[Fộrcəd]

As you hopefully know, most freshly spread malware are FUD. This makes it hard for Anti-Virus to detect infection. So i'm going to show you how to easily check for COMMON computer infections using freeware and your own brain :)

First of all your gonna need to download Process Explorer
This is one of many great internal tools from Microsoft, its basically a task-manager on steroids, with features such as direct hash checkup towards the VirusTotal database and signature checkup (Best feature)

You wanna run this and admin, it should look something like this.

This if a screenshot of its running a fresh VM infected by NanoCore.

Now you wanna go to Options>> And Check "Verify image signatures" also go to "VirusTotal.com" and check "Check VirusTotal"


This will cross check the hash of every running process with the Virus-total database, it will also check if the signature of the file is valid.
^And this is the important part, you can spoof and play with any file all you want, but only an authorized software publisher can assign file's a valid signature. This is basically the easiest way to check any file written to your disk may be possible malware or not.

But keep in mind, this applies only for the written exe/malware on disk, if a malware injects itself into another process, it will not change its valid signature. So this is to locate the physical written malware on disk.


As you can see this NanoCore stub has no valid signature and no HF crypter will be able to give it a valid one either. From here we can easily suspend the process , kill the process, locate the file and remove it.

The same applies for persistence, by suspending the process instead of killing it, your break most persistence by Trojans etc.

Microsoft also has another internal tool called "Autoruns", basically shows every startup reg key, so after you kill/suspend the process, you can remove their startup feature
Download: https://technet.microsoft.com/en-us/sysi...s/bb963902

Very good presentation for a more in-depth look, recommend for anyone dealing on HF.
https://www.youtube.com/watch?v=Wuy_Pm3KaV8


My English grammer < shit, PM me.

[Anxious.exe]

Seems pretty cool, will give it a try soon.

[yotoprules]

Thanks a lot for this tutorial! I might give this a try if I or someone else ever gets infected

[jimmyfer]

Great tutorial, this is very usefull. Simple and excelent!

[Anxious.exe]

Vouch for OP ! Amazing share, amazing tool.

[Fộrcəd]

Seems pretty cool, will give it a try soon.

Thanks a lot for this tutorial! I might give this a try if I or someone else ever gets infected

Great tutorial, this is very usefull. Simple and excelent!

Vouch for OP ! Amazing share, amazing tool.

Glad you enjoyed

[Fộrcəd]

I feel this can help allot of users out there, bumping.

[warpje]

Learned something new nice tutorial! Will check the different RAT and crypter to see how it works with that!

[Fộrcəd]

Learned something new nice tutorial! Will check the different RAT and crypter to see how it works with that!

Please do

It's really interesting to be able to analyze their movement a bit more detailed.

[Don Genovese]

Very interesting and useful, appreciate the effort gone into it.

[Sc0rpian]

Great tutorial mate.. ! This would be very helpful for victims whose system got compromised. Also I would prefer to use 'winpatrol' tool which keeps monitor and notify user about all hidden startup programs.

Reference:
winpatrol.com/winpatrol/

[LanMan]

Nice tutorial, it will help people, and Process Hacker is a nice little tool too.
But these tool will detect only basic malware.

[[▲■●]]

Thanks for sharing, very useful information.
Ran some checks immediately after reading.

[iiXenonunim]

Thanks a lot for this tutorial! I highly appreciate it.

[Tieko]

Thanks a lot for that, it's really useful.
Wherever you are, have a nice day.