1

Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around.

Basically just wanted to see how 500m+ user records were kept and what info was released( it was pretty much all publicly scrapable data with ocassional email address.)
Curiosity satisfied, I guess.
BUT.. what is this! Slowed response, unusually high resource usage, ridiculous boot times, amongst other things this laptop just got a lot worse! Could it be... has BonziBuddy finally returned? No seemingly just another piece of malware...

...no results from Defender, MalwareBytes, all the big names.
Well to be expected I guess when you download dodgy shit, but I'd love to know what is happening in the background of my computer right now.


So my hopefully decipherable question is this:

1 Ignore anti-virus programs.

2 Using the simple tools we have at our disposal(taskmanager/monitoring active net connections/sniffing packets with wireshark.) Is it possible for a layman to figure out exactly what is going on in the background of their computer?

I can open wireshark but I cannot figure out what is what, going where, or for what purpose(admittedly I know nothing about this software)

I can run netstat, which is like the simple-mans wireshark without the packets displayed, look at active connections and corresponding local address and foreign address, along with PID, trace that to an executable, but do I know what is actually happening?

Is it impossible to see exactly what processes are doing what because without the original code we end up with undecipherable compiled jargon?

I can see files behaving strangely(unprecedented resource hog) but that alone is meaningless, what is it actually doing and can I find out?

To those people understand my ramblings and this field of computing a bit more and are impartial enough to want to shed light, what do YOU do when you have had an infection slip under the radar? Restore/Reformat? Do you use virtual machines on suspect files? What are your red flags? Dont you ever have a desire to pirate software you cant allow yourself to buy, because its for a short period of time or the use is not for commercial gain but simply out of good old primate curiosity?

3
  • 1
    This is a pretty broad question and various sub-questions of it are already covered on this site. Please keep your question more focused and ask only about the parts not covered already here or which are not covered sufficiently in your opinion. In the latter case please reference what you've already researched and in what aspects the answers are lacking. – Steffen Ullrich Apr 16 at 22:16
  • 1
    Here are some answers to your question, which is too broad anyway and probably going to be closed. The "professional" way to clean a system is to wipe it out and reinstall everything, including data from clean backups. If you want to test some software and reduce the risk of infection, just test it in a virtual machine. If you want to find out how malware works and what is going on on an infected machine, you basically need to be a security researcher, or at least have a solid background in that area. – reed Apr 16 at 22:33
  • 1
    Malware infections do not necessarily cause your computer to slow down or even cause any noticeable difference in behavior. It's only when there is sloppy programming in the malware that causes errors or if the malware starts sending spam or similar activities that it is noticed. Could you elaborate on what you downloaded and if you executed any executable files? – Alex Cannon Apr 16 at 23:08