How Do You Detect for Possible Infections?

Discussion in 'polls' started by guest, Aug 4, 2013.

?

How Do You Detect for Possible Infections?

  1. My real-time antivirus (Avast, MSE, etc)

    62.5%
  2. On-demand scanner (HitmanPro, Malwarebytes, etc)

    79.7%
  3. Online service (VirusTotal, Jotti, etc)

    23.4%
  4. Process viewer (Process Explorer, Process Hacker, etc)

    28.1%
  5. Manual inspection (See if you have a malicious DLL in your system32 folder, etc)

    7.8%
  6. Other method (Please mention it in your post)

    15.6%
  7. I don't detect for possible infections

    3.1%
Multiple votes are allowed.
  1. Overkill

    Overkill Registered Member

    Joined:
    Mar 16, 2012
    Posts:
    2,343
    Location:
    USA
    It depends, I mainly use hitmanpro usually daily but sometimes i'll use mbam or eek and I may even use killswitch once in awhile.
     
  2. aztony

    aztony Registered Member

    Joined:
    Sep 9, 2012
    Posts:
    737
    Location:
    The Valley Arizona
    I rely on my AV to do the heavy lifting, my firewall is a nice complement, and I run weekly scans with MBAM.
     
  3. theharlequin

    theharlequin Registered Member

    Joined:
    Nov 5, 2012
    Posts:
    24
    Location:
    Australia
    On-demand scanner: HitmanPro, Malwarebytes
    Online service: VirusTotal
    Other: MJ RegWatcher
     
  4. Noob

    Noob Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    6,491
    Real time and On demand scans. :D
    Additionally i check the HIPS rules every now and then.
    Used to do some tweaks to Windows in Windows 7, have not done anything in Windows 8 yet.
     
  5. Behold Eck

    Behold Eck Registered Member

    Joined:
    Aug 23, 2013
    Posts:
    574
    Location:
    The Outer Limits
    Real time, on demand, killswitch and comodos file scanner on Win7 and XP.

    Tweezers,cotton buds, mirrors, petri dishs, miroscope, metal detectors, x-ray machines and body scanners on myself.
     
  6. noone_particular

    noone_particular Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    3,798
    If I have a reason to suspect a problem, I run an integrity check of all the files in the Windows directory, all of its subfolders, and everything in Program Files. I also create a complete filelist of everything on the system drive and compare it to an existing file list that's kept in encrypted storage.

    If I'm still suspicious after that, I boot to an alternate OS, create a new file list from there, then compare it to the list created from within Windows. This will expose any hidden files.

    If I suspect unwanted changes or additions to the registry, I restart the system. My entire registry is replaced by a clean, optimized copy on every reboot.
     
  7. mattdocs12345

    mattdocs12345 Registered Member

    Joined:
    Mar 23, 2013
    Posts:
    1,892
    Location:
    US
    Your security solutions are just way beyond of what I can comprehand right now :)
    But how often does you Windows 98SE actually get infected? I assume that nobody makes malware for older Windows anymore so it can't be much.
     
  8. noone_particular

    noone_particular Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    3,798
    Integrity checkers have been around since Win 95 or earlier. They create hashes of the files or folder contents that you select. When you run it again, it repeats the process and compares the new hashes to the previously made ones. If the file hash changes, the file has been changed. This is best suited for executables, DLLs, config files, etc. The file hashes do need to be recalculated after system updates, new installs, etc.

    File lists work in much the same way except that more of the process is done manually. You make a list of everything on your system from a command prompt. When you want to check, you make a new list and use a comparison tool to highlight the differences. Rootkit infections can hide files from Windows and tools run from within Windows. By comparing lists made from within Windows to ones made from another OS, you can see files hidden by rootkits. On 98 systems, you already have that 2nd OS, DOS. You can also use a separate XP or linux system or a live CD.

    These methods work the same on any OS. The only things that change are the files that you keep tract of and where they're located. They're best suited for systems that don't change much. The more you install, remove, update, etc, the harder it gets to keep the hashes and file lists accurate and up to date. It also helps a lot if you put your operating system and data on separate partitions.
    AFAIK, my system has been compromised twice, both times in 2004. The first was a virus that crashed Norton Internet Security. The second time I was hacked. Norton Internet Security logged the entire event, including giving executables internet access and did nothing to stop it. Needless to say, that was the last time I used anything Norton/Symantec

    Almost nobody directly targets 9X systems any more, 3 letter agencies not included. That said, a significant percentage of malware will run on any version of Windows. A growing percentage of malware targets user applications like the browser. If that malware is intended to steal credentials, credit card info, etc, or is to just de-anonymize you, the OS you're using won't matter nearly as much as which browser you're running and how you have it configured and protected.
     
  9. tomazyk

    tomazyk Guest

    I run daily scan with HitmanPro. Anything suspicious is uploaded to VirusTotal using VT Uploader.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.