Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose I wanted to run some manual checks to see if my Windows 7 machine has been infected. I don't usually do anything to get it infected, but I would like to check whether the below steps are enough to provide me with a basic level of assurance that it has not been infected. In this scenario, consider the machine does not have an anti-virus installed.

  1. Reboot the machine
  2. Using the netstat -ano command to see if there are any foreign connections from my machine. I make sure I have not opened the browser prior to this check.
  3. Compare the PID from netstat -ano's output with Windows Task Manager
  4. Check other processes under Windows Task Manager
  5. Check the Startup tab from System Configuration (opened by typing msconfig at the Run prompt)
  6. Check the Registry in:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

  7. Check the Windows Logs

  8. Check the Startup folder from All Programs

If none of the above checks shows anything suspicious, I take it as good enough assurance that my system has not been infected with anything. I know that a proper Rootkit will easily bypass all these checks and I would not be able to identify it on the system.

Questions

  1. Is this process useful at all?
  2. If yes, or potentially yes, what other steps should I take?
  3. Is there really a need for an anti-virus?
  4. Should I have done the check-ups in Safe Mode?
  5. If this is a whole load of rubbish, would someone be kind enough to provide a pointer to a better approach?

NOTE: The nature of the question is more that of an academic/didactic one rather than a practical one.

share|improve this question
1  
here you have some additional steps that can be performed using only windows native tools –  mzet Oct 17 '13 at 12:41
add comment

2 Answers

up vote 1 down vote accepted

Since the nature of your question is more didactic than practical, the answer is simple: No, that process isn't useful.

The malware designer/coder is smarter than you, he knows your operating system more than you, he spent hundreds of hours in his mother's basement (or his respective agency's labs) exploring the nooks and crannies. His whole job is to make it extremely difficult for you to conventionally find his program or even be aware of its existence.

Assume that every malware installs a rootkit, patches your operating system, modifies your bootloader, flashes your BIOS, override your settings, and change the default behaviour of everything on which you're making your judgement.

Having that said, practically speaking and in the context of pre-2008 simple malware (I haven't looked into malware code/analysis for years), yes your method is an acceptable forensic approach for a beginner to intermediate level.

Finally, utilizing an antivirus software is a good idea and a very good line of defence. Just think about of the millions upon millions of signatures, patterns, and behaviours that software is able to search through to verify your files even before they could affect you.

share|improve this answer
    
+1; thank you. You were spot on the "pre-2008" part. I learned this "method" during the early years of XP. Still on this subject, you've mentioned that pre-2008, this method was "an acceptable forensic approach for a beginner to intermediate level". Still within the pre-2008 context, what were the advanced level's approach? Fancy EnCase forensics? Or was the advanced approach the basic wiping-and-rebuilding? –  Lex Oct 17 '13 at 7:44
add comment

Is this process useful at all?

For simple malware yes.

Is there really a need for an anti-virus?

yes because AV programs designed for this work and the AV's has especially methods to protect of your system.

Should I have done the check-ups in Safe Mode?

NO ! you must do this works with a live operating system (Boot disks such as Hiren's BOOT) because the complexes malware can modify the OS behavior to be undetectable.

If this is a whole load of rubbish, would someone be kind enough to provide a pointer to a better approach?

if you have enough information about malwares and there method, your way can be useful too.

share|improve this answer
    
Thanks for your answer: it seems to tie in with Adnan's too. +1 for the Safe Mode explanation. Could you please expand on this one? 'To be undetectable' while in Safe Mode? –  Lex Oct 17 '13 at 7:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.