How can I know if my PC is getting infected?

Question

I have installed an antivirus, but as no antivirus is perfect, what can I do to diagnose if my PC is getting infected?

For example, keeping a close eye on what programs and tasks run when I turn my PC on. And after installing new programs, see if there are changes, etc... If there is a change that I cant justify, I will kill that thing while I can, right?

Also I can get feedback from google to see if a process is malicious or healthy, but sometimes virus are names like healthy proceses... mmmmm

Answer 1

The short, pithy answer is that you don't. There is some extremely stealthy malware out there. Look at stuxnet, flame, and some of the banking trojans as examples. If a sophisticated enemy is out to get you chances are you won't know you've been hacked.

That being said it's extremely unlikely that you are ever going to be targeted by anything that sophisticated. Chances are you are like the majority of people trying to defend themselves against an average level of threat, in which case you do what we all do:

• patch your system. Most of your typical hacks target well-known vulnerabilities that have been patches for weeks, or even years. They target OS vulnerabilities but also adobe flash, java, adobe reader, etc. Make sure that you patch all your software as soon as patches come out
• Install a good AV and run scans frequently (looks like you've got this covered)
• narrow your system's attack surface. The more software you have installed the wider your attack surface is, so uninstall all software you don't use, especially the crappy bloatware that most out of the box systems have installed
• harden your system. Ensure that you have no guest accounts, and that all accounts have strong passwords. Turn off any service or process that isn't needed

As for knowing if you've been hacked it's usually pretty obvious unless you have been infected by stealth malware: you'll get pop-up ads, redirects to sites you didn't intend to visit, threatening messages telling you to pay money or have your life destroyed, your fiends will tell you that they are receiving spam from your email address, somebody in Timbuktu will buy a laptop using your credit card details, and you'll find out that somebody's used your personal information to apply for 40 different loans completely destroying your credit rating, or someone will siphon your life savings into a cayman islands bank account.

Good luck, and happy browsing.

Answer 2

You can never know if your PC is already infected or not. Anti virus will only go so far and malicious code can be hidden in many parts of the hard drive. You might be able to tell by listening to the traffic coming from your computer.

A good way to know when your system has been compromised to:

1. Install a known good operating system.
2. Install any updates for the OS.
3. Install any software needed.
4. Remove any unnecessary files.
5. Perform a hash on all files on the hard drive (md5summer)
6. Create a list of all files on the hard drive

After you suspect an intrusion, or for maintenance, or installing an Anna Kournikova screensaver.

1. Compare a new hash with your old hash and report any files that were changed.
2. Find any files that were added.
3. Determine whether or not the changes are valid.

Answer 3

I'll add my two cents to the other excellent answers:

A great way to be aware of whether your PC is infected is by doing exactly what you're doing now: learning. Most malware spreads through user ignorance. If you don't know what malware can do or how it gets onto your machine, you'll be much less alert to its presence. You don't even need an in-depth knowledge.

The user is the greatest vulnerability a computer can have.

Answer 4

To add to what has already been said, keep your actions in check. Even with all the AV software and precaution measures, the best thing you can do to keep your system safe is to actually use the system responsibly. This includes:

• Install software only from verified sources. If you can download a program from the original source, do that. Downloading from third party hosting / mirroring services is inherently more risky. Compare the file hashes for downloaded software, to make sure the files had not been compromised.

• Don't install pirated or "patched" software. This one is obvious, yet so many people think that pirated software is safe. It had been tampered with on purpose, and even if the original intention of the party that altered it had not been malicious, it still may have opened various attack vectors.

• Secure your internet usage and browse responsibly. Disable all the unnecessary plugins, most computers still get infected by drive by downloads or carefully crafted social engineering. Run with NoScript or a similar add-on, and only allow known hosts to run JavaScript / Flash / Java etc. Keep your browser, Flash player, Java etc. up to date to prevent known exploits from harming your machine. Don't download anything you are being asked to download out of the blue, this includes "system optimization" software, unknown antivirus software or anything else that pops up claiming it will "protect you", use only well researched and endorsed security software you have researched beforehand.

• Keep your OS up to date at all times.

• Run a restrictive and properly configured firewall, monitor all incoming and outgoing connections and make sure that network is accessed only by processes and programs that have a valid reason to connect to the network.

If you adhere to all the tips from the answers to your question, you will have substantially minimized the chances of infection by malicious software, and any infection will likely be pretty easy to identify as you will have a pretty good understanding of your past actions and changes in system behavior that resulted from the actions.

Stay safe.

Answer 5

Well, if by PC you are referring simply to the Hardware, then I would say installing Linux (I use Ubuntu) is your best bet. I have never experienced any known viruses on any of my Ubuntu machines and there is also a cool command on all Linux systems called "find" which when used like "find -mtime -1" shows what files were made in the last day, so can monitor the computer's new files if you're ever feeling suspicious. Using other options instead of "-1" would produce different ranges. For instance, using "-5" would show all files made in the last five days, and "+3" would show all files made before the last three days.

If you're set on using Windows, which in my opinion would only make sense for a couple of reasons (mainly if your sole desire is to play very cutting-edge games), then your biggest friend is going to be Microsoft's Security Essentials, which is one of the best parts of the Windows Operating system these days, in my opinion. It seems at some point, fairly recently, Microsoft realized that if their computers kept being so susceptible to viruses they'd stop being the largest platform. So they stepped up to the plate.

tl;dr use MSE for Windows or just switch to Linux like a man (jk, jk, I love all the Windows users out there)