's saying, “Hey, our coffee shop Firewall Profile,
which is active is off right?
So, I get a heads up right away that something…
Turn it on quick.
That's right, we need to turn this back on.
So, that's one thing that you want to do.
You also want to make sure that it is turned on it is…
Notice it says No just there for a second.
I don't know if you noticed that.
Yeah, it said, “Hey, you're in an unsafe configuration.
Do you want to change this?”
So, if you ever open up Windows Security,
and you see that, it's time to enable that Firewall.
Pay attention, pay attention.
Definitely.
And speaking of paying attention, I like that.
That kind of segues into
if you see Firewall Notification Settings here,
if I choose this jump link, there are different providers,
and you can control how many of these notifications you receive.
Yes.
Some people maybe see these notifications
and they get kind of immune to them.
So, they say, “Okay, I don't want to know about anything.
Let me just disable them.”
Well, that's one of your, like main starting points to saying,
“Hey, I know something's going wrong.
I want to be aware of it.”
So, I wouldn't disable that.
Now, so that kind of takes care of our Firewall.
However, there are a couple other things too
that we want to look at, like for instance Virus…
let's go back to the Home button so you can kind of see.
Let me know that there's a couple of things
that I need to do for Virus and threat protection…
There’s another way into there.
And notice it does it’s telling me what I thought.
It wants me to set up OneDrive, it really does.
Microsoft really pushes this but I'm going to dismiss this
because I don't want to log in or set up a OneDrive right now.
And then notice also Account protection,
again is Microsoft Enhanced Security and other benefits
but they want you to sign in with Microsoft.
This is your Microsoft account.
I'm not going to do that right now.
So, I'm going to go ahead and just kind of disable that.
Now, once that's done,
if we go back to Virus and threat protection,
I do want you to see
that there are a couple of things that we can do.
We can run Quick scans,
we can actually change our scan options here
if we want and we can run a Full scan,
a Custom scan, and this is the big one.
I really like this,
and I really want to tell people about this one.
In fact, I don't want to click on it right now.
This is called Microsoft Defender Online
before Windows Defender and became all one thing…
Right.
The Firewall used to be just called Windows Firewall
and Windows Defender was the anti-malware suite.
Well, they bundled all of this together.
Right.
One of the other things that you can get from Microsoft
is you can go to their website
you can download the Windows Defender Offline,
it was called WDO.
And that was just a little bootable,
you could turn it into a bootable USB device, right?
Or you could burn it to a DVD.
We don't really have
a lot of optical drives computers much anymore,
you know, and not that you don't,
but it's becoming a thing of the past.
And what I can do is one of the pieces of malware
that's very, very tricky and very hard to get rid of
is what's known as a rootkit
because a rootkit slips itself in
underneath the operating system,
and it can reach or wreck things like system calls and stuff.
And it can really just obscure the fact that it's there.
So, what this says is,
“You know what, let's run Windows Defender in memory
before the operating system even loads.”
- So, the hard drive is on. - That’s good practice.
Exactly.
So, if we take a look,
you can see it says some malicious software
can be particularly difficult to remove.
That's code for typically rootkits.
And I would run this
if you think that you potentially have malware.
Now, a couple of differences between this Quick scan says
just check for the common you know,
common places where threats are found.
Let me tell you really the difference
between the Common scan and the Custom scan.
The Common scan,
or excuse me Custom scan and Quick scan.
The Custom scan is going to do a Quick scan
and then anything else you include.
Okay.
So essentially not much different.
Not much different.
So, if I have a USB thumb drive
and I think I want to scan that and see if it's got malware,
maybe it's the source of malware,
you know, the USB thumb drive.
You plug it in, and you could say,
“Okay, I want you to do the Custom scan.”
Which means run the Quick scan the commonplaces
but then also check that thumb drive.
Full scan, it's pretty self-evident that says
run it against everything in the operating,
every single location in the operating system.
If you have a lot of time, that's good,
especially if you got terabytes of information,
this could take a very long time to do and that's great.
So, those are really some of the things that we can do
when it comes to, you know, preventing malware.
Another thing you could do here
is you'll notice that there's this Device and security
or Device security, excuse me.
Device security leverages some of the virtualization
that is in Windows,
and it says that there are portions of your device
that we virtualized,
and we don't allow code to actively run in those locations.
We kind of sandbox it, right?
Think about the sandbox, your toys are in the sandbox.
They're not outside of the sandbox, they stay right there.
So, this has nothing to do with VM.
It's really not.
Now, it's not a VM,
but it's based on the technology that run virtual machines.
Absolutely.
So, it's still running that same virtualization,
but it says let's take this portion, this area,
and we're gonna put code in there,
but that code can't affect anything
to the other portions of the system, right?
So, virtualization basically is definitely something
to have enabled and you can hit the Core isolation details.
And you can see that it asked,
Hey, do you want to prevent, notice Memory integrity,
it says prevents attacks from inserting malicious code
into high-security processes.
That's that quarantining where that's that sandboxing,
and you can see it's on by default.
Very good.
So, those are some of the other things
that we want to make sure that we look at you know,
inside of our Windows Security.
Fantastic. Anything else, Wes?
Sure. One of the things I mentioned at the beginning
was download or trusted sources for download.
Right, right, right. You mentioned that.
And this is like a download
even from something that you might trust.
You might trust.
Okay, so when you go to download a piece of software,
it just says that Windows wants to recognize
who the publisher of that software is.
And again, it does it kind of
by those digital security identifiers
that we talked about certificates
and that's how it identifies the application is valid
via the publisher has said,
“This is who we are.
This is our software, and we got a little check
that you can do against that software
to verify it is who we say it is.”
Now, that doesn't mean that it gets it right all the time.
Like for instance, sometimes I go up and I download
an open-source piece of software called Notepad++,
a lot of enhancements over Notepad.
I trust it.
Windows, as it updates regularly,
the Notepad++ doesn't recognize
some of the later versions of it.
It doesn't mean that it's untrusted software.
It's very good software.
It’s just Windows hasn't updated it to identify it as trusted,
but I trust it and I can verify the publisher is
who I say or is who they say they are.
Now there's another way that you can actually do this
inside of your operating system.
So, Windows Security,
you'll notice there's App and browser control.
Notice there's Reputation-based protection.
These settings protect your device from malicious
or potentially unwanted software,
and we could turn this on.
So, if we turn this on, it's going to trigger
the User Account Control and that's okay.
So now it's turned on.
And we also have things like Exploitation protection
that's built into Windows.
But even more than that, by this, by the way,
this is actually enabled by default, Exploit protection.
There's another setting that is not,
isn't I should say, better English there,
there inside of the Windows Security Center.
If we close all of this down,
I'm going to go ahead and open the Edge Web Browser.
And here you can see this is where I told you,
you could see you were definitely hijacked
or something if it wasn't a Google homepage
and I was expecting it to be.
It is a gaggle for instance.
Yeah, notice a little three-dot ellipsis up here
in the upper right-hand corner.
If we choose that and we go down to really the first,
second up from the bottom,
notice there's Settings right here.
If I click Settings, and the arrow button
to expand the navigation view, notice Privacy & security?
Yeah.
Privacy & security,
if you scroll all the way down to the bottom,
this has been in Windows for a very long time.
It was in Internet Explorer as well.
This is the Windows Defender SmartScreen.
It's on by default, but notice it says,
“Help protect me from malicious sites and downloads
using the Windows Defender SmartScreen.”
And that's part of that reputation.
Windows Defender has a database
that it searches for known good software
and if it says it's kind of like you know, you go
and like maybe you and your friend
making reservations at a restaurant.
But I don't make reservations at the restaurant, right?
We both go up there at the same time.
The person, the hostess, or the host at the door says,
“Oh Zach, I see party of one.
Okay, I know who you are.
You’re on the list. Go ahead.”
I go inside. I go up there and it says,
“Wes, Wes Brian. Yeah, I don't see you.
I don't know who you are. Hold on.
Let's throw up a warning here real quick
and say you might not want to trust this person
because we don't see him in the list.”
That's kind of how Windows Defender works.
It checks this database for known good software
and if it doesn't find it in the list
and it says you might want to steer away.
You might want to, for instance, close down the website
or you might not want to download the software
that's trying to download because there could be
a potential for it to be malware in general.
One last thing I want to show you here
and if we look in the lower left-hand
or right-hand corner of the screen,
I can see that there are updates present
with this little icon right here.
Oh, we're gonna to save.
And if I choose that icon right there,
it should bring me up to Windows back to Windows Update.
I can almost be, almost certain,
not really certain, I don't see them right now.
But that there could be
Windows Defender signature definitions inside of this list too.
And at any point, we still want to do our updates.
And you can see that it's already kind of updated the machine,
it just needs to finalize the installation by restarting.
So, those are a couple of ways
that you can also defend against malware,
is making sure that your system is up to date
and has the latest definitions,
has all of the Windows updates
downloaded to your computer
because a lot of times what it does is
it closes off some of those security vulnerabilities
that we wouldn't know existed
unless they put out the updates.
Wes, thanks very much, I feel much safer now.
You’re welcome.