0

Some time ago I got a virus on my computer, which is not detected by antivirus programs. Yet I can see the malicious activity in the Windows Event Log and in the TcpLogView: url=https://postimg.org/image/4yv0nyvof/ Considering that updates of antivirus databases always lag behind the creation of new viruses, what program tools are best suited for a timely detection of such zero-day threats?

  • 1
    what makes you sure it's a virus? – dandavis Aug 2 '17 at 3:13
  • @dandavis, I know this because firstly I am not in Singapore. Not even close. There is no good reason why SYSTEM from my computer would try to connect to a remote computer located in Singapore 60 times per minute, each time trying a different port. Secondly, later on I found from the Windows Event Log that exactly at that time, that exact IP made an anonymous logon into my computer. And there is absolutely no non-malicious way how that could possibly happen. – and his dog Aug 2 '17 at 5:12
  • Put all that information in your question; comments disappear. – Jan Doggen Aug 2 '17 at 6:36
  • I would like to keep my question not about solving my particular problem with this particular virus, but about how one would approach such problems in general. How do people know that their computers are not infected, since apparently antivirus software can not detect every and each virus, especially the new ones. – and his dog Aug 2 '17 at 6:48
1

There is no perfect security and noone can guarantee that a virus will never go through whatever defence you set up. Though there are some measures that can make it less likely:

  • A firewall

monitor for suspicious network activity

  • Behavior-based detection

Just like firewall can detect suspicious network activity modern antiviruses can monitor suspicious activity within your system. No matter how new the virus is it needs to autorun somehow every time when computer starts. Usually applications add themselves to autorun during installation or when you deliberately ask them to do so. So monitoring autorun is a good way to catch a virus and is unlikely to bother you with false positives. This is just one example, the behaviour-based security could monitor hundreds of potential harmful activities. Among free antiviruses i know COMODO Antivirus provides this type of protection (its called HIPS in it). Many others may do as well (check AVG, Avast, Avira, etc) though I am not sure about them. Though with more aggressive detection comes more false positives. So don's get overenthusiastic with high settings.

  • Heuristics

Signature-based detection tries to find specific viruses that have already been caught and analysed. Heuristic analysis is searching for specific commands within application's code that are likely to be harmful. While behaviour-based detection analyses what application does, the heuristic analysis analyses what it could do.

  • Sandboxing

When you have a clean PC the only way a virus can infect it is from some new file that you downloaded and lauched. If you care a lot about staying secure you could launch unsafe (downloaded from internet, etc.) applications in a sandbox (isolated environment that from which the virus can not escape and harm your real OS). Even if you run a virus within sandbox it will be killed without a trace when the sandbox is closed. Advanced sandboxes allow you to "freeze" it's state when closing instead of just erasing everything so that you can continue the work when opening a sandbox next time. It is still perfectly safe.

Though some very advanced viruses might escape a sandbox using a mistake in it's code there is no reason to worry about it. For this to happen the virus should be targeting the specific sandbox application you are using (and probably the same version) and it must be vulnerable in the first place. Also creating such a virus would require expert-level knowledge and a ton of work. It's just not worth the trouble. Viruses like this are usually created for specific targets (i mean by intelligence agencies, etc.) and not spread in public. Because getting it caught by antivirus companies would destroy all the hard work put into creating this monster.

An example of free sandbox is "sandboxie". It has a nag screen after trial expired but still allows you to use it forever. Also many modern antivirus solutions have built-in sandbox. Once again COMODO antivirus has it and many others are likely to have it.

P. S.

When you see an unknown process with suspicious network activity in background it is not necessarily a virus. It could be background update service, license check service, etc. Just google the name of the process and you may find out what it is. Also when you are concerned about specific file you could use online virus scanning services that would check it with every antivirus in the world without having to install anything. It would also help the antivirus companies to roll out an update quickly if you actually find a new virus - they do check files uploaded to such services (not all of them though. It requires the owner of the service to cooperate).

P. P. S.

As was said in the beginning you can only increase your security but never reach 100%. And with more security comes more bothersome false positives and more performance drop. At some point antivirus does more harm then the virus it might catch. One of the targets for risk management is to make sure that maintaining your security is not more taxing than having it breached sometimes.

  • Thank you for the answer. You suggested a very good idea. I changed my COMODO HIPS setting to "Paranoid". If a virus steals my banking info, the damage would be much bigger than any possible performance drop. A virus can also get into computer even if you do not download and run files from the Internet. Some OS vulnerability (like the one EternalBlue exploits) can allow a malicious actor to run arbitrary code on one's computer. – and his dog Aug 2 '17 at 5:42
  • In a case above a virus hijacked the SYSTEM process. Firewall lets it out, since SYSTEM is a trusted process. You can not upload SYSTEM to VirusTotal, you can not scan it for viruses, you can not run it in a sandbox. The question is: how do you detect a malicious activity of such a virus? – and his dog Aug 2 '17 at 5:42
  • When the virus is really deep it is very hard to catch as it becomes a part of the system (a rootkit). What makes things worse is that a rootkit has absolute privileges in the system and a kind of role reverse happens. First the virus had to find a way inside your system but now it has total domination over it and it's you who must find a way around. It can prevent any of your actions, hide things from you and literally do anything. – MadCake Aug 2 '17 at 7:34
  • Many antiviruses can scan for rootkits and hopefully remove them. Though the toughest ones are simply impossible to remove from within the system as the system is now playing by viruses rules. To return the control you must boot from another system that is not infected and scan the infected drive. This will make sure that the virus is not activated and does not make countermeasures. – MadCake Aug 2 '17 at 7:34
  • About exploits: it is indeed possible to create a web page that would infect vulnerable browsers without downloading anything or send an email that would exploit a vulnerable mail agent. Though most exploits are created after the vulnerability is publicly known. At that point it should already be patched in the most recent version of software. Finding a new vulnerability by yourself (which is called then zero-day vulnerability) is something only selected few can do.So for the most part malware would exploit old and already patched security holes. – MadCake Aug 2 '17 at 7:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.