DLLHOST.exe Preventive Methodology

[CyberGeek]

Greetings,

Does anyone have a preventive methodology for dllhost.exe from getting infected? I personally never had this issues, but frequently several people have been getting hit with dllhost.exe infection causing high RAM usage.

The purpose of this post for suggestion is to "prevent" dllhost.exe from getting infected.

I can relate to th efact that we need AV/MWB/SpyBot Destroyer, etc... to prevent such infectious app from attacking the dllhost.exe file.

Thanks

 

[Jack]

Greetings,

Does anyone have a preventive methodology for dllhost.exe from getting infected? I personally never had this issues, but frequently several people have been getting hit with dllhost.exe infection causing high RAM usage.

The purpose of this post for suggestion is to "prevent" dllhost.exe from getting infected.

I can relate to th efact that we need AV/MWB/SpyBot Destroyer, etc... to prevent such infectious app from attacking the dllhost.exe file.

Thanks

The high usage from the dllhost.exe is due to a new malware "Trojan.Poweliks". While it's behavior is not exactly common (does not rely on the presence of a Windows binary file (an executable file on disk) to maintain its infection of a computer), the delivery is done through very traditional methods: Spam emails, social engineer, exploits and other attack vectors which can be avoided if you practice a safe online behavior.

What is Poweliks?

Poweliks is the name of a malicious program. This particular program is a Windows Trojan but what makes it noteworthy is that it does not rely on the presence of a Windows binary file (an executable file on disk) to maintain its infection of a computer.

A common method of infection of a Windows computer is for a 'dropper' program to be run on a computer that then downloads a 'payload' file which actually does the malicious work. The initial dropper file is usually programmed to delete itself to evade detection hence a sample of the dropper file does not remain for analysis by SophosLabs. The payload file would then remain active on the computer and is programmed to carry out certain tasks (e.g., pop-up adverts, warnings that you are infected and need to buy protection (scareware), encrypt personal files and demand a ransom for unlocking them (ransomware), contacting a command and control server to away 'orders' for exactly what to do, etc.) In this more common scenario, because the payload file has to remain active SophosLabs can easily acquire a sample of the file and see if prevention from infection is already covered (e.g., in Sophos' existing library of file detection, or through our intelligent heuristic detection methods). If required an update can be published and Sophos users who enable Sophos Live Protection are immediately protected - those who disable Live Protection with receive the update (along with Live Protection users) to their network/endpoint computers depending on the configurable update schedule set locally.

In the case of malware like Poweliks the dropper file does not download a payload file that needs to remain active on the computer. Before the dropper file deletes itself it is programmed to write all necessary code to the Windows registry of the local computer. Hence there is no secondary payload file to take a sample of as all computer instructions for the malware to persist on the computer are contained in the registry.

Read more about Trojan.Poweliks :
FILELESS TROJAN POWELIKS VIRUS ON THE RISE - http://www.cbronline.com/news/security/fileless-trojan-poweliks-virus-on-the-rise-4425463
Information on malware known as Poweliks - http://www.sophos.com/en-us/support/knowledgebase/121370.aspx
Trojan.Poweliks: A threat inside the system registry - http://www.symantec.com/connect/blogs/trojanpoweliks-threat-inside-system-registry

The single biggest factor in preventing a malware infection on your PC is YOU.
You don’t need expert knowledge or special training.You just need vigilance to avoid downloading and installing anything you do not understand or trust, no matter how tempting might be!

Below you can read , some tips on how to easily avoid a computer infection.Follow them and we can guarantee, that you’ll never have to deal with an infected PC.

Spoiler: How to keep your computer clean

1. Avoid running programs that where downloaded from a untrustworthy source or don’t have a digital signature.
Before clicking the ‘Run‘ button make sure you know what the program is and always keep in mind from where you got it.



Everyone has seen this type of alert however most of the user for a reason or another, decide to ignore it and allow the file to run without any kind of restriction.

Files that don’t have a digital signature or were downloaded from a unknown source should always be treated as dangerous.

I strongly recommend that you check each file before allowing it to run :

1. Scan it with your antivirus.
2. Scan it with an on-demad scanner (programs that you can install on your computer and use them only for scans) like HitmanPro and Malwarebytes Anti-Malware.
3. Submit the file to virustotal.com, a site which will scan your program with the 43 known antivirus engines.

Even so it’s strongly recommended that you run the file in a virtual environment like Sandboxie.

2.Avoid keygens,cracks and other warez
Keygen , cracks and patches are the most common ways of getting your PC infected.
I strongly advise you to avoid them, as there is little quality control in the world of illegal software, and it is easy for an attacker to name a piece of malware after a popular movie, album, or program to tempt you into downloading it.



3. Download files only from trusted sources.
You can drastically reduce the risk of an infection by knowing what and from where you are downloading a file.
We recommend that you install a site advisor like Web of Trust or Norton Safe Web, which will help you decide if the site is trustworthy or not.

As a general rule it’s recommended that you download files from known and reputable sites that have confirmed that the download is malware free.
If you are unsure about the quality of a download, leave the site and research the software you are being asked to install. If it is OK, you can always come back to site and install it. If it is not OK, you will avoid a malware headache.

4. Use common sense while online
Finding something on the internet does not guarantee that it is true. Anyone can publish information online, so before accepting a statement as fact or taking action, verify that the source is reliable.
If it’s sounds to good to be truth then most likely is!
You’ll not win the lottery and you’ll not get an amazing prize on the Internet so don’t fall for this type of scams.
Ignore emails or websites who promise you a great prize as there is always a catch behind this type of promises.
Completing a survey will not grant you a iPhone or 1000$ instead it will give the cyber criminals your personal details.

5. Keep your computer up-to-date and secure
Always update your OS or software when an update is available as this can greatly reduce the chances of an exploit.
Also keep in mind that a simple antivirus engine doesn’t do the job anymore, you need to have a layered system protection as malware threats are constantly changing and improving thus making the antivirus engine obsolete.
An antivirus engine, firewall , host intrusion prevention system, a site advisor and sandbox are security layers which every computer needs to be safe in today’s world.
You can build up your malware defenses with our help by starting a thread in our Security Configuration Wizard forum.
Another common mistake made by Windows users is to disable the User Account Control.
The way Microsoft found to keep security, comfort and function in balance by integrating User Account Control (UAC) that seamlessly, is one of the benefits Windows 7 offers.When using a Limited/Standard User Account , your user profile might still getting compromised, but not Windows 7 basic operating system in the background. Even your profile got hit, all your pictures, MP3 files or documents can be restored easily by logging in to another account that is not yet compromised.

I strongly advise you to let this Windows feature enabled and pay a very close attention to this pop-ups , as this could save your PC from an infection.

Other Quick Security Tips :

1. • Uninstall Java if you don’t really need it as this is one of the most exploited programs.
   • Use complex passwords for you online accounts – Passwords should be a minimum of eight characters and contain a combination of letters (uppercase/lowercase), numbers, and special symbols (!,@, #, &, %,*)
   • Do not open email attachments from unknown sources or files sent through an instant messenger
   • Don’t give out your details to people who don’t have a legitimate need to know them.
   • While on social networks it’s best to be reserved when allowing people to see your profile or updates.

 

[CyberGeek]

Thanks, Jack for your input,

I agreed! It's all due to the "end-user" that are causing these spread of malware infections. My case was more to do with "policies" that can/could be used in preventing the spread of malware. We can't all be 100% secure because end users are made of of more than 70%, because that number are for "not so tech savvy" arenas.

These are clients that are on a domain, and was looking for maybe some kind of policies to use to prevent this unwanted propaganda's.

I have devised a simple but effective plan for a "Do-Over" list when setting up PCs.

My biggest fear for clients or anyone that is no tech savvy is, Java. They're very exploitable and get infected easily. For me, I never installed Java, never got malware. However, Java are needed for many clients that requires it to access a website.

Thanks for the "Best Practice" Jack.

Regards