News: 1627630245

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Malware and Trojans, but there's only one horse the boss man wants to hear about

(2021/07/30)


On Call A call from the executive floor is rarely a harbinger of happiness, especially when one is wading knee-deep through the molasses of malware. Welcome to one Register reader's experience in [1]On Call .

Our story takes place a few years ago and concerns "Ruud" (not his name) who had joined a very well-known company as head of IT. As befitted a person of his job title, Ruud had started putting the company's house in order and begun rolling out some standard security tools "to get us to a decent baseline."

It did not go well, or went too well depending on one's standpoint, and the new tools spotted some malware running on dozens of PCs. It was an all-hands-on-deck moment to stop the nasties spreading any further through the company. Leading from the front, Ruud dived in to do his bit.

[2]

"I was downstairs freezing my tits off in a cold store working on an affected PC when I got a tap on the shoulder from my boss," he told us. The managing director had called down and wanted a word. Now.

[3]

[4]

As to what that word was, there was no clue. But Ruud feared it would not be "attaboy" followed by a slap on the back and a bonus cheque. There was, after all, malware spattered over the company like paint on a decorator's radio and, regardless of blame, he was the current head of IT. The buck had come screeching to a halt with him.

[5]Exsparko-destructus! What happens when wand waving meets extremely poor wiring

[6]Try placing a pot plant directly above your CRT monitor – it really ties the desk together

[7]Where's the boss? Ah right, thorough deep-dive audit. On the boardroom table. Gotcha

[8]Go to L: A man of the cloth faces keyboard conundrum

"I asked my boss why he didn't tell the MD I was knee-deep in malware," said Ruud, "but he was too spineless to deflect the MD's request."

And so Ruud began the climb of shame to the ivory tower where the executives lived. Filled with justifiable existential dread at what awaited him through the hallowed portal, he introduced himself to the MD's secretary and was shown in.

The MD did indeed have a problem. Something so serious that only the IT manager could address it.

[9]

Could Ruud print off some pictures of the MD's horses? The secretary, you see, couldn't do it. Would that be OK?

Ruud tried to explain what he'd been doing before the interruption, but the MD just looked at him blankly.

"He never really did understand IT," sighed Ruud, "and just wanted his pictures printed."

[10]

"It was an interesting place to work."

Ever been in an epic IT firefight but still had to field the most trivial of requests? Or found yourself with a boss that really didn't see the point of all this computery stuff? Share the time when that pointless call came in with an email to [11]On Call . ®

Get our [12]Tech Resources



[1] https://www.theregister.com/Tag/on-call

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YQPNtDiGhmPLFCf@37RujAAAAJQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQPNtDiGhmPLFCf@37RujAAAAJQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQPNtDiGhmPLFCf@37RujAAAAJQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://www.theregister.com/2021/07/23/on_call/

[6] https://www.theregister.com/2021/07/16/on_call/

[7] https://www.theregister.com/2021/07/09/on_call/

[8] https://www.theregister.com/2021/07/02/on_call/

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQPNtDiGhmPLFCf@37RujAAAAJQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQPNtDiGhmPLFCf@37RujAAAAJQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[11] mailto:oncall@theregister.com

[12] https://whitepapers.theregister.com/



Not as bad as I expected

TWB

I thought Ruud was going to find and remove some horse betting malware which the boss man 'could not do his "job" without'

Re: Not as bad as I expected

chivo243

I was really afraid where this one was going... Trojans and horses?! Eeew!

In a previous career

chivo243

I worked as a sous-chef for a chain of upscale restaurants, my chef went on vacation (I know!! can you believe it?) on a day with many large parties booked, June wedding receptions etc. The Executive Chef shows up out of the blue and begins poking his beak around, and decides that "I" should drop what I'm doing and re-arrange and re-label the produce shelves in the cooler! Needless to say, the GM did a bit of comping that day, as I was in the cooler, and not running the kitchen. I gave notice as soon as my chef returned.

Re: In a previous career

Frogmaster

Yup, when the brown stuff starts hitting the revolving blades there can be some strange behaviour. I was working at a major UK Building Society in the early part of the century when word got out that some major systems were down, and unofficially some colleagues asked if I could help. Rolling up sleeves and walking across the floor I met the system admin who was responsible for said outage acting very busy - tidying up the software cupboard, arranging all disks/CDs/etc. in alphabetical order! So we had to completely bypass them, let them get on with what made them happy, and fix the issues. Weird how pressure can affect people in strange ways - in this case CYA mode "Let's look busy and I won't get asked to do anything useful...."

Re: In a previous career

2+2=5

> I met the system admin who was responsible for said outage acting very busy - tidying up the software cupboard, arranging all disks/CDs/etc. in alphabetical order

I've not encountered that particular sub-species of admin but I have met a close cousin: the developer who creates a problem through his own lack of diligence and then promotes himself as the "hero" who saves the day by working overtime to fix his own problem.

Anonymous Coward

I recall, many years ago (around 20ish) when I temporarily stood in as IT mug for a small company I was working for (in an otherwise non-IT role), that the office server got infected with a virus. The previous IT incumbent had installed AV software but decided not to install any updates as it took too much time and effort. Anyway, the system needed sorting fast, so I added my own laptop to the network and used the (up to date) AV program on that to scan the server. It found the source of the virus and disinfected - remember, this was back in the days when things were much simpler. The source had been an email received by the General Manager; it was deleted and he was told why. All sorted and back to real work.

The next day, the system was reinfected, so laptop hooked back in and system scanned and cleaned - again. The source? The GM had decided he needed the infected email and, realising he also had a copy on his PC at home, had forwarded it to his company email a/c after dinner. A trip to the GM's home to clean his PC followed! He was a good guy to work for, but not the most computer-savvy...

SMOKING IS NOW ALLOWED !!!
Anyone wishing to smoke, however, must file, in triplicate, the
U.S. government Environmental Impact Narrative Statement (EINS),
describing in detail the type of combustion proposed, impact on
the environment, and anticipated opposition. Statements must be
filed 30 days in advance.