I guess its a difference in terminology. For my org any hack, malware, spyware etc that occurs on the system is labeled an intrusion.
Wow…you and I are geographically close, but worlds apart with regards to terminology.
I was reading an article about lastwritetimes for Reg keys, specifically HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USBStor to at least rule out any USB device infection. In this key I have located many USB devices as expected but I don't see any lastwritetimes.
Do you know where they are located? Perhaps the article you mentioned can describe what you need to look for.
I am currently reviewing this on my system (vista) so I don't contaminate the target machine. I want to know what I am looking for first. Should I be expecting to see a lastwritetime for every entry in the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USBStor for the listed USB devices? Or is there another place to look for mac times for Reg keys.
First, Registry keys do not have MAC times…only a LastWrite time, which is analogous to a last modification or last written time on files.
Second, most tools don't show key LastWrite times…RegEdit doesn't.
Finally, LastWrite times on keys/subkeys beneath the enum\USBStor key won't show you when the device had last been connected to the system.
All of this is covered in a book titled, Windows Forensic Analysis. I hear that it's a great read and an easy reference.
I'm curious…what led you to this conclusion?
It was from studying that "great read" of yours Keydet roll
Seriously though, it's far from being a "conclusion" given the limited info provided. Nonetheless, there are many Autoclick Bots that will try to install & earn ad clicking revenue for the herder.
Luc - I'd be surprised if the infection came from a USB… was the system fully patched? AV? Firewall? You will probably have been right earlier… often this type of infection comes from visiting a malicious website. If you have identified some of the malware, how about mapping the creation times to the browsing history times… use Netanalysis would be my advice.
Why is this so important to find out? This kind of thing happens all the time… Even if you find the malicious site, what will you be able to do about it?