Virushunt

How to find virus on a computer?
1. Close all programs do nothing on yore computer, if youre network connection is sending and receiving data it could be virus.

2. Is the computer slower than usual.

3. Is youre antivirus working? Test here

4. Check MSCONFIG (Click start run msconfig)
Do you recognise everything in the startup folder?

5. When did the computer start acting strange? Search files that has been added after the computer started acting strange. (especially .exe files)
search google if you find a suspicious file, it usaly say if the file is legitimate.

6. Processes (Ctrl + Alt + Delete, Task manager, Processes)
Look for unknown process, if they use memory or CPU.

7. Sessions (Rightklick my computer and klick manage, click shared folders and sessions).
see if someone is connected to the computer.
see if there is some new user under "local users and groups".
See if there are some unknown services under "services and aplications"

8. Open internet explorer, click tools, internet options, Advanced, Reset Internet explorer settings.

9. List hidden system-folders. Click Start, run, cmd, go to the folder you want to se if it is any hidden folder in and write dir /as

10. List all exe-files in dateorder and folderorder from wher you is, and have a log on it. ( Click Start, run, cmd, go to the folder you want to start from, write Dir \*.exe /od /s >logfile_exe.txt

11. List all folder in dateorder from wher you is, and have a log on it. ( Click Start, run, cmd, go to the folder you want to start from, write Dir /ad /od /s >logfile_map.txt

12. See which Connections youre computer have and which ports in use (Click Start, run, cmd, write Netstat –an

13. List files in dateorder (Click Start, run, cmd, go to the folder you want to start from, write dir /od

14. List files with hidden attribute (Click Start, run, cmd, go to the folder you want to see if there is hidden files in and write dir /ah

15. Fport.exe See the ports, service and networkconnections runing on the computer.

16. Silentrunner Check for registry-values that dont use to be there.

17. HiJackThis Scan the Registry and hard drive for spyware

18. Process Explorer – Shows a list on active processes, includes name on process files.

19. TCPView - Shows a list of all TCP och UDP portar on youre system, host och source adress on TCP connections.

20. Processmonitor - monitoring tool for Windows that shows real-time file system.

21. Autoruns – Shows what autoruns in windows.

22. Unlocker – If a file is locked, unlock the file with this tool.

23. Smartsniff - Check the tcp/ip traffic that passes youre networkcard.

24. processlibrary.com a online library of processes tells the exact nature and purpose of every process that should, and should not, be running on a PC.

25. www.virustotal.com - If you find a suspicious file, upload it to virustotal.com.
T he file get analyzed and you get to know if it is a known virus.

26. If a virus want to shutdown youre computer (counting down) Start run: shutdown -a