I love incidents caused by false positives in antivirus products. Its frustrating enough that they don't detect legitimate threats, but when they delete legitimate files its just a waste of time and energy.
Today I handled an incident where 10% of an organizations machines detected ESUGRemoteSvc.exe as a Trojan..
2008-09-19 17:13:48;2008-09-19 17:23:42;Real Time Scan;LOGGER_Real_Time;1;Virus found;Trojan Horse;1;"C:/WINDOWS/system32/ESUG/ESUGRemoteSvc.exe";Quarantined;
Fire up the IRT engine. Gather samples, run it in a isolated machine to watch it behavior, submit it to virustotal.com and Normans Sandbox, pull it apart with Immunity Debugger, but the thing looks legit. No machines are scanning the network or making TCP connections to an unusual number of hosts, but it appeared to be spreading. So what is this evil program? ITS SYMANTECS OWN ADMIN TOOL!!! ESUG stands for "Enterprise Support Utilities Group"
A call to Symantec confirmed it was a false positive. Thanks for the friday afternoon excitement.
Welcome to In Depth Defense. In Depth Defense LLC is a privately owned Information Security Consulting company owned and operated by Mark Baggett. In Depth Defense specializes in Penetration Testing and Incident Response. At this time In Depth Defense is not accepting any new client work, but we are happy to speak to you and point you to other resources in the community.
Mark Baggett has been active in Information Security for 18+ years. I've served in a variety of roles from software developer to CISO. You can find archives of older blog entries below and read my newer posts on http://www.pauldotcom.com, http://isc.sans.edu and http://pen-testing.sans.org