I recently watched Keith Barker's demonstration on how to detect malware with different features of the free REMnux...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
tool. Do you have any other free antimalware tools you'd suggest using to find malware on infected machines?
One of the best places to find free information security tools is SecTools.org's Top 125 Security Tools list, which rates both antimalware tools and rootkit detectors. It's periodically updated based on feedback from the information security community. SANS also has a short primer on malware analysis that includes additional tools. However, note that many of these tools require significant knowledge about the systems under investigation, and it may be best to use these tools in a lab setting before doing so in the field.
I have found that some of the most useful tools for beginners conducting malware analysis are the Windows Sysinternals tools. Note that security teams should always analyze malware on a test/isolated system because it is likely that the system will become infected. Organizations could conduct these tests in a virtual machine, but some advanced malware is able to detect a VM and will then behave differently. You can use the filemon tool to monitor what files are accessed by the malware, or regmon tool to monitor access to the registry. By monitoring file and registry access, you can get a better idea of the activities occurring on your systems. You could then use process explorer to take a more in-depth look at the running processes from the malware.
There are two basic types of tools that can be used to find malware on an infected machine: one set of tools will look for known malicious signatures or behavior while the other will be for an advanced user to investigate in-depth to identify advanced malware on an infected machine. Signature- or behavior-based tools are often the commercial tools from McAfee, Symantec, etc. or open source tools such as ClamAV. Many times the advanced tools will be highly customizable, or feature a general toolkit that may take significant effort to use, such as Microsoft system internal, or Sysinternals, tools.
Ask the Expert!
Want to ask Nick Lewis a question about enterprise threats? Submit your question now via email! (All questions are anonymous.)
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
When NSA cyberweapons went public, attackers bundled them into the EternalRocks malware. Nick Lewis takes a closer look at this new threat and ...continue reading
A Google Docs phishing attack used OAuth tokens to affect more than a million Gmail users. Nick Lewis explains how it happened, and how to defend ...continue reading
A vulnerability in Microsoft's Windows Defender antivirus tool left users open to remote code exploitation. Expert Nick Lewis explains how it ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.