Analyzing a Stuxnet Infection with the Sysinternals Tools, Part 3

re: Analyzing a Stuxnet Infection with the Sysinternals Tools, Part 3

jader3rd — Fri, 20 May 2011 16:45:24 GMT

So the ability to modify the task sechduling file. Do you think that that's something someone at Microsoft intentionally enabled for some backwards compatability purposes? I can invision a bug where something with Task Scheulding was broken (or undesirably difficult) because of new admin security models, so someone intentionally shimmed the scenario, by passing the credentials.

re: Analyzing a Stuxnet Infection with the Sysinternals Tools, Part 3

Mark Russinovich — Fri, 13 May 2011 16:06:02 GMT

@Feet Command: virtual

re: Analyzing a Stuxnet Infection with the Sysinternals Tools, Part 3

Mark Russinovich — Fri, 13 May 2011 16:05:49 GMT

@RichardVJ the seminar is being simulcast for web viewing.

re: Analyzing a Stuxnet Infection with the Sysinternals Tools, Part 3

Fleet Command — Fri, 13 May 2011 15:09:53 GMT

Indeed, I agree, Mark. I understand that it should have been difficult preparing this blog post, in fact more difficult than just learning it for yourself. Thank you.

By the way, Mark, did you use an actual computer or a virtual one?

re: Analyzing a Stuxnet Infection with the Sysinternals Tools, Part 3

RichardVJ — Fri, 13 May 2011 10:31:08 GMT

Good work Dr Mark :)

Mark Please host a online session for the planned seminar, We are all interested in your Zero Day Malware Cleaning with the Sysinternals Tools seminar but really difficult to travel from EU to US for it.

re: Analyzing a Stuxnet Infection with the Sysinternals Tools, Part 3

TheJoshuaTSmith — Tue, 10 May 2011 19:18:26 GMT

Mark, thank you SO much for sharing, as usual. This series on Stuxnet, in particular, was a most interesting read, and, as per your usual style, easy to assimilate and follow.

Again, we very much appreciate the Sysinternals tools and your personal interactivity with the tech community.