Fellow Malware Travelers

As argued in What’s different about this approach?, you should plan to look for undetected malware when a detected malware incident occurs. Malware rarely travels alone.

“Virus found in file in Internet cache” is a typical example of a detected malware incident. You may be tempted to ignore these incidents if you have configured your antivirus software to use real-time or on-access file scanning to block malware from executing. To be clearer, in order to present a web page, a web browser must download components and use the components to assemble a web page. When a malware component is downloaded, antivirus software has the opportunity to scan the file once it has downloaded. When malware is detected, the antivrus software can then attempt to quarantine or delete the file. This will probably fail, since the web browser has the file open. The web browser is not allowed to interpret the file, however, since the antivirus software blocks access. With this reasoning, you may be tempted to ignore the “virus found in file in Internet cache” incident.

Instead, use one of the many browser history and browser cache utilities to learn what else arrived from the same network location or at the same time. For example, Pasco will interpret the index.dat files from Internet Explorer. Windows Explorer makes finding these files difficult. A command shell will reveal them.

In Internet Explorer: Tools, Internet Options tab (Browsing history section), Settings button, Current location: will reveal where to look (such as “C:\Users\<userid>\AppData\Local\Microsoft\Windows\Temporary Internet Files\”). “Temporary Internet Files” is a hidden folder. In a command window, change directories to “C:\Users\<userid>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5″. “Content.IE5″ is also a hidden folder.  The index.dat file in this folder is the index.dat file for the Internet Explorer cache for this user. It indexes the files in the four or more hidden folders at its location. That is, files must be copied from the web server to the local drive before it can be presented to the user; the index.dat file is used to locate the local copy of the web server’s file.

The index.dat file for Internet Explorer history is in “C:\Users\<userid>\AppData\Local\Microsoft\Windows\History\History.IE5″.

If you are looking for your Cookies, see “C:\Users\<userid>\AppData\Roaming\Microsoft\Windows\Cookies”. The “C:\Users\<userid>\Cookies” folder is a junction (alias) to here.

As an administrator, where I had access to remote file systems, if an alert for detected malware appeared I would quickly grab the index.dat files:

copy "\\<machine>\C$\Users\<userid>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "<machine>_<userid>_cache_index.dat"
copy "\\<machine>\C$\Users\<userid>\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "<machine>_<userid>_history_index.dat"

The index.dat file for Internet Explorer history has System and Hidden file attributes which make it less easy to copy.

With Pasco I could convert these dat files to more easily interpreted tab-separated text files.

pasco index.dat > index.txt

The tab-separated text files can be opened in Excel and sorted by URL or by access time. Find the reported malware file and see if any other suspicious files arrived from the same source or at about the same time. Submit these suspicious files to VirusTotal and your antivirus vendor. Alternately, learn to reverse engineer the suspicious files before submitting them to VirusTotal and your antivirus vendor.

A batch file to make this file collection and interpretation easier would be:

@echo off
if (%2)==() goto ERR_SYNTAX
copy "\\%1\C$\Users\%2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "%1_%2_cache_index.dat"
attrib -s -h "C:\Users\%2\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat"
copy "\\%1\C$\Users\%2\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "%1_%2_history_index.dat"
attrib +s +h "C:\Users\%2\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat"
copy "C:\Users\%2\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "%1_%2_history_index.dat"
pasco "%1_%2_cache_index.dat" > "%1_%2_cache_index.txt"
pasco "%1_%2_history_index.dat" > "%1_%2_history_index.txt"
GOTO EXIT
:ERR_SYNTAX
Error - requires two parameters, machine name (or IP address) and userid
:EXIT

A sufficiently large environment (at least 500 machines) with sufficiently liberal Internet access permissions, and large population of laptops will find a steady stream of undetected malware with this method.

A similar approach for Google Chrome would look in:

(pre-Vista) Documents and Settings\[user]\Local Settings\Application Data\Google\Chrome\User Data\Default

(Vista) Users\App Data\Local\Google\Chrome\

For the following files:

Archived History
Cookies
History
Thumbnails
Web Data

And parse the files with a tool that interprets SQLite Format 3.