Scan for infection of malicious files manually?

Question

I know there are options of free security softwares out there that do good job like malwarebytes, but I really want to learn how to scan for possible threats of malicious files on your pc manually. I know you could check irregular and unfamiliar activities and processes on computer with process manager in windows, but I am worried that some malicious files could hide their processes or that they quit their processes when they have detected that you have opened process manager or security softwares such as malwarebytes or antivirus softwares. Is there a way to access a log of all the changes made and are being made to windows, recent and ongoing processes so one could narrow down suspicious files instead of having to keep surveilance on process manager all the time. And are there other ways to scan for threats in pc manually-- such as checking some system files. Also, could someone tell me how those security programs scan for threats themselves? And how do i know whether the scan method employed by them are thorough and trustworthy? And are security programs such as kaspersky, avg, sophos efficient in finding threats at all?

And usually how do you find ways to remove the threats? by Google alone? are there some online forums or communities where you could find people to ask for help fixing your infected pc, or some database for removal methods of malicious files? And if you cannot be certain what kind of malicious files your system has been infected with after googling and scanning with security softwares, where should you turn to for help?

Answer 1

Basically what you ask is how can you become your computer's Anti-Virus. Simple answer - you can't.

You can make or find scripts which will give you some indicators of compromise for your system and start looking at them suspiciously, you can explore through processes and their insights, you can analyze your network traffic and see what's not good here. You can learn how to monitor your system with Windows Management Interface and PowerShell (i assume you work on windows for this one). You can also take snapshots of your system and compare them. You may also use or write tools to check the signatures of your files with Yara rules and see if you get any malicious hits. You will learn tons of stuff, but still, you may be missing something. It's not worth compromising your system for something like this.

So basically, you will be doing by hand what a good AV does. Scan files based on their signatures database and/or process behavior. Check for changes in the filesystem and registry keys, suspicious network traffic and strange strings. The difference is you will be doing it slower, less efficiently and not in real time.

If you want to learn stuff about analyzing and thus tackling malware set a nice virtual environment, get to learn static and dynamic analysis, some tools that will help you and start learning your OS's insights. Find a nice malware sample list and off you go. But you can't replace an AV and you shouldn't either. That's what it's made for, speed and efficiency in detecting and blocking tons of known attacks and trying to detect unknown ones, based on behavior.

P.S. Feel free to ask anything below :)

Answer 2

Perhaps you might be interested in threat hunting and reverse engineering. Learning the fundamentals of threat hunting will help you understand what to look for on your system in terms of potential security threats, and learning reverse engineering will help you become more familiar with how your system and the programs designed to run on your system function. It sounds like you are using a Windows system, so these may prove useful to you:

• The Endgame Guide To Threat Hunting: Practitioner's Edition (Note that the intended audience are practitioners in an enterprise environment, but many of the concepts will still apply when working with a single system, Regardless, it is good exposure).
• https://github.com/tylerha97/awesome-reversing
• https://github.com/0x4D31/awesome-threat-detection

These resources will allow you to answer many of your own questions. Happy hunting.

Answer 3

There are a lot of good answers here already that I would recommend you look into. My only suggestion is work with a mix of tools and knowledge gained from various books/PDFs/videos on how to find and asses files, know what you are looking for.

I once found a crypto variant on a prod server of a client because i noticed the CPU spiking and a cursory search for the word "bitcoin" or "BTC" or for files with periods after their extension e.g. "file_name.exe.WHATEVER"