Detecting Targeted Malware and Advanced Persistent Threats

When dealing with malware, typically your last line of defense is your antivirus.  In order for malware to slip past antivirus scanning software, the malware needs to first bypass your perimeter network defenses, such as Network Intrusion Prevention System (NIPS) and network firewall, as well as your Host Intrusion Prevention System (HIPS) and host based firewall.  Multiple layers of protection should block a large number of threats to your organization.

Typically, most of the malware which will bypass all of your security layers is targeted malware...never before seen in the wild.  If the malware is advanced enough, it will be able to slip past your heuristics defenses, and since it has never been seen in the wild, will go unnoticed by your signature based antivirus scans.

If you're fortunate enough to detect some sign of trouble, the first thing you should do is begin checking common malware load points.  Don't bother trying to look for the proverbial "needle in a haystack" and find the file which infected your system.  Be aware that there are only a few load points which will be used by malware, and begin your search there.

Free trial of VIPRE Antivirus Business

Discover first hand, the benefits of this security solution for your company.

VIPRE Antivirus Business is the cost-effective and easy-to-manage business virus protection for small- and medium-sized businesses. It's easy to set up and use via an intuitive management console. It's the business antivirus built with IT administrators in mind. Try VIPRE free for 30 days to see how this security solution can benefit your organization.

This offer is intended for business use only. 

Request your free trial today!

How to Choose the Right Antivirus and Firewall

Anti-virus and Firewall are very important protection for all systems, home or business.

If you don't have a budget to purchase software, there are some excellent free programs available.  Please note that I am only going to be discussing Windows in this post, as Mac or Linux AV is a completely different subject worthy of a future blog post.

The first product you should consider is ZoneAlarm Antivirus+Firewall.  This lightweight combination is perfect to maximize protection while minimizing performance impact.
However, if you do not want a combination Antivirus+Firewall, it's perfectly acceptable to use ZoneAlarm's standalone firewall product with another antivirus product...but I strongly recommend at a minimum using ZoneAlarm's firewall, as I have yet to find a comparable firewall product for free.

If you're looking for an alternative to ZoneAlarm's antivirus, there are many available.
First on the list is AVG (which you can download directly here)
Second is Microsoft Security Essentials, which requires a legitimately licensed copy of Windows
Third is ClamWin, an open source antivirus program which is extremely lightweight but does not feature an on-access scanner.

If you have a budget to afford antivirus at home, or need to protect your business, VIPRE has written a guide on choosing the right antivirus solution for your business.




By the way, if you'd like to support this blog, feel free to make a purchase through our Software Catalog.

Having Fun with the EICAR Test File

For those not familiar with it, the EICAR Test File is a text file commonly used for verifying Antivirus software is properly working.  More info can be found on EICAR.org

I stumbled upon an interesting bugtraq post from 2003 which I felt was worth sharing.  The post disassembles the EICAR test file and looks at how it works.

Interesting read, especially if you're interested in programming.

Do you test your Antivirus updates before deployment?

If your system uses Avira Antivirus, you probably won't be reading this post today.

According to ZDnet, an Avira Antivirus update today crippled millions of computer systems.

This isn't the first time an Antivirus update has crippled Windows systems.  Back in 2010 McAfee pushed out a DAT update which sent computers into endless reboot cycles.

What can you do to help protect your organization against these disasters?  It's simple...test your software updates.  Even antivirus definition updates can cause catastrophic failures across your enterprise...

And just in case something slips through the cracks...have a backup plan.  Are you prepared for a worst case scenario where every active computer system in your organization is unusable?  How do you keep your organization running?  How do you recover from something that widespread in a timely manner, and restore normal business functionality?  Keep these questions in mind, and as we always said in Boy Scouts..."Be Prepared."