What tools one can use to detect a malicious activity on a computer, aside from antivirus programs?

Question

Some time ago I got a virus on my computer, which is not detected by antivirus programs. Yet I can see the malicious activity in the Windows Event Log and in the TcpLogView: Considering that updates of antivirus databases always lag behind the creation of new viruses, what program tools are best suited for a timely detection of such zero-day threats?

Answer 1

There is no perfect security and noone can guarantee that a virus will never go through whatever defence you set up. Though there are some measures that can make it less likely:

• A firewall

monitor for suspicious network activity

• Behavior-based detection

Just like firewall can detect suspicious network activity modern antiviruses can monitor suspicious activity within your system. No matter how new the virus is it needs to autorun somehow every time when computer starts. Usually applications add themselves to autorun during installation or when you deliberately ask them to do so. So monitoring autorun is a good way to catch a virus and is unlikely to bother you with false positives. This is just one example, the behaviour-based security could monitor hundreds of potential harmful activities. Among free antiviruses i know COMODO Antivirus provides this type of protection (its called HIPS in it). Many others may do as well (check AVG, Avast, Avira, etc) though I am not sure about them. Though with more aggressive detection comes more false positives. So don's get overenthusiastic with high settings.

• Heuristics

Signature-based detection tries to find specific viruses that have already been caught and analysed. Heuristic analysis is searching for specific commands within application's code that are likely to be harmful. While behaviour-based detection analyses what application does, the heuristic analysis analyses what it could do.

• Sandboxing

When you have a clean PC the only way a virus can infect it is from some new file that you downloaded and lauched. If you care a lot about staying secure you could launch unsafe (downloaded from internet, etc.) applications in a sandbox (isolated environment that from which the virus can not escape and harm your real OS). Even if you run a virus within sandbox it will be killed without a trace when the sandbox is closed. Advanced sandboxes allow you to "freeze" it's state when closing instead of just erasing everything so that you can continue the work when opening a sandbox next time. It is still perfectly safe.

Though some very advanced viruses might escape a sandbox using a mistake in it's code there is no reason to worry about it. For this to happen the virus should be targeting the specific sandbox application you are using (and probably the same version) and it must be vulnerable in the first place. Also creating such a virus would require expert-level knowledge and a ton of work. It's just not worth the trouble. Viruses like this are usually created for specific targets (i mean by intelligence agencies, etc.) and not spread in public. Because getting it caught by antivirus companies would destroy all the hard work put into creating this monster.

An example of free sandbox is "sandboxie". It has a nag screen after trial expired but still allows you to use it forever. Also many modern antivirus solutions have built-in sandbox. Once again COMODO antivirus has it and many others are likely to have it.

P. S.

When you see an unknown process with suspicious network activity in background it is not necessarily a virus. It could be background update service, license check service, etc. Just google the name of the process and you may find out what it is. Also when you are concerned about specific file you could use online virus scanning services that would check it with every antivirus in the world without having to install anything. It would also help the antivirus companies to roll out an update quickly if you actually find a new virus - they do check files uploaded to such services (not all of them though. It requires the owner of the service to cooperate).

P. P. S.

As was said in the beginning you can only increase your security but never reach 100%. And with more security comes more bothersome false positives and more performance drop. At some point antivirus does more harm then the virus it might catch. One of the targets for risk management is to make sure that maintaining your security is not more taxing than having it breached sometimes.