How to avoid getting infected / remove malware
by Sozin -

Nan Ihier Gelair Mordor


Jan 2015




1 Year of Service
How to avoid getting infected / remove malware
Thread starter

You are free to have this leak but bear in mind, it's not mine, so don't bother me if the links/program/source/whatever stop working. I take no responsibility of this, use at your own risk.

1.1 Scanning [Image: 4nerSv0.png]
Make sure to scan all the files you download onvirustotalormalwr.
They givecriticalinformation about programs.
Such as if it starts on launch, steals information etc.
Even if it the scanned file has 0 detections, you are still vulnerable.
I really like this one, it think it gives as much information asSysanalyzerwhich I will get to.
[Image: 1f556254f6bc59082a4de2519cd092a7.png]
Keep in mind that, Malwr also provides screenshots of the file it launched.
Malwr.comis not considered a Virtual Environmentso anti-vm has no effect.
More information it provides
[Image: f6012fb236445044d7e4c89ff219f3bc.png]
Virustotal doesn't go as deep as does, it was made for scanning but also shows
a slight amount of information of the program that has been ran.
I recommend to scan on Virustotal since they distribute, meaning if the malware is undetected,
it will soon be detected. (They send samples to AV companies)
1.2 Sandboxie [Image: cK2cyfI.png]
This tool is pretty cool, you can run programs in it without having the risk of getting your machine infected.
Keep in mind that Password Stealers still work in a sandboxie, As mentioned by Zoinexion.
Check out his thread for more information regarding Sandboxie.
You can download Sandboxie here.
1.3 Virtual Machine [Image: WqicLTi.png]
A Virtual Machine is roughly said a machine in a machine. So if you have windows for example,
you can create a virtual machine with another copy of windows.
Anything you do in that Virtual Machine cannot harm your main computer.
Image of a VM
[Image: fdcb1b072e64ad75a58a351409409a46.png]
These are great to use, you can always run programs in a virtual machine, knowing the risks.
If your Virtual Machine is empty, the person who infected you can't do much.
He can still open your CD tray though.
You can download VMware Workstation here.
1.4 Sysanalyzer [Image: w97xMA9.png]
This is one of my favorite, it shows you exactly what a program does after you launched it.
Keep in mind this is not a sandbox, so it is recommended to run it in a VM.
Image of the UI
[Image: 75f7bfc5d21f2148b714bfc31648ac0b.png]
After running malware with it, it shows me that it made some registry changes. This is often for startup and persistence.
Registry changes
[Image: 2279a9c3563d74eab48d9dc01f586939.png]
Processes that started running after launch
[Image: 6e5c5313e2207e3a519d2b21b5b9d003.png]
Connection logs


[Image: 625d5ca6a6ee18e72ed3e019ec63fdcd.png]
7:26:50 PM B48 /AutoIt3ExecuteScript "C:\Users\Ferat\AppData\Local\Temp\611515" /AutoIt3ExecuteScript "C:\Users\Ferat\AppData\Local\Temp\611515"
7:26:50 PM D88 TERMINATED croror.exe
7:26:51 PM FE8
7:26:51 PM B48 TERMINATED croror.exe
7:26:53 PM 810 TERMINATED dllhost.exe
7:26:53 PM D70 /AutoIt3ExecuteScript "C:\Users\Ferat\AppData\Local\Temp\712196" /AutoIt3ExecuteScript "C:\Users\Ferat\AppData\Local\Temp\712196"
7:26:53 PM FE8 TERMINATED imnotavirus.exe
7:26:54 PM 694
7:27:00 PM 694 TERMINATED vbc.exe
Here you can see that it executed a script, terminated the original file, executed another script and then launched the process with the name I gave it.
You can get Sysanalyzer here.
1.5 Up to date AVs [Image: RMZXZWm.png]
I really recommend people to get Eset Nod32. It is usually one of the fastest AV to give malware detections.
Even if you are infected, give it a week max, run a scan and you should be good again.
Most people have a hard time crypting against eset nod32, and even if it is undetected, it won't be long before it is detected.
But that isn't the main reason why I like Eset Nod32.
It also gives you this cool feature.
[Image: 18f21436b6cd5d92f58007ac8ea2f8b4.png]
It shows you a list of all running processes.
All you need to do is pay attention to these:
[Image: 13e58a338884dfda36e9a9ee5f8efd14.png]
The ones with theexclamation marks indicate that the process is new.
Note that if you are running 32 bit, some malware will be able to hide them selves from the process list.
You can get Eset Nod32 here.
1.6 Trust and Ending [Image: 3xDYXV9.png]
Check if the person from who your download is, is trusted. Always read the comments and check the feedback.
Also try look at your processes and see if you find something suspicious.
If you follow this guide, I am sure you will stay safe on the internet.
Keep in mind that smart malware does not have anti-sandboxie, nor anti-vm.
They could've been bound to an actual program with a delay of 5 minutes before startup.
If a program works, it doesn't mean its not infected.
I wrote this one myself, it is not a leak but I don't know where else to post it.

Do not let your difficulties fill you with anxiety, after all it is only in the darkest nights that stars shine more brightly. - Ali(a.s)

Developer( PHP, Python, C++, HTML+CSS, JS I am available for Hire. Message Me for details.
07-08-2015, 02:56 AM
Find Reply
Register to remove ads

The last reply on this thread is older than a month. Please do not unnecessarily bump it.

Users browsing this thread: 1 Guest(s)