Saturday
Dec132008
Uncovering a Virus/Trojan
Getting done with the first part really got my juices flowing. I was shopping looking and thinking about this next article. I came up to only one option turning this into a 3-5 length post due to all the content that I will have. So where did we leave off? Oh that is right figuring out if you have a virus/Trojan. The instant I made a post about this 12 hours later someone make a comment and here is what he said:
[ad#ad2-right]
Now the truth is anytime a Virus does something it usually leaves a footprint somewhere and somehow. Even the hardest working hacker can't plan for all possibilities and that is where we begin. I have been helping people for a while with viruses and know that no matter how hard the virus tries to hide you can usually find it relatively quickly and easily do to virus check here are the ways I've done to figure out if they may or may not have a virus/Trojan.
Now if this is a client's computer and you don't want to be rude to the client, there are a few indications of user error and installing a virus. This is relatively simple, all you do is do a quick inventory of all the start menu programs. You'd want to look for any P2P file sharing program, If they have Firefox Installed, and if they are using Window Mail and not Thunderbird. You see 80% to 90% of virus downloaded are installed by the End USER. They either downloading a game and installing a virus with [ad#ad2-left]a game, or not protecting themselves by using Internet Explorer or Using Windows Mail. That is usually my first step due to the fact, I've got to be diplomatic about finding out about security ways. Also make sure they are up to date on there Window updates, unless they are using a really old system then you will have to work even harder. Also you can suspect a virus if the client is talking about having problem with a program recently although this isn't always true it sometimes is the case due to the fact hackers don't have a big chance to test these viruses/Trojans out before they set them into the wild. So there are always going to be unplanned problems associated with them.
After the first initial search of desktop, you should really know the likely hood of a possible virus getting on the system and later we will talk about counter measures to prevent virus attacks in the future. There are a few places a hacker likes to put commands. Hackers love to put in the Registry to run a program every time Windows starts. It usually in:
These are just a few but if you look hard enough it can be found most of the time. Most of the time I use the registry to tell me where these programs are so I can do a further check of the program. Some of this is not needed with some of the programs that I recommend but this is for those who want to be a through job and make sure the virus is gone.
On my next post we will talk about some good tools for the trade to help get rid of a virus/Trojan. This little step here is used to better help identify a virus and also give you chance to google each name on the list of registry and the hard drive to see if you can identify the virus.
[ad#ad2-right]
Rene Van Belzen
I can't wait to read part two of this article. I always wondered how you'd know you're infected if a virus don't want to be detected and no virus definitions are yet available, because the virus is so new.
Now the truth is anytime a Virus does something it usually leaves a footprint somewhere and somehow. Even the hardest working hacker can't plan for all possibilities and that is where we begin. I have been helping people for a while with viruses and know that no matter how hard the virus tries to hide you can usually find it relatively quickly and easily do to virus check here are the ways I've done to figure out if they may or may not have a virus/Trojan.
Now if this is a client's computer and you don't want to be rude to the client, there are a few indications of user error and installing a virus. This is relatively simple, all you do is do a quick inventory of all the start menu programs. You'd want to look for any P2P file sharing program, If they have Firefox Installed, and if they are using Window Mail and not Thunderbird. You see 80% to 90% of virus downloaded are installed by the End USER. They either downloading a game and installing a virus with [ad#ad2-left]a game, or not protecting themselves by using Internet Explorer or Using Windows Mail. That is usually my first step due to the fact, I've got to be diplomatic about finding out about security ways. Also make sure they are up to date on there Window updates, unless they are using a really old system then you will have to work even harder. Also you can suspect a virus if the client is talking about having problem with a program recently although this isn't always true it sometimes is the case due to the fact hackers don't have a big chance to test these viruses/Trojans out before they set them into the wild. So there are always going to be unplanned problems associated with them.
After the first initial search of desktop, you should really know the likely hood of a possible virus getting on the system and later we will talk about counter measures to prevent virus attacks in the future. There are a few places a hacker likes to put commands. Hackers love to put in the Registry to run a program every time Windows starts. It usually in:
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\
Usually 50% to 70% of virus like to make sure the program to runs. This is a flaw in Windows because hackers can edit this without much effort but there isn't many places a hacker can go to make sure a program is set to run when you boot. So this is also a benifit to finding those little programs.
Now just like the Regisitry, Hackers also like to put programs in a few areas on the hard drive. This is also kinda hard to hide because most of the time these are consider important to the system but if you know what to look for you can pretty much figure out if it is truelly a system file. These areas of the hard drive are:
- C:\WINDOWS\System32[ad#ad2-right]
- C:\WINDOWS
- %programfiles%\common files\microsoft shared
- %windir%\temp\
These are just a few but if you look hard enough it can be found most of the time. Most of the time I use the registry to tell me where these programs are so I can do a further check of the program. Some of this is not needed with some of the programs that I recommend but this is for those who want to be a through job and make sure the virus is gone.
On my next post we will talk about some good tools for the trade to help get rid of a virus/Trojan. This little step here is used to better help identify a virus and also give you chance to google each name on the list of registry and the hard drive to see if you can identify the virus.
|
Post a Comment | in Computer, Content, CurrentVersion, Explorer, FIREFOX, Game, HKLM, Hackers, Installed, Internet, Mail, Microsoft, Registry, Rene Van Belzen, Security, Software, Someone, Start Menu, Thunderbird, Trojan, Virus, Vista, WIndows, Window, Windows, Windows Vista, cl, client, date, drive, fact, file, footprint, hacker, internet explorer, inventory, length, matter, menu programs, option, p2p file sharing program, post, rene van, something, start, system, user, user error, using internet, virus check, virus definitions, virus removal, virus trojan, while, window updates 
