up vote 1 down vote favorite
share [g+] share [fb]

Let's say one of the users on my home computer opened a questionable executable / image / document or allowed a questionable website through NoScript. I'm sure it's possible to have malware (or a rootkit) installed and running on your computer that does not present any sort of unusual behavior but still keylogs / sniffs packets / whatever. However, how likely is such a scenario (except for Sony rootkits)? How likely is it that your computer is running a very covert bot?

If you suspect your system might have been compromised in spite of the lack of symptoms, what tests can be run or what steps can be taken to improve a reasonable user's peace of mind? Avira Rescue System, NOD32, Comodo Firewall, Spybot, HiJackThis - anything I could add to that?

I know questions about malware are rampant on SU, but I am specifically interested in experiences people have had with intrusions showing rare and subtle symptoms.

Yes, I am paranoid. Help set me straight.

Thanks.

Note: This is now a community wiki.

link|improve this question
1  
If you're interested in people's experiences, there's no real answer - so this should be community wiki. Good question, though :) – Phoshi Mar 1 '10 at 15:39
That's a very good idea, thanks. I've turned it into a wiki. – alexsome Mar 1 '10 at 17:31
feedback

3 Answers

up vote 1 down vote accepted

A way to test this would be using the program Sandboxie. Sandboxie allows you to run an application in a sandbox, then see any changes it made because it creates virtual versions of the files in order to make the program not see a difference. By going through those files, you may be able to spot any wrongdoing.

That said, t's a matter of probabilities. Of the set of possible malware, a small subset are rootkits that actively avoid being spotted as running. From there, it's a small subset that wouldn't be detectable by antivirus. From there, it's yet a smaller percentage that wouldn't have any immediate effect on things such as programs running or Internet connections.

It terms of being sure, it's effectively impossible to be sure that it's not, for example, a trojan that is just waiting for 2011 to activate. If there's no sign, no detection, no effects, and you don't see anything wrong with the files it installed, I think you can rest relatively easy. I mean, you have no way of being sure you haven't been infected by a zero-day root-kit worm, either.

link|improve this answer
feedback
up vote 1 down vote

Run any sort of popular antivirus/antimalware software. Whatever malware exists will almost surely make an attempt to block an installation or running of the software. Software such as Malwarebytes, AVG, RootRevealer, etc. will not run.

link|improve this answer
feedback
up vote 1 down vote

Once you've been compromised (or you think you've been compromised), there is really no way to assuage your paranoia - your computer simply can't be trusted anymore.

Time to reformat and reinstall windows - it's the only way to be sure.

link|improve this answer
+1: That's perfectly true; however, I see no reason anyone should believe they haven't been compromised unless they don't use their computer at all. After all, if rendering an image can be used as a method of infection, you're basically unsafe the minute you open a web browser. As Zurahn's answer pointed out, you could get infected by a zero-day root-kit, so really all one can do is look for reasonable steps to get to the point of "resting relatively easy". – alexsome Mar 1 '10 at 17:53
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.