Suppose I wanted to run some manual checks to see if my Windows 7 machine has been infected. I don't usually do anything to get it infected, but I would like to check whether the below steps are enough to provide me with a basic level of assurance that it has not been infected. In this scenario, consider the machine does not have an anti-virus installed.
- Reboot the machine
- Using the
netstat -anocommand to see if there are any foreign connections from my machine. I make sure I have not opened the browser prior to this check.
- Compare the PID from
netstat -ano's output with Windows Task Manager
- Check other processes under Windows Task Manager
- Check the Startup tab from System Configuration (opened by typing
msconfigat the Run prompt)
Check the Registry in:
Check the Windows Logs
Check the Startup folder from All Programs
If none of the above checks shows anything suspicious, I take it as good enough assurance that my system has not been infected with anything. I know that a proper Rootkit will easily bypass all these checks and I would not be able to identify it on the system.
- Is this process useful at all?
- If yes, or potentially yes, what other steps should I take?
- Is there really a need for an anti-virus?
- Should I have done the check-ups in Safe Mode?
- If this is a whole load of rubbish, would someone be kind enough to provide a pointer to a better approach?
NOTE: The nature of the question is more that of an academic/didactic one rather than a practical one.