So day by day, I see people posting here that they're infected over and over, and the same crap is being repeated all the time, to solve this issue I'm going to post any and all that you know on securing your PC and anaylzing it.
There are some of the things that I personally do, while I do not say that I am the absolute best, I would say I am fairly adept, I am also hoping that those who know better can write their own methods here as a quick go-to thread, so anyways, here goes:
Anti Virus
The most obvious, an anti virus is the best defense you can have against most malware, as it will have a databse of most if not all of older malware that is not being maintained anymore, while most AV's are relatively the same, some AV's may take longer to update their virus database to get newer bots or may have weaker or inaccurate heuristics to detect newer malware, my personal favourites are malwarebytes, it is very good and is also extremely good at detecting trash such as adware, I think most people can agree with me here, I also like ESET NOD and Kaspersky, I strongly suggest against McAfee and Bitdefender, the former is generally shit and the latter is too system intensive.
Analysis
If you feel that you are infected and your AV scan isn't showing any red, then it's time to do things yourself, you'll need to download some programs in order to make your hunt easier, while you can still use the standard tools that you get in windows almost as well, it is very tedious, for example, to check to see what programs are booting up on startup you'll have to check msconfig, the startup folder, task scheduler, and more...
the tools that I personally like are the Sysinternals Autoruns, Sysinternals Process Explorer, and the Sysinternals Process Monitor.
Autoruns is by far the most useful, it will list every single exe or dll that has to be loaded on startup on several tabs that have the sources as their list, for example, booting from the startup folder, booting from registry, it goes on, anohter useful aspect is that it also has the date it was added, and whether or not the program is signed, and allowing you to effectively disable them.
Process Explorer is task manager on steroids, you will have far more information and control over tasks, you'll get a GPU tab to spot for miners, entry coloring to show if the target process is signed or unsigned, the ability to suspend a process [freeze it] to fight "buddy malware" - malware that has 2 processes and spawns itself again once it spots that the other one is dead,
entry coloring to see if a process has recently closed or started, and far far more.
The process monitor is not as useful, it monitors I/O events to the registry and filesystem, it might be useful in some cirucmstances, such as a keylogger which writes on every keystroke..
Wireshark will also be useful to try and spot strange network activity.
Misc
An interesting method to help fight malware is to use software that will snapshot drives or filesystems, Faronics Deep Freeze, you should freeze the C: drive so you can prevent malware from installing itself into your system to start the next time you boot up, not a total defence against malware, but it can help save you from having malware on your computer undetected for a long time.
Farbar Recovery Scan Tool (FRST)
something that @ven0m keeps constalty posting :)
Make sure that all the boxes are checked and click on Scan
Two logs will be opened after the scan namely --
FRST.txt
Addition.txt
Shortcut.txt
There are some of the things that I personally do, while I do not say that I am the absolute best, I would say I am fairly adept, I am also hoping that those who know better can write their own methods here as a quick go-to thread, so anyways, here goes:
Anti Virus
The most obvious, an anti virus is the best defense you can have against most malware, as it will have a databse of most if not all of older malware that is not being maintained anymore, while most AV's are relatively the same, some AV's may take longer to update their virus database to get newer bots or may have weaker or inaccurate heuristics to detect newer malware, my personal favourites are malwarebytes, it is very good and is also extremely good at detecting trash such as adware, I think most people can agree with me here, I also like ESET NOD and Kaspersky, I strongly suggest against McAfee and Bitdefender, the former is generally shit and the latter is too system intensive.
Analysis
If you feel that you are infected and your AV scan isn't showing any red, then it's time to do things yourself, you'll need to download some programs in order to make your hunt easier, while you can still use the standard tools that you get in windows almost as well, it is very tedious, for example, to check to see what programs are booting up on startup you'll have to check msconfig, the startup folder, task scheduler, and more...
the tools that I personally like are the Sysinternals Autoruns, Sysinternals Process Explorer, and the Sysinternals Process Monitor.
Autoruns is by far the most useful, it will list every single exe or dll that has to be loaded on startup on several tabs that have the sources as their list, for example, booting from the startup folder, booting from registry, it goes on, anohter useful aspect is that it also has the date it was added, and whether or not the program is signed, and allowing you to effectively disable them.
Process Explorer is task manager on steroids, you will have far more information and control over tasks, you'll get a GPU tab to spot for miners, entry coloring to show if the target process is signed or unsigned, the ability to suspend a process [freeze it] to fight "buddy malware" - malware that has 2 processes and spawns itself again once it spots that the other one is dead,
entry coloring to see if a process has recently closed or started, and far far more.
The process monitor is not as useful, it monitors I/O events to the registry and filesystem, it might be useful in some cirucmstances, such as a keylogger which writes on every keystroke..
Wireshark will also be useful to try and spot strange network activity.
Misc
An interesting method to help fight malware is to use software that will snapshot drives or filesystems, Faronics Deep Freeze, you should freeze the C: drive so you can prevent malware from installing itself into your system to start the next time you boot up, not a total defence against malware, but it can help save you from having malware on your computer undetected for a long time.
Farbar Recovery Scan Tool (FRST)
something that @ven0m keeps constalty posting :)
Make sure that all the boxes are checked and click on Scan
Two logs will be opened after the scan namely --
FRST.txt
Addition.txt
Shortcut.txt
![[Image: m8kjAh.gif]](https://#/m8kjAh.gif)
