SOS – I Think my Computer is Infected

In Brief

These days, it is very difficult to tell if a machine is infected. Cybercriminals try using Trojan horses to extract data (spying), or use the computer for larger-scale attacks (distributed denial of service), to send spam or other illicit reasons.

Some infections have no real aim, and many initial infections only load installation software. In this case, access to the infected computers is sold to the highest bidder, who then uses the installer (Trojan loader) to install the final Trojan horse.

The most common vectors for infections are aa follows:

Use best practices to avoid malware.

Risk Analysis

Try to perform a risk analysis to check whether you have fallen victim to a targeted or opportunistic attack. These questions might help you:

If you answered yes to any of these questions, a cybercriminal may well be interested in you and launch a targeted attack. In other cases, you have probably fallen victim to an opportunistic attack. Your machine will be sold on to the highest bidder.

Another way to determine whether this is a targeted or opportunistic attack is to look at the methods used by the criminal to infect your device. An impersonal e-mail indicates an opportunistic attack, while an e-mail that refers to you by name looks more like a targeted attack.

Victim of an Opportunistic Attack

Some cybercriminals try to infect as many machines as possible through opportunistic attacks. These criminals specialise in the ‘acquisition’ of machines and only install software enabling remote access. They often try to distribute their victims by country, categorising individuals and companies, and they sometimes even try to identify the infected victim (the profiling quality of the infected machines increases their sale price). They go on to sell access to these machines to the highest bidder. This person will then install special malware using the remote access software, based on their objectives:

Opportunistic attacks are usually quite large-scale attempts, with malicious code used to provide remote access – in the best-case scenario, this code will only be detected days later by the supplier’s anti-virus software. Generally speaking, the resident anti-virus never detects malware after detection and you need to use a live CD anti-virus for better detection.

Victim of a Targeted Attack

As opposed to large-scale, opportunistic attacks, targeted attacks usually focus on a specific victim, often a single person within a targeted organisation. Malicious code is specially designed for this type of attack, and in most cases, it slips through anti-virus checks. Targeted attacks can be used as a vector for infection:

It is very difficult to recognise an attack of this type. These codes make no ‘noise’, because they do not spread, or they only spread very slowly. They do everything to remain unnoticed to extract confidential information as long as possible.

Malware activity may eventually be identified in firewall or proxy logs.

Cleaning an Infected Machine

It is often difficult to tell whether a machine is infected, and it is even more difficult to clean it. The effort made and the method chosen need to be sufficient to match the criticality of the machine concerned.