Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm at work and having some issues here, so I found a lot of suspicious files involving the Flash, so I though that could be a keylogger. How do I find out if it is, and if truly is, what do I do to remove it? I'm worried about my security, since I'm a public agent.

share|improve this question
add comment

3 Answers

If you are worried about particular files, you can upload them to Virustotal so that they are checked by popular AV software. Keep in mind that sophisticated malware could detect that and remove itself from the file before it is uploaded, so that the AV scanner wouldn't find anything suspicious.

Apart from that you can download free (check the license if you can also use them for business use!) ISO images from different Anti Virus software vendors which you can boot from and check your system. The benefit of this approach is, that any malware which might have infected your Operating System will not be able to start (since you don't boot your Operating System) and can't hide itself therefore. You can put several scanner on one CD/DVD or USB stick with tools like XBoot, so you only need to create on CD/DVD than several ones. These tools will add a bootloader to your CD/DVD or USB stick which will let you choose between the different scanner on boot. Here are examples of Anti Virus ISOs from Kaspersky and Avira:

http://www.avira.com/en/download/product/avira-rescue-system

http://support.kaspersky.com/viruses/rescuedisk

You will find a lot more from other companies like F-Secure, AVG and so on via your favorite search engine. I would recommend to download them on a system, which you don't suspect to be infected by malware and handle them.

If you find malware, I would recommend a fresh re-installation of the Operating System to make sure you removed the malware completly. Keep in mind that you also should check any USB mass storage devices, backup devices etc. for malware. Again use multiple scanner.

Be aware that these solutions might not find recent malware. It might be wise to contact a security expert who could do detailed analysis of your system. Analysis of unknown malware is not trivial.

share|improve this answer
    
Thanks! i wonder that is not that kind of problem that i'm wanting to solve. BTW all the information usefull. –  Noviscki Nov 25 '13 at 15:22
add comment

A good trick i use quite often if i'm worried about a file is to open it using this http://www.sandboxie.com/ it allows you to sandbox applications meaning it doesn't get access to you main disk, alternatively using a VM instead of your main OS for handling "suspect" files or even only using a VM for you important stuff can be useful. In terms of your flash problem, trying monitoring your network activity if you start to get very suspicious download wireshark and sniff the packets coming off your machine. if there is any sensitive data going astray kill flash immediately and run a virus scan.

share|improve this answer
    
Thanks! I'll figure this out and try to fix and better my search for those suspicious files, by the way all the information you provided was usefull! –  Noviscki Nov 25 '13 at 15:26
add comment

If you are being targeted, then it's quite likely you wouldn't be able to tell easily. The best bet would be to monitor your network communications to see if anything is being sent to unknown locations, but this is hard to verify and time consuming.

If that is too time consuming, the best bet is probably to either a) back up the files and then delete them and see what happens or, for higher security/paranoia, b) assume it is a compromise and act as if it was, blow your system away, rebuild it and make sure to use up to date AV software and possibly avoid installing flash to avoid similar issues in the future.

Which of those two I recommend would depend highly upon your knowledge level and what made the files look suspicious to you. Flash can have a lot of cached files and such that are not necessarily a problem.

share|improve this answer
    
Thanks! this tip from the up to date the AV are SO IMPORTANT, cuz when they gave us the PC back, they told us to don't update the AV saying excuses like that updates may have a large size of memory. –  Noviscki Nov 25 '13 at 15:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.