0

I know there are options of free security softwares out there that do good job like malwarebytes, but I really want to learn how to scan for possible threats of malicious files on your pc manually. I know you could check irregular and unfamiliar activities and processes on computer with process manager in windows, but I am worried that some malicious files could hide their processes or that they quit their processes when they have detected that you have opened process manager or security softwares such as malwarebytes or antivirus softwares. Is there a way to access a log of all the changes made and are being made to windows, recent and ongoing processes so one could narrow down suspicious files instead of having to keep surveilance on process manager all the time. And are there other ways to scan for threats in pc manually-- such as checking some system files. Also, could someone tell me how those security programs scan for threats themselves? And how do i know whether the scan method employed by them are thorough and trustworthy? And are security programs such as kaspersky, avg, sophos efficient in finding threats at all?

And usually how do you find ways to remove the threats? by Google alone? are there some online forums or communities where you could find people to ask for help fixing your infected pc, or some database for removal methods of malicious files? And if you cannot be certain what kind of malicious files your system has been infected with after googling and scanning with security softwares, where should you turn to for help?

2

Basically what you ask is how can you become your computer's Anti-Virus. Simple answer - you can't.

You can make or find scripts which will give you some indicators of compromise for your system and start looking at them suspiciously, you can explore through processes and their insights, you can analyze your network traffic and see what's not good here. You can learn how to monitor your system with Windows Management Interface and PowerShell (i assume you work on windows for this one). You can also take snapshots of your system and compare them. You may also use or write tools to check the signatures of your files with Yara rules and see if you get any malicious hits. You will learn tons of stuff, but still, you may be missing something. It's not worth compromising your system for something like this.

So basically, you will be doing by hand what a good AV does. Scan files based on their signatures database and/or process behavior. Check for changes in the filesystem and registry keys, suspicious network traffic and strange strings. The difference is you will be doing it slower, less efficiently and not in real time.

If you want to learn stuff about analyzing and thus tackling malware set a nice virtual environment, get to learn static and dynamic analysis, some tools that will help you and start learning your OS's insights. Find a nice malware sample list and off you go. But you can't replace an AV and you shouldn't either. That's what it's made for, speed and efficiency in detecting and blocking tons of known attacks and trying to detect unknown ones, based on behavior.

P.S. Feel free to ask anything below :)

  • Thank you. No its just sometimes i am too paranoid to believe my AV does a good job and also i need some knowledge to be reassured that my pc is safe and sound and my data uncompromised. Basically i'd like to learn about how to analyse systems and program behaviours and how to check whether some important files are infected....which are so important i cant trust someone else. how do i get started with virtual environment (i think you mean like virtual machines or sandboxes?) and system analysis? are there tutorials online or do i need physical textbooks? – Jack the Ripper Oct 17 '18 at 22:27
  • Virtual machines are the A and Z. A good virtual lab with various OSes and tools should be ont op of your list to get started. There are other technologies as well, like containers, sandboxes etc., but you will see them in time. What you want to look out for (to study) is "digital forensics". It's good to focus either on windows or linux, but you will get a taste of both and will probably work with both whether you like it or not. Try to find some challenges online as well. www.hackthebox.eu and www.root-me.org have various ones. Study, experiment, try, don't give up at once! – Chris Tsiakoulas Oct 19 '18 at 13:55
1

Perhaps you might be interested in threat hunting and reverse engineering. Learning the fundamentals of threat hunting will help you understand what to look for on your system in terms of potential security threats, and learning reverse engineering will help you become more familiar with how your system and the programs designed to run on your system function. It sounds like you are using a Windows system, so these may prove useful to you:

These resources will allow you to answer many of your own questions. Happy hunting.

  • Thank you. Also is there some fast way to find out whether a software is trustworthy in general beforehand through doing online researches? Whenever I look for the information of a particular software on google, it is not certain that there will be candid information on whether the software is malware, or that sometimes you simply cant find any info on it but you have to use the software badly. And how do you find out whether a software download site is trustworthy. (like majorgeeks lots of positive comments but i just am not sure about it) – Jack the Ripper Oct 19 '18 at 11:06
0

There are a lot of good answers here already that I would recommend you look into. My only suggestion is work with a mix of tools and knowledge gained from various books/PDFs/videos on how to find and asses files, know what you are looking for.

I once found a crypto variant on a prod server of a client because i noticed the CPU spiking and a cursory search for the word "bitcoin" or "BTC" or for files with periods after their extension e.g. "file_name.exe.WHATEVER"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.