I recently watched Keith Barker's demonstration on how to detect malware with different features of the free REMnux...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
tool. Do you have any other free antimalware tools you'd suggest using to find malware on infected machines?
One of the best places to find free information security tools is SecTools.org's Top 125 Security Tools list, which rates both antimalware tools and rootkit detectors. It's periodically updated based on feedback from the information security community. SANS also has a short primer on malware analysis that includes additional tools. However, note that many of these tools require significant knowledge about the systems under investigation, and it may be best to use these tools in a lab setting before doing so in the field.
I have found that some of the most useful tools for beginners conducting malware analysis are the Windows Sysinternals tools. Note that security teams should always analyze malware on a test/isolated system because it is likely that the system will become infected. Organizations could conduct these tests in a virtual machine, but some advanced malware is able to detect a VM and will then behave differently. You can use the filemon tool to monitor what files are accessed by the malware, or regmon tool to monitor access to the registry. By monitoring file and registry access, you can get a better idea of the activities occurring on your systems. You could then use process explorer to take a more in-depth look at the running processes from the malware.
There are two basic types of tools that can be used to find malware on an infected machine: one set of tools will look for known malicious signatures or behavior while the other will be for an advanced user to investigate in-depth to identify advanced malware on an infected machine. Signature- or behavior-based tools are often the commercial tools from McAfee, Symantec, etc. or open source tools such as ClamAV. Many times the advanced tools will be highly customizable, or feature a general toolkit that may take significant effort to use, such as Microsoft system internal, or Sysinternals, tools.
Ask the Expert!
Want to ask Nick Lewis a question about enterprise threats? Submit your question now via email! (All questions are anonymous.)
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
The OurMine hacking group recently used DNS poisoning to attack WikiLeaks and take over its web address. Learn how this attack was performed from ...continue reading
Typosquatting was used by threat actors to spread malware in the NPM registry. Learn from expert Nick Lewis how this method was used and what it ...continue reading
Threat actors are using phishing email campaigns to fool users with tech support scams and fake Blue Screens of Death. Learn how these campaigns work...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.