Well I'm not like a professional white hat or anything like that, but I'd just like to share some tips on what I do before I open a suspicious file.
1) Look at the user's post count and join date. If they joined within the last month, then you already have a clue it's probably not legit, but don't prejudge mind you.
Example : Spoiler (Click to View)
Already got deleted from it being infected, but serves as a good example. Join date was in December, and only had 14 posts.
2) Now you're unsure if it is clean or not but you download anyway. Next step is to head to Virustotal. Upload it there and see if anything is detected. Most of the time, this is where you will realize it is infected. Even if this scan comes up as 0/43, it still could be crypted.
Spoiler (Click to View)
3) If you don't have sandboxie, go get it. It is a tool that allows you to run programs in a sandbox basically, so if it is infected, it won't infect your computer. Run the suspect file in sandboxie and look for anything suspicious. If anything other than the program shows up, e.g. firefox.exe or explorer.exe, then it is infected. Also, if there are still things open after closing the program, it is infected. Examples below
As I open it:
Spoiler (Click to View)
Even after I close it:
Spoiler (Click to View)
4) Always have a reliable anti virus running on your computer, and do regular scans with MalwareBytes and SuperAntiSpyware. For a reliable anti virus I use Avira AntiVir, but there are many others that are just as good or better, such as Comodo Firewall, which also tells you when something tries to connect to a DNS (so if it could be a RAT). And by regular scans, I mean at least once a month.
If you do believe you are infected, disconnect from the internet, and then run scans with both MalwareBytes and SuperAntiSpyware, and also check your startup to see if it has been injected there. To do this, go to run and type msconfig, then go to the startup tab. If this doesn't cure the infection head to the White Hat Help Section while in safe mode with networking.
If you are not sure if you are infected, use a packet sniffer such as Commview or WireShark and look for any suspicious IPs on your network.
Hopefully this tutorial will reduce the amount of infections here, and reduce the work load on the HJT Team.
1) Look at the user's post count and join date. If they joined within the last month, then you already have a clue it's probably not legit, but don't prejudge mind you.
Example : Spoiler (Click to View)
Already got deleted from it being infected, but serves as a good example. Join date was in December, and only had 14 posts.
2) Now you're unsure if it is clean or not but you download anyway. Next step is to head to Virustotal. Upload it there and see if anything is detected. Most of the time, this is where you will realize it is infected. Even if this scan comes up as 0/43, it still could be crypted.
Spoiler (Click to View)
3) If you don't have sandboxie, go get it. It is a tool that allows you to run programs in a sandbox basically, so if it is infected, it won't infect your computer. Run the suspect file in sandboxie and look for anything suspicious. If anything other than the program shows up, e.g. firefox.exe or explorer.exe, then it is infected. Also, if there are still things open after closing the program, it is infected. Examples below
As I open it:
Spoiler (Click to View)
Even after I close it:
Spoiler (Click to View)
4) Always have a reliable anti virus running on your computer, and do regular scans with MalwareBytes and SuperAntiSpyware. For a reliable anti virus I use Avira AntiVir, but there are many others that are just as good or better, such as Comodo Firewall, which also tells you when something tries to connect to a DNS (so if it could be a RAT). And by regular scans, I mean at least once a month.
If you do believe you are infected, disconnect from the internet, and then run scans with both MalwareBytes and SuperAntiSpyware, and also check your startup to see if it has been injected there. To do this, go to run and type msconfig, then go to the startup tab. If this doesn't cure the infection head to the White Hat Help Section while in safe mode with networking.
If you are not sure if you are infected, use a packet sniffer such as Commview or WireShark and look for any suspicious IPs on your network.
Hopefully this tutorial will reduce the amount of infections here, and reduce the work load on the HJT Team.
